Microsoft-Windows-PushNotifications-Platform

412 events across 4 channels

Event ID	Title	Channel
1	The Windows Push Notification Platform has encountered an error in File: …	Debug
2	The Windows Push Notification Platform has started loading.	Debug
3	The Windows Push Notification Platform has been unloaded.	Debug
4	The Windows Push Notification Platform has been disabled due to Group Policy …	Debug
5	The Windows Push Notification Platform has been loaded.	Debug
6	The Windows Push Notification Platform has started unloading.	Debug
7	The Windows Push Notification Platform has launched as Type with Privilege …	Debug
8	The Windows Push Notification Platform is switching into new NewPrivilege …	Debug
9	The Windows Push Notification Platform has switched with error code Error, and …	Debug
10	The Windows Push Notification Platform has started defragging storage.	Debug
11	The Windows Push Notification Platform has finished defragging storage.	Debug
12	The Windows Push Notification Platform has determined new maximum number of …	Debug
13	The Windows Push Notification Platform has expanded its persistent header …	Debug
14	The Windows Push Notification Platform has switched to using an expanded …	Debug
15	The Windows Push Notification Platform has started loading file data: count …	Debug
16	The Windows Push Notification Platform has created a new memory-mapped file.	Debug
17	The Windows Push Notification Platform has detected that its persistent buffer …	Debug
18	The Windows Push Notification Platform has registered inbox applications.	Debug
19	The Windows Push Notification Platform has encountered an error in File: …	Operational
20	The Windows Push Notification Platform has encountered error ErrorCode opening …	Operational
21	The Windows Push Notification Platform has started processing tile update …	Debug
22	The Windows Push Notification Platform has stopped processing tile update …	Debug
23	The Windows Push Notification Platform is setting URI Uri with recurrence …	Debug
24	The Windows Push Notification Platform has initiated a WNS connection.	Debug
25	The Windows Push Notification Platform is disconnecting from WNS.	Debug
26	ThreadPool: [Name] (InstanceId) has been scheduled.	Debug
27	ThreadPool: [Name] (InstanceId) finished with error code [ErrorCode].	Debug
28	ResourceManager has recevied a message: code [MessageCode].	Debug
29	The Windows Push Notification Platform has started scavenging the image cache.	Debug
30	The Windows Push Notification Platform has finished scavenging the image cache.	Debug
31	The Windows Push Notification Platform has TotalSize entries in the image cache.	Debug
32	The Device has entered battery saver state: BATTERY_SAVINGS_ON	Debug
33	The Device has exited battery saver state: BATTERY_SAVINGS_OFF	Debug
34	The DcpProvider has been loaded successfully.	Debug
35	WNS Platform finished TraceLogging registration with code ErrorCode.	Debug
36	WNS Connection Provider finished TraceLogging registration with code ErrorCode.	Debug
37	The Windows Push Notification Platform is required to connect on startup, …	Operational
38	PDC intialization finished with ErrorCode: ErrorCode.	Debug
39	PDC unintialization finished with ErrorCode: ErrorCode.	Debug
40	PDC activation finished with ErrorCode: ErrorCode, PdcType: PdcType, …	Debug
41	PDC deactivation finished with ErrorCode: ErrorCode, PdcType: PdcType, …	Debug
42	Cloud Notifications must be enabled in GP and MDM to receive push notifications.	Operational
1000	A Connection Provider is registered with Windows Push Notification Platform …	Debug
1001	The following Connection Provider is enabled with the parameters: CLSID [CLSID] …	Debug
1002	The Connection Provider with CLSID CLSID was instantiated with the following …	Debug
1003	Connect request sent to the Connection Provider.	Operational
1004	Disconnect request sent the Connection Provider.	Operational
1005	The Connection Provider status changed to Status.	Operational
1006	Sending a channel request to the Connection Provider with parameters: …	Operational
1007	The Connection Provider completed the channel request for transaction id …	Operational
1008	Sending a channel revoke request to the Connection Provider for channel id …	Operational
1010	group received for ChannelId action and AppUserModelId NotificationType with …	Operational
1011	Sending a request to the Connection Provider to renew a channel with parameters: …	Operational
1012	Setting batching configuration to the following state: BatchingState.	Debug
1013	Configuring notification delivery for AppUserModelId AppUserModelId with channel …	Operational
1014	The Resource Manager was notified that display state changed to DisplayStatus.	Debug
1015	Configuring notification policy for NotificationType [NotificationType] Enabled …	Operational
1016	The Resource Manager was notified of an update to the network cost.	Debug
1017	The Resource Manager was notified of an update to the data plan.	Debug
1018	The Resource Manager reset the Mobile Broadband Usage statistics.	Debug
1019	The Resource Manager was notified that user session state changed to Status.	Debug
1020	The Connection Provider status changed to a failure state: {Status}.	Operational
1021	The Connection Manager has failed to connect: ErrorCode.	Operational
1022	ConnectWork is requesting ConnectionManager to connect.	Operational
1023	No internet connection available, WorkItemName is queued for next network status …	Operational
1024	Internet connection status changed to IsConnected, submitting pending workitems: …	Operational
1025	A Power event was fired: PowerEventType [PowerEventType] IsEnabled [Enabled].	Operational
1100	Connecting to the Windows Push Notification Service.	Debug
1101	Windows Push Notification Service connection result: Error.	Debug
1102	Sending Channel WNP Protocol command: Sending_Channel_WNP_Protocol_command …	Debug
1103	Channel WNP Protocol command tracking information: TransactionId [TransactionId] …	Debug
1104	Sending Revoke WNP Protocol command: Sending_Revoke_WNP_Protocol_command …	Debug
1105	Sending Block/Unblock WNP Protocol command: ChannelId [ChannelId] …	Debug
1106	Sending Options WNP Protocol command: Sending_Options_WNP_Protocol_command …	Debug
1107	WNP Protocol command response: WNP_Protocol_command_response [TrID] TrID [Error] …	Debug
1108	WNP Protocol delivered notification: WNP_Protocol_delivered_notification …	Debug
1109	Disconnecting from the Windows Push Notification Service.	Debug
1110	Windows Push Notification Service disconnection result: Error.	Debug
1112	Requesting Device Compact Ticket for the ConnectionType.	Debug
1113	Device Compact Ticket request completed with Device Id DeviceId for the …	Operational
1114	Sending Filter/Unfilter WNP Protocol command: NotificationType …	Debug
1115	Sending Ack WNP Protocol command: Sending_Ack_WNP_Protocol_command [MsgId] …	Debug
1116	Device Compact Ticket request failed with error Error for the ConnectionType.	Operational
1117	Windows Push Notification Service was disconnected due to error: Error and will …	Operational
1118	Sending Challenge Response WNP Protocol command: Nonce [Nonce] Response …	Debug
1201	WNP Transport Layer Connect call initiated for the ConnectionType.	Debug
1202	WNP Transport Layer Connect call completed for the ConnectionType.	Debug
1203	WNP Transport Layer SendCommand call initiated for TrID CommandTrid on the …	Debug
1204	WNP Transport Layer SendCommand call completed for TrID CommandTrid on the …	Debug
1205	WNP Transport Layer Disconnect call initiated for the ConnectionType.	Operational
1206	WNP Transport Layer Disconnect call completed for the ConnectionType.	Operational
1207	WNP Transport Layer resolving DNS initiated for host HostName for the …	Operational
1208	WNP Transport Layer resolving DNS completed for the ConnectionType with code …	Operational
1209	WNP Transport Layer retrieving proxy information initiated for the …	Operational
1210	WNP Transport Layer retrieving proxy information completed for the …	Operational
1211	WNP Transport Layer initial server connection initiated to server HostName on …	Operational
1212	WNP Transport Layer initial server connection completed to server HostName on …	Operational
1213	WNP Transport Layer proxy connection initiated for the ConnectionType.	Operational
1214	WNP Transport Layer proxy connection completed to server HostName for the …	Operational
1215	WNP Transport Layer proxy negotiation initiated for the ConnectionType.	Operational
1216	WNP Transport Layer proxy negotiation completed for the ConnectionType.	Operational
1217	WNP Transport Layer TLS negotiation initiated for the ConnectionType.	Operational
1218	WNP Transport Layer TLS negotiation completed for the ConnectionType with code …	Operational
1219	WNP Transport Layer sent Bytes bytes on the ConnectionType.	Debug
1220	WNP Transport Layer received Bytes bytes on the ConnectionType.	Debug
1223	WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: …	Operational
1224	WNP Transport Layer received Bytes bytes of payload: Payload.	Operational
1225	WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, …	Operational
1226	WNP Transport Layer received proxy server response for the ConnectionType of …	Operational
1227	WNP Transport Layer received command when disconnected with Verb: Verb, Trid: …	Operational
1228	WNP Keep Alive Detector received OnConnected event from the test connection with …	Debug
1229	WNP Keep Alive Detector received OnReconnecting event from the test connection …	Debug
1230	WNP Keep Alive Detector received OnDisconnected event from the test connection …	Debug
1231	WNP Keep Alive Detector received KA hint from server: ServerKaHint seconds.	Debug
1232	WNP Keep Alive Detector updating cached Ka time with value: KaValue seconds; …	Debug
1233	Fast reconnect triggered for previous WNS session (SessionId) on the …	Operational
1234	ConnectionType TCP connection established over ProtocolType.	Debug
1235	WNP Keep Alive Detector resetting Idle Failed Interval.	Debug
1236	WNP Keep Alive Detector incrementing Idle-Succeeded count to IdleSucceededCount.	Debug
1237	WNP Keep Alive Detector encountered failed idle interval of IdleFailedInterval …	Debug
1238	WNP Keep Alive Detector starting Test Connection	Operational
1239	WNP Keep Alive Detector starting KA measurement with value: KaValue seconds; …	Operational
1240	WNP Keep Alive Detector stopping KA measurement	Operational
1241	WNP Keep Alive Detector lost network over ProtocolType.	Operational
1242	WNP Transport Layer received Power Management event with type …	Operational
1243	WNP Transport Layer received Power Management event with type …	Debug
1244	Connection to the Windows Push Notification Service (HostName:Port) failed …	Operational
1245	Connection to the Windows Push Notification Service (HostName:Port) failed …	Admin
1246	WNP Transport Layer was disconnected from the Windows Push Notification Service …	Operational
1247	Connection to the Windows Push Notification Service failed because of a failure …	Admin
1248	Connection to the Windows Push Notification Service (HostName:Port) failed …	Admin
1249	StopKeepAliveMeasurement was called from message loop.	Debug
1250	The KA measurement was never started.	Debug
1251	The test connection disconnect failed synchronously due to error: Error.	Debug
1252	The KA value has converged.	Operational
1253	The test connection will be disconnected due to idle failure.	Debug
1254	WNP Transport Layer for ConnectionType detected preferred interface change.	Operational
1255	WNP Transport Layer for ConnectionType reacting to preferred interface change, …	Operational
1256	WNP Transport Layer for ConnectionType reacting to preferred interface change, …	Operational
1257	WNP Transport Layer for ConnectionType called InitializeSecurityContext and got …	Operational
1258	WNP Transport Layer for ConnectionType received asynchronous connection error …	Operational
1259	WNP Transport Layer for the Data Connection sending out of band keep alive (PNG) …	Operational
1260	WNP Transport Layer for the Data Connection received cellular state change WNF …	Operational
1261	Adding new user to the Windows Push Notification Service.	Operational
1262	Removing existing user from the Windows Push Notification Service.	Operational
1263	Replacing existing user from the Windows Push Notification Service.	Operational
1264	Adding new user to the Windows Push Notification Service completed.	Operational
1265	Removing existing user from the Windows Push Notification Service completed.	Operational
1266	Replacing existing user from the Windows Push Notification Service completed.	Operational
1267	WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: …	Operational
1268	WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, …	Operational
1300	Started tracking connection establishment performance.	Debug
1301	Finished tracking connection establishment performance.	Debug
1302	PDC Intialization finished with error code [ErrorCode] and Initialization Count …	Debug
1303	PDC Unintialization finished with error code [ErrorCode] and Initialization …	Debug
1304	PDC Activation finished with error code [ErrorCode], Initialization Count is …	Debug
1305	PDC Deactivation finished with error code [ErrorCode], Initialization Count is …	Debug
1306	WNP protocol state for Device Id DeviceId is State State for the ConnectionType.	Debug
1307	WNP Connector state for Connector Id ConnectorId is State State for the …	Debug
1308	WNP Transport Layer for Connector Id ConnectorId requested NCSI probe for the …	Debug
1309	WNP Transport Layer for Auth Manager requested NCSI probe for the ConnectionType …	Debug
1310	WNP Transport Layer for ConnectionType detected first fallback interface change.	Operational
1311	WNP Transport Layer for ConnectionType detected second fallback interface …	Operational
1312	WNP Transport Layer detected low WIFI signal quality level (value = …	Operational
1313	WNP Transport Layer detected a significant drop in WIFI signal quality (delta = …	Operational
1314	WNP Transport Layer detected a change in WIFI interface availability (event …	Operational
1315	WNP Transport Layer detected a change in WIFI interface connectivity status …	Operational
1316	WNS delivered notification dropped in CP: ErrorCode [ErrorCode] Namespace …	Operational
1316		Operational
1317	NotificationType associated with ChannelId ChannelId and AppUserModelId …	Operational
1317		Operational
1318	WNP Protocol delivered notification: Namespace [Namespace] UserId [UserId] …	Operational
1318		Operational
2000	The Windows Push Notification Platform has received a channel request with the …	Debug
2001	The channel table has added a valid channel mapping: ChannelId [ChannelId] …	Operational
2002	The channel table has removed a channel mapping: ChannelId [ChannelId] …	Operational
2003	The channel table has updated a channel mapping: ChannelId [ChannelId] …	Operational
2004	The channel table has returned a cached channel mapping: ChannelId [ChannelId] …	Debug
2005	A cloud notification callback was added: AppUserModelId [AppUserModelId].	Debug
2006	A cloud notification callback was removed: AppUserModelId [AppUserModelId].	Debug
2007	A cloud notification could not be delivered to a callback due to an error: …	Debug
2008	A cloud notification was delivered to a callback: AppUserModelId …	Debug
2009	A local notification was submitted to threadpool: AppUserModelId …	Debug
2010	A clear tile message was received from an application endpoint: AppUserModelId …	Debug
2011	A clear badge message was received from an application endpoint: AppUserModelId …	Debug
2012	A cancel toast message was received from an application endpoint: AppUserModelId …	Debug
2013	A clear toast message was received from an application endpoint: AppUserModelId …	Debug
2014	A remove toast message was received from an application endpoint: AppUserModelId …	Debug
2015	A channel request failed due to an error: AppUserModelId [AppUserModelId] …	Debug
2016	A clear mixview message was received from an application endpoint: …	Debug
2025	A toast feedback callback was added: TrackingId [NotificationTrackingId].	Debug
2026	A toast feedback callback was removed: TrackingId [NotificationTrackingId].	Debug
2027	A toast feedback callback was invoked: TrackingId [NotificationTrackingId].	Debug
2028	A scheduled toast was added: PackageFullName [PackageFullName] AppUserModelID …	Debug
2029	A scheduled toast was removed: PackageFullName [PackageFullName] AppUserModelID …	Debug
2030	A scheduled toast is about to be raised: AppUserModelID [AppUserModelID] TimerId …	Debug
2031	A background task to application mapping has been added: AppUserModelID …	Debug
2032	A background task to application mapping has been removed: AppUserModelID …	Debug
2033	A raw notification has activated a background task: AppUserModelID …	Operational
2034	A raw notification has activated a system task: AppUserModelID [AppUserModelID].	Debug
2035	A scheduled tile was added: PackageFullName [PackageFullName] AppUserModelID …	Debug
2036	A scheduled tile was removed: PackageFullName [PackageFullName] AppUserModelID …	Debug
2037	A scheduled tile is being raised: AppUserModelID [AppUserModelId] TimerId …	Debug
2038	A scheduled tile was removed because the number of scheduled tiles per app …	Debug
2039	A periodic update has been set: PackageFullName [PackageFullName] AppUserModelID …	Debug
2040	A periodic update has been reset: PackageFullName [PackageFullName] …	Debug
2041	A periodic update has started polling URL: AppUserModelID [AppUserModelId] …	Debug
2042	A periodic update has finished polling URL: AppUserModelID [AppUserModelId] …	Debug
2043	A periodic update has rejected polling URL because size of notification exceeded …	Debug
2044	A periodic update has rejected polling URL due to mobile broadband connection …	Debug
2045	A periodic update has failed polling URL.	Debug
2046	A background task application mapping entry has been removed: AppUserModelID …	Debug
2047	Notification API call for AppUserModelId [AppUserModelId] failed.	Debug
2048	A raw notification has failed to activate a background task: AppUserModelID …	Debug
2049	A periodic update has found HTTP Status Code rather than 200: AppUserModelID …	Debug
2050	A periodic update has failed polling URL because X-WNS-TAG header is invalid: …	Debug
2051	A periodic update has failed polling URL because X-WNS-EXPIRY header is invalid: …	Debug
2052	A periodic update of Type NotificationType for AppUserModelId AppUserModelID at …	Debug
2053	A periodic update has failed polling URL because X-WNS-GROUP header is invalid: …	Operational
2100	A cloud notification was dropped because the following channel is not valid: …	Debug
2101	A notification was dropped because the expiration time was in the past: …	Debug
2102	A notification was dropped because of global settings: RequestFlags …	Debug
2103	A notification was dropped because cloud notifications are disabled globally: …	Debug
2104	A notification was dropped because of application settings: AppUserModelId …	Debug
2105	A notification was dropped because the application does not have the network …	Debug
2106	A notification was dropped because the application does not have the capability …	Debug
2107	A notification was dropped because the current network is costly: AppUserModelId …	Debug
2108	A notification was dropped because the mobile broadband cap has been reached: …	Debug
2109	Network traffic related to notifications was attributed to the following …	Debug
2110	A notification was dropped because cloud notifications are disabled for the …	Debug
2111	A notification was dropped because the application is not registered: …	Debug
2112	A NotificationType notification with trackingid TrackingId is getting posted for …	Debug
2150	An application setting was changed: AppUserModelId [AppUserModelId] SettingType …	Debug
2151	A group policy setting was changed.	Debug
2152	An application setting was queried: AppUserModelId [AppUserModelId] SettingType …	Debug
2153	A global setting was changed: SettingType [SettingType] Enabled [Enabled] …	Debug
2154	A global setting was queried: SettingType [SettingType] Enabled [Enabled] …	Debug
2155	The list of apps with capability: SettingType [SettingType] was requested.	Debug
2156	Callback registered for SettingType [SettingType] with Cookie Cookie [Cookie …	Debug
2157	Callback unregistered : Callback_unregistered [Cookie Value].	Debug
2158	End of clearing Tile Notification Queues and Image Cache.	Debug
2159	Mobile Broadband Tile Cap Queried: Mobile_Broadband_Tile_Cap_Queried [Cap Value …	Debug
2160	Mobile Broadband Tile Cap Changed: Mobile_Broadband_Tile_Cap_Changed [Cap Value …	Debug
2161	Mobile Broadband Tile Usage Queried: Mobile_Broadband_Tile_Usage_Queried [Usage …	Debug
2162	Mobile Broadband Reset Dates Queried.	Debug
2163	The list of apps with capability: SettingType [SettingType] in Package: …	Debug
2164	Start of clearing Tile Notification Queues and Image Cache.	Debug
2165	Mobile Broadband Cap Enforcement Callback invoked: Enabled [Enabled].	Debug
2166	Toasts have been Temporarily Suspended until WakeupTime [UTC FILETIME].	Debug
2167	Toast Temporary Suspend Time was queried: Is Suspended?	Debug
2168	Toast Wakeup Timer has fired.	Debug
2169	The list of Polling apps in Package: PackageFamilyName [PackageFamilyName] was …	Debug
2170	A Setting Sync was scheduled: PackageFamilyName [PackageFamilyName] CollectionId …	Debug
2171	A call to the settings endpoint happened to unblock all channels for all types.	Operational
2200	A channel request was not allowed because of global settings: RequestFlags …	Debug
2201	A channel request was not allowed because the application does not have the …	Debug
2202	A NotificationType notification with NotificationTrackingId TrackingId was …	Debug
2203	A NotificationType notification with NotificationTrackingId TrackingId is being …	Debug
2250	Notification channels associated with a package are able to receive raw …	Debug
2300	The following application was added to the lock screen: PackageFullName …	Debug
2301	The following application was removed from the lock screen: PackageFullName …	Debug
2400	System application was registered with the following paramaeters: …	Debug
2401	System application was unregistered with the following parameters: …	Debug
2402		Debug
2403		Debug
2404	Phone VoIP application was registered with the following parameters: …	Debug
2405	Phone VoIP application was unregistered with the following parameters: …	Debug
2406	The Windows Push Notification Platform has received a phone legacy channel …	Debug
2407	PhoneLegacy push notification is being processed: ChannelId [ChannelId], …	Debug
2408	PhoneLegacy voip notification is being processed: ChannelId [ChannelId], …	Debug
2409	A connection status callback was added: AppUserModelId [AppUserModelId].	Debug
2410	A connection status callback was removed: AppUserModelId [AppUserModelId].	Debug
2411	A connection status callback was updated: AppUserModelId [AppUserModelId].	Debug
2412	A connection status was delivered to a callback: AppUserModelId [AppUserModelId] …	Debug
2413	An application was registered with the following parameters: PackageFullName …	Operational
2414	An application resgistration was updated with the following parameters: …	Operational
2415	An application was unregistered with the following parameters: AppUserModelId …	Operational
2416	A local notification was received from AppUserModelId [AppUserModelId] with a …	Operational
2416		Operational
2417	A local notification failed to be submitted to threadpool: ErrorCode [HResult].	Operational
2417		Operational
2418	A local notification was submitted to threadpool: AppUserModelId …	Operational
2418		Operational
2419	A raw notification has activated a system task: AppUserModelID [AppUserModelID].	Operational
2419		Operational
3000	Tile session creation is requested for ProcessName endpoint Object.	Operational
3001	Tile session creation is finished for ProcessName from endpoint Endpoint with …	Operational
3002	Tile session SessionId is being updated.	Debug
3003	Tile session SessionId is updated with error code Error.	Debug
3004	Tile session SessionId is being closed.	Operational
3005	Tile session SessionId is closed with error code Error.	Operational
3006	Toast session creation is requested for ProcessName from endpoint Object.	Operational
3007	Toast session creation is finished for ProcessName from endpoint Endpoint with …	Operational
3008	Toast session SessionId is being closed.	Operational
3009	Toast session SessionId is closed with error code Error.	Operational
3010	Started tracking Notification Request performance.	Debug
3011	Finished tracking Notification Request performance.	Debug
3012	Toast with notification tracking id TrackingId is delivered to AppUserModelId on …	Debug
3013	NotificationType with notification tracking id TrackingId is delivered to …	Debug
3014	Tile queue entry is created for AppUserModelId.	Debug
3015	Tile notification id NotificationId for AppUserModelId is stored at QueueIndex …	Debug
3016	Tile notification id OverridingNotificationId overrided existing notification id …	Debug
3017	This is a verbose debug event that dumps Tile Queue information.	Debug
3018	Badge notification id TrackingId is stored for AppUserModelId.	Debug
3019	Tile image request RequestId has started.	Debug
3020	Tile image request RequestId has been canceled due to new request.	Debug
3021	Tile image request for notification NotificationId in AppUserModelId contains …	Debug
3022	Image download request is being processed for first time: resource id …	Debug
3023	Image download is complete for a single URL: notification id [NotificationId], …	Debug
3024	Image download is complete for all URL with notification id [NotificationId].	Debug
3025	Processing initial batch on Image request for toast: AppUserModelId …	Debug
3026	Processing Toast Image request URL: Resource Id [ResourceId], URL [URL].	Debug
3027	Scheduling Image Download Task: [Slot Index] SlotIndex, [Notification Id] …	Debug
3028	Completed Image Download Task: [Notification Id] NotificationId, [IsTile] …	Debug
3029	Download image has failed: [Notification Id] NotificationId [Tile] IsTile …	Debug
3030	Image resource is being processed.	Debug
3031	Image resource has been processed.	Debug
3032	Clearing all tile notifiction is being processed.	Debug
3033	Clearing all tile notifiction has been processed.	Debug
3034	Clearing all images is being processed.	Debug
3035	Clearing all images has been processed.	Debug
3036	Image Download Manager policy is changed to IDM_Enabled.	Debug
3037	Detail event for tile session SessionId update.	Debug
3038	Detail event at start of Notification Request performance tracking.	Debug
3039	Image Download Manager drop request due to newer request arrival.	Debug
3040	Downloading image has failed because protocol is not supported: URL [URL].	Debug
3041	Downloading image has failed because downloaded image it too big over maximum …	Debug
3042	Downloading image has failed because downloaded image is empty: URL [URL].	Debug
3043	The new tile notification was found to be a duplicate of a previous …	Debug
3044	The new badge notification was found to be a duplicate of a previous …	Debug
3045	Started tracking Toast Notification Request performance.	Debug
3046	Finished tracking Toast Notification Request performance.	Debug
3047	The new tile flyout notification was found to be a duplicate of a previous …	Debug
3048	Badge notification id TrackingId is stored for AppUserModelId.	Debug
3049	Endpoint Object is being cleanedup.	Operational
3050	Toast notification id NotificationId for AppUserModelId is stored at QueueIndex …	Debug
3051	Toast notification id OverridingNotificationId overrided existing notification …	Debug
3052	Toast with notification tracking id TrackingId is being delivered to …	Operational
3053	NotificationType with notification tracking id TrackingId is being delivered to …	Operational
3054	Toast with notification tracking id TrackingId is canceled by AppUserModelId - …	Operational
3055	Some toast notifications have been cleared - informed session SessionId.	Operational
3056	NotificationType are being cleared for AppUserModelId - informed session …	Operational
3057	Presentation Endpoint received a call to close session SessionId.	Operational
3058	Presentation Endpoint ended a call to close session SessionId.	Operational
3100	Started tracking Clear Toast Notification performance.	Debug
3101	Finished tracking Clear Toast Notification performance.	Debug
3102	Started tracking Clear Toast Notifications performance.	Debug
3103	Finished tracking Clear Toast Notifications performance.	Debug
3104	Toast with notification id [TrackingId] has expired and will be removed from the …	Debug
3105	Started tracking Remove Toast Notifications performance.	Debug
3106	Finished tracking Remove Toast Notifications performance.	Debug
3107	Processing of Push Notification has failed: ChannelId [ChannelId], …	Debug
3108	Started tracking Clear Toast Notification Rollover performance.	Debug
3109	Finished tracking Clear Toast Notification Rollover performance.	Debug
3110	Toast Notification Forwarding Global Settings: isFwToCdpEnabled = …	Operational
3111	Start Toast Notification Forwarding activity	Operational
3112	Stop Toast Notification Forwarding activity	Operational
3113	Toast Notification Forwarding Local Settings: isDeveloperAppMirroringEnabled = …	Operational
3114	Start Toast Notification Forwarding Do Forward To AFC	Operational
3115	Stop Toast Notification Forwarding Do Forward To AFC	Operational
3116	Start Toast Notification Forwarding Make Activity from Notification	Operational
3117	Stop Toast Notification Forwarding Make Activity from Notification	Operational
3118	Toast Notification Forwarding Finished Decorating Payload	Operational
3119	Toast Notification Forwarding Finished Loading Payload onto Activity	Operational
3120	Toast Notification Forwarding Finished setting attributes onto activity	Operational
3121	Start Toast Notification Forwarding Asset Resolution	Operational
3122	Toast Notification Forwarding Asset Resolution Successful	Operational
3123	Toast Notification Forwarding Making Activity TrackingId = TrackingId …	Operational
3124	Toast Notification Forwarding Published Activity with Result = ErrorCode.	Operational
3125	VerboseLog.	Operational
3126	Sync Dismiss: Dismiss Activities for App Start	Operational
3127	Sync Dismiss: Dismiss Activities for App Stop	Operational
3128	Sync Dismiss: Dismiss Activities Start	Operational
3129	Sync Dismiss: Dismiss Activities Stop	Operational
3130	Sync Dismiss: Dismiss Activities Start	Operational
3131	Sync Dismiss: Dismiss Activities Stop	Operational
3132	Sync Dismiss: Remove Notification using Activity Start	Operational
3133	Sync Dismiss: Remove Notification using Activity Stop	Operational
3134	Sync Dismiss: Get Activities Start	Operational
3135	Sync Dismiss: Get Activities Stop	Operational
3136	Sync Dismiss: CDPGetPlatformDeviceId Start	Operational
3137	Sync Dismiss: CDPGetPlatformDeviceId Stop	Operational
3138	VerboseLog.	Operational
3139	Sync Dismiss Removed Activity with Result = ErrorCode.	Operational
3140	Sync Dismiss Removed Notification with Result = ErrorCode.	Operational
3141	SyncDismissRemoveNotificationUsingActivityParams: MatchOnNotificationId = …	Operational
3142	Sync Dismiss: Matched Activity using Notification!	Operational
3143	Sync Dismiss: Matched Notification using Activity!	Operational
3144	Received WNF_CDP_CDPUSERSVC_READY	Operational
3145	[Sqlite][Informational] Status: SqliteInformational_Status.	Debug
3146	[Sqlite][Warning] Status: SqliteWarning_Status.	Operational
3147	[Sqlite][Error] Status: SqliteError_Status.	Operational
3148	[Sqlite][Other] Status: SqliteOther_Status.	Debug
3149	Processing of Push Notification has succeeded: ChannelId [ChannelId], …	Debug
3149		Operational
3150	Processing of Local Notification has failed: NotificationType …	Operational
3150		Operational
3151	Processing of Local Notification has succeeded: NotificationType …	Debug
3151		Operational
3152	Processing of Push Notification has failed: ChannelId [ChannelId], …	Operational
3152		Operational
3153	Toast with notification tracking id TrackingId is delivered to AppUserModelId on …	Operational
3153		Operational
3154	Processing and publishing of Resume Notification has succeeded: TrackingId …	Debug
3154		Operational
3155	Processing and publishing of Resume Notification has failed: TrackingId …	Operational
3155		Operational
3156	Processing of Resume Response has succeeded: TrackingId [TrackingId].	Debug
3156		Operational
3157	Processing of Resume Response has failed: TrackingId [TrackingId], Location …	Operational
3157		Operational
10000	DebugTrace: DebugTrace.	Debug

Event ID 1 — The Windows Push Notification Platform has encountered an error in File: FileName, Function FunctionName, Line LineNumber, Error ErrorCode, ErrorMessage ErrorMessage.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has encountered an error in File: FileName, Function FunctionName, Line LineNumber, Error ErrorCode, ErrorMessage ErrorMessage.

Message #

The Windows Push Notification Platform has encountered an error in File: %1, Function %2, Line %3, Error %4, ErrorMessage %5.

Fields #

Name	Description
`FileName` UnicodeString	—
`FunctionName` UnicodeString	—
`LineNumber` Int32	—
`ErrorCode` UInt32	—
`ErrorMessage` UnicodeString	—

Event ID 2 — The Windows Push Notification Platform has started loading.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformBootUp

Description

The Windows Push Notification Platform has started loading.

Message #

The Windows Push Notification Platform has started loading.

Event ID 3 — The Windows Push Notification Platform has been unloaded.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformShutdown

Description

The Windows Push Notification Platform has been unloaded.

Message #

The Windows Push Notification Platform has been unloaded.

Event ID 4 — The Windows Push Notification Platform has been disabled due to Group Policy settings.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has been disabled due to Group Policy settings.

Message #

The Windows Push Notification Platform has been disabled due to Group Policy settings.

Event ID 5 — The Windows Push Notification Platform has been loaded.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformBootUp

Description

The Windows Push Notification Platform has been loaded.

Message #

The Windows Push Notification Platform has been loaded.

Event ID 6 — The Windows Push Notification Platform has started unloading.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformShutdown

Description

The Windows Push Notification Platform has started unloading.

Message #

The Windows Push Notification Platform has started unloading.

Event ID 7 — The Windows Push Notification Platform has launched as Type with Privilege privilege.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has launched as Type with Privilege privilege.

Message #

The Windows Push Notification Platform has launched as %1 with %2 privilege.

Fields #

Name	Description
`Type` UInt32	—
`Privilege` UInt32	—

Event ID 8 — The Windows Push Notification Platform is switching into new NewPrivilege privilege.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: SwitchPrivilege
Opcode: Start

Description

The Windows Push Notification Platform is switching into new NewPrivilege privilege.

Message #

The Windows Push Notification Platform is switching into new %1 privilege.

Fields #

Name	Description
`NewPrivilege` UInt32	—

Event ID 9 — The Windows Push Notification Platform has switched with error code Error, and current privilege is ResultedPrivilege.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: SwitchPrivilege
Opcode: Stop

Description

The Windows Push Notification Platform has switched with error code Error, and current privilege is ResultedPrivilege.

Message #

The Windows Push Notification Platform has switched with error code %2, and current privilege is %1.

Fields #

Name	Description
`ResultedPrivilege` UInt32	—
`Error` Int32	—

Event ID 10 — The Windows Push Notification Platform has started defragging storage.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: DefragFile
Opcode: Start

Description

The Windows Push Notification Platform has started defragging storage.

Message #

The Windows Push Notification Platform has started defragging storage.

Event ID 11 — The Windows Push Notification Platform has finished defragging storage.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: DefragFile
Opcode: Stop

Description

The Windows Push Notification Platform has finished defragging storage.

Message #

The Windows Push Notification Platform has finished defragging storage.

Event ID 12 — The Windows Push Notification Platform has determined new maximum number of applications MaximumApplication based on count of current applications CountApplication.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has determined new maximum number of applications MaximumApplication based on count of current applications CountApplication. Old maximum number of applications is OldMaximumApplication.

Message #

The Windows Push Notification Platform has determined new maximum number of applications %2 based on count of current applications %1. Old maximum number of applications is %3.

Fields #

Name	Description
`CountApplication` UInt16	—
`MaximumApplication` UInt16	—
`OldMaximumApplication` UInt16	—

Event ID 13 — The Windows Push Notification Platform has expanded its persistent header storage to accommodate NewMaximumApplication Applications.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has expanded its persistent header storage to accommodate NewMaximumApplication Applications.

Message #

The Windows Push Notification Platform has expanded its persistent header storage to accommodate %1 Applications.

Fields #

Name	Description
`NewMaximumApplication` UInt16	—

Event ID 14 — The Windows Push Notification Platform has switched to using an expanded persistence buffer.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has switched to using an expanded persistence buffer.

Message #

The Windows Push Notification Platform has switched to using an expanded persistence buffer.

Event ID 15 — The Windows Push Notification Platform has started loading file data: count applications CountApplication, count allocated entries CountAllocated, max count MaximumApplication.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has started loading file data: count applications CountApplication, count allocated entries CountAllocated, max count MaximumApplication.

Message #

The Windows Push Notification Platform has started loading file data: count applications %1, count allocated entries %2, max count %3.

Fields #

Name	Description
`CountApplication` UInt16	—
`CountAllocated` UInt16	—
`MaximumApplication` UInt16	—

Event ID 16 — The Windows Push Notification Platform has created a new memory-mapped file.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has created a new memory-mapped file.

Message #

The Windows Push Notification Platform has created a new memory-mapped file.

Event ID 17 — The Windows Push Notification Platform has detected that its persistent buffer is out of sync.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has detected that its persistent buffer is out of sync.

Message #

The Windows Push Notification Platform has detected that its persistent buffer is out of sync.

Event ID 18 — The Windows Push Notification Platform has registered inbox applications.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has registered inbox applications.

Message #

The Windows Push Notification Platform has registered inbox applications.

Event ID 19 — The Windows Push Notification Platform has encountered an error in File: FileName, Function FunctionName, Line LineNumber, Error ErrorCode, ErrorMessage %5.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Verbose
Opcode: Info

Description

The Windows Push Notification Platform has encountered an error in File: FileName, Function FunctionName, Line LineNumber, Error ErrorCode, ErrorMessage %5.

Message #

The Windows Push Notification Platform has encountered an error in File: %1, Function %2, Line %3, Error %4, ErrorMessage %5.

Fields #

Name	Description
`FileName` UnicodeString	The Windows Push Notification Platform has encountered an error in File.
`FunctionName` UnicodeString	—
`LineNumber` Int32	—
`ErrorCode` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 19,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854784000,
    "time_created": "2022-04-07T16:48:25.193524+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 1640,
      "thread_id": 764
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "FileName": "onecoreuap\\base\\diagnosis\\platform\\notifications\\platform\\endpoint\\backgroundapplicationpolicymanager.cpp",
    "FunctionName": "BackgroundApplicationPolicyManager::InitializeWnfCallbacks",
    "LineNumber": 162,
    "ErrorCode": 2147943568
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 20 — The Windows Push Notification Platform has encountered error ErrorCode opening file FilePath.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

The Windows Push Notification Platform has encountered error ErrorCode opening file FilePath.

Message #

The Windows Push Notification Platform has encountered error %2 opening file %1.

Fields #

Name	Description
`FilePath` UnicodeString	—
`ErrorCode` UInt32	—

Event ID 21 — The Windows Push Notification Platform has started processing tile update settings for CountInboxApps inbox and CountPreinstallApps preinstall apps.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ProcessTileUpdateSettings
Opcode: Start

Description

The Windows Push Notification Platform has started processing tile update settings for CountInboxApps inbox and CountPreinstallApps preinstall apps.

Message #

The Windows Push Notification Platform has started processing tile update settings for %1 inbox and %2 preinstall apps.

Fields #

Name	Description
`CountInboxApps` UInt32	—
`CountPreinstallApps` UInt32	—

Event ID 22 — The Windows Push Notification Platform has stopped processing tile update settings.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ProcessTileUpdateSettings
Opcode: Stop

Description

The Windows Push Notification Platform has stopped processing tile update settings.

Message #

The Windows Push Notification Platform has stopped processing tile update settings.

Event ID 23 — The Windows Push Notification Platform is setting URI Uri with recurrence WpnRecurrence for AppUserModelId AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ProcessTileUpdateSettings

Description

The Windows Push Notification Platform is setting URI Uri with recurrence WpnRecurrence for AppUserModelId AppUserModelId.

Message #

The Windows Push Notification Platform is setting URI %2 with recurrence %3 for AppUserModelId %1.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`Uri` UnicodeString	—
`WpnRecurrence` UInt32	—

Event ID 24 — The Windows Push Notification Platform has initiated a WNS connection.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformBootUp

Description

The Windows Push Notification Platform has initiated a WNS connection.

Message #

The Windows Push Notification Platform has initiated a WNS connection.

Event ID 25 — The Windows Push Notification Platform is disconnecting from WNS.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PlatformShutdown

Description

The Windows Push Notification Platform is disconnecting from WNS.

Message #

The Windows Push Notification Platform is disconnecting from WNS.

Event ID 26 — ThreadPool: [Name] (InstanceId) has been scheduled.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

ThreadPool: [Name] (InstanceId) has been scheduled.

Message #

ThreadPool: [%1] (%2) has been scheduled.

Fields #

Name	Description
`Name` UnicodeString	—
`InstanceId` Pointer	—

Event ID 27 — ThreadPool: [Name] (InstanceId) finished with error code [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

ThreadPool: [Name] (InstanceId) finished with error code [ErrorCode].

Message #

ThreadPool: [%1] (%2) finished with error code [%3]

Fields #

Name	Description
`Name` UnicodeString	—
`InstanceId` Pointer	—
`ErrorCode` Int32	—

Event ID 28 — ResourceManager has recevied a message: code [MessageCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

ResourceManager has recevied a message: code [MessageCode].

Message #

ResourceManager has recevied a message: code [%1]

Fields #

Name	Description
`MessageCode` UInt32	—

Event ID 29 — The Windows Push Notification Platform has started scavenging the image cache.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: DefragFile
Opcode: Start

Description

The Windows Push Notification Platform has started scavenging the image cache.

Message #

The Windows Push Notification Platform has started scavenging the image cache.

Event ID 30 — The Windows Push Notification Platform has finished scavenging the image cache.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: DefragFile
Opcode: Stop

Description

The Windows Push Notification Platform has finished scavenging the image cache.

Message #

The Windows Push Notification Platform has finished scavenging the image cache.

Event ID 31 — The Windows Push Notification Platform has TotalSize entries in the image cache.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Windows Push Notification Platform has TotalSize entries in the image cache.

Message #

The Windows Push Notification Platform has %1 entries in the image cache.

Fields #

Name	Description
`TotalSize` UInt64	—

Event ID 32 — The Device has entered battery saver state: BATTERY_SAVINGS_ON

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: BatterySaver
Opcode: Start

Description

The Device has entered battery saver state: BATTERY_SAVINGS_ON.

Message #

The Device has entered battery saver state: BATTERY_SAVINGS_ON

Event ID 33 — The Device has exited battery saver state: BATTERY_SAVINGS_OFF

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: BatterySaver
Opcode: Stop

Description

The Device has exited battery saver state: BATTERY_SAVINGS_OFF.

Message #

The Device has exited battery saver state: BATTERY_SAVINGS_OFF

Event ID 34 — The DcpProvider has been loaded successfully.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The DcpProvider has been loaded successfully.

Message #

The DcpProvider has been loaded successfully.

Event ID 35 — WNS Platform finished TraceLogging registration with code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNS Platform finished TraceLogging registration with code ErrorCode.

Message #

WNS Platform finished TraceLogging registration with code %1.

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 36 — WNS Connection Provider finished TraceLogging registration with code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNS Connection Provider finished TraceLogging registration with code ErrorCode.

Message #

WNS Connection Provider finished TraceLogging registration with code %1.

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 37 — The Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : ChannelsExist.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

The Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : ChannelsExist.

Message #

The Windows Push Notification Platform is required to connect on startup, ValidChannelsExist : %1.

Fields #

Name	Description
`ChannelsExist` Boolean	The Windows Push Notification Platform is required to connect on startup, ValidChannelsExist.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036896722944,
    "time_created": "2023-11-05T22:41:17.162599+00:00",
    "event_record_id": 2587,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 5040
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ChannelsExist": true
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 38 — PDC intialization finished with ErrorCode: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC intialization finished with ErrorCode: ErrorCode.

Message #

PDC intialization finished with ErrorCode: %1.

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 39 — PDC unintialization finished with ErrorCode: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC unintialization finished with ErrorCode: ErrorCode.

Message #

PDC unintialization finished with ErrorCode: %1.

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 40 — PDC activation finished with ErrorCode: ErrorCode, PdcType: PdcType, PdcScenario: PdcScenario, ScenarioData: [ScenarioData].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC activation finished with ErrorCode: ErrorCode, PdcType: PdcType, PdcScenario: PdcScenario, ScenarioData: [ScenarioData].

Message #

PDC activation finished with ErrorCode: %1, PdcType: %2, PdcScenario: %3, ScenarioData: [%4].

Fields #

Name	Description
`ErrorCode` Int32	—
`PdcType` UInt32	—
`PdcScenario` UInt32	—
`ScenarioData` UnicodeString	—

Event ID 41 — PDC deactivation finished with ErrorCode: ErrorCode, PdcType: PdcType, PdcNetRef: PdcNetRefCount, PdcPlatRef: PdcPlatRefCount.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC deactivation finished with ErrorCode: ErrorCode, PdcType: PdcType, PdcNetRef: PdcNetRefCount, PdcPlatRef: PdcPlatRefCount.

Message #

PDC deactivation finished with ErrorCode: %1, PdcType: %2, PdcNetRef: %3, PdcPlatRef: %4.

Fields #

Name	Description
`ErrorCode` Int32	—
`PdcType` UInt32	—
`PdcNetRefCount` Int64	—
`PdcPlatRefCount` Int64	—

Event ID 42 — Cloud Notifications must be enabled in GP and MDM to receive push notifications.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Cloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: GroupPolicyValue, MDMPolicyValue: MDMPolicyValue.

Message #

Cloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue: %1, MDMPolicyValue: %2.

Fields #

Name	Description
`GroupPolicyValue` Boolean	Cloud Notifications must be enabled in GP and MDM to receive push notifications. GroupPolicyValue.
`MDMPolicyValue` Boolean	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 42,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036896722944,
    "time_created": "2023-11-05T22:41:17.226539+00:00",
    "event_record_id": 2600,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 5364
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "GroupPolicyValue": true,
    "MDMPolicyValue": true
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1000 — A Connection Provider is registered with Windows Push Notification Platform using the following parameters: CLSID [CLSID] Enabled [Enabled] Flags [CLSCTX Flags].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A Connection Provider is registered with Windows Push Notification Platform using the following parameters: CLSID [CLSID] Enabled [Enabled] Flags [CLSCTX Flags].

Message #

A Connection Provider is registered with Windows Push Notification Platform using the following parameters: %1 [CLSID] %2 [Enabled] %3 [CLSCTX Flags].

Fields #

Name	Description
`CLSID` GUID	—
`Enabled` Boolean	—
`Flags` UInt32	—

Event ID 1001 — The following Connection Provider is enabled with the parameters: CLSID [CLSID] Flags [CLSCTX Flags].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The following Connection Provider is enabled with the parameters: CLSID [CLSID] Flags [CLSCTX Flags].

Message #

The following Connection Provider is enabled with the parameters: %1 [CLSID] %2 [CLSCTX Flags].

Fields #

Name	Description
`CLSID` GUID	—
`Flags` UInt32	—
`ErrorCode` Int32	—

Event ID 1002 — The Connection Provider with CLSID CLSID was instantiated with the following flags Flags and finished with ErrorCode ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Connection Provider with CLSID CLSID was instantiated with the following flags Flags and finished with ErrorCode ErrorCode.

Message #

The Connection Provider with CLSID %1 was instantiated with the following flags %2 and finished with ErrorCode %3.

Fields #

Name	Description
`CLSID` GUID	—
`Flags` UInt32	—
`ErrorCode` Int32	—

Event ID 1003 — Connect request sent to the Connection Provider.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment

Description

Connect request sent to the Connection Provider.

Message #

Connect request sent to the Connection Provider.

Event ID 1004 — Disconnect request sent the Connection Provider.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Disconnect request sent the Connection Provider.

Message #

Disconnect request sent the Connection Provider.

Event ID 1005 — The Connection Provider status changed to Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment

Description

The Connection Provider status changed to Status.

Message #

The Connection Provider status changed to %1.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1005,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 9223372036963926272,
    "time_created": "2023-11-05T22:41:17.244262+00:00",
    "event_record_id": 2601,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 8072
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Status": 4
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1006 — Sending a channel request to the Connection Provider with parameters: PackageFullName [PackageFullName] Properties [Properties] Cookie [Cookie] TransactionId [TransactionId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Sending a channel request to the Connection Provider with parameters: PackageFullName [PackageFullName] Properties [Properties] Cookie [Cookie] TransactionId [TransactionId].

Message #

Sending a channel request to the Connection Provider with parameters: %1 [PackageFullName] %2 [Properties] %3 [Cookie] %4 [TransactionId].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`Properties` UInt32	—
`Cookie` UInt32	—
`TransactionId` Int32	—

Event ID 1007 — The Connection Provider completed the channel request for transaction id TransactionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

The Connection Provider completed the channel request for transaction id TransactionId. ChannelId [ChannelId] ChannelUri [ChannelUri] Expiry [Expiry].

Message #

The Connection Provider completed the channel request for transaction id %1. %2 [ChannelId] %3 [ChannelUri] %4 [Expiry].

Fields #

Name	Description
`TransactionId` Int32	—
`ChannelId` UnicodeString	—
`ChannelUri` UnicodeString	—
`Expiry` Double	—

Event ID 1008 — Sending a channel revoke request to the Connection Provider for channel id ChannelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Sending a channel revoke request to the Connection Provider for channel id ChannelId.

Message #

Sending a channel revoke request to the Connection Provider for channel id %1.

Fields #

Name	Description
`ChannelId` UnicodeString	—

Event ID 1010 — group received for ChannelId action and AppUserModelId NotificationType with TrackingId ChannelId, X-WNS-MSG-ID AppUserModelId, timestamp TrackingId and expiration MessageId tag: Timestamp, group: ...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival
Opcode: Start

Description

group received for ChannelId action and AppUserModelId NotificationType with TrackingId ChannelId, X-WNS-MSG-ID AppUserModelId, timestamp TrackingId and expiration MessageId tag: Timestamp, group: Expiry, action: Tag, bundle: count=Group;missed=Action;Id=OfflineCacheCount.

Message #

%1 received for ChannelId %2 and AppUserModelId %3 with TrackingId %4, X-WNS-MSG-ID %5, timestamp %6 and expiration %7 tag: %8, group: %9, action: %10, bundle: count=%11;missed=%12;Id=%13.

Fields #

Name	Description
`group`	—
`action`	—
`NotificationType` UInt32	—
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`MessageId` UInt64	—
`Timestamp` Double	—
`Expiry` Double	—
`Tag` UnicodeString	—
`Group` UnicodeString	—
`Action` UInt32	—
`OfflineCacheCount` UInt32	—
`CacheRollover` Boolean	—
`OfflineBundleId` UnicodeString	—
`Priority` UnicodeString	—
`Cached` UnicodeString	—

Event ID 1011 — Sending a request to the Connection Provider to renew a channel with parameters: ChannelId [ChannelId] PackageFullName [PackageFullName] Properties [Properties] Cookie [Cookie] TransactionId...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Sending a request to the Connection Provider to renew a channel with parameters: ChannelId [ChannelId] PackageFullName [PackageFullName] Properties [Properties] Cookie [Cookie] TransactionId [TransactionId].

Message #

Sending a request to the Connection Provider to renew a channel with parameters: %1 [ChannelId] %2 [PackageFullName] %3 [Properties] %4 [Cookie] %5 [TransactionId].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`PackageFullName` UnicodeString	—
`Properties` UInt32	—
`Cookie` UInt32	—
`TransactionId` Int32	—

Event ID 1012 — Setting batching configuration to the following state: BatchingState.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Setting batching configuration to the following state: BatchingState.

Message #

Setting batching configuration to the following state: %1.

Fields #

Name	Description
`BatchingState` UInt32	—

Event ID 1013 — Configuring notification delivery for AppUserModelId AppUserModelId with channel id ChannelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Configuring notification delivery for AppUserModelId AppUserModelId with channel id ChannelId. NotificationType [NotificationType] Enabled [Enabled].

Message #

Configuring notification delivery for AppUserModelId %4 with channel id %1.  %2 [NotificationType] %3 [Enabled].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UInt32	—
`Enabled` Boolean	—
`AppUserModelId` UnicodeString	—

Event ID 1014 — The Resource Manager was notified that display state changed to DisplayStatus.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Resource Manager was notified that display state changed to DisplayStatus.

Message #

The Resource Manager was notified that display state changed to %1.

Fields #

Name	Description
`DisplayStatus` UInt32	—

Event ID 1015 — Configuring notification policy for NotificationType [NotificationType] Enabled [Enabled].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Configuring notification policy for NotificationType [NotificationType] Enabled [Enabled].

Message #

Configuring notification policy for %1 [NotificationType] %2 [Enabled].

Fields #

Name	Description
`NotificationType` UInt32	—
`Enabled` Boolean	—

Event ID 1016 — The Resource Manager was notified of an update to the network cost.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Resource Manager was notified of an update to the network cost. NetworkCost [Cost] Costly [Costly].

Message #

The Resource Manager was notified of an update to the network cost. %1 [Cost] %2 [Costly].

Fields #

Name	Description
`NetworkCost` UInt32	—
`Costly` Boolean	—

Event ID 1017 — The Resource Manager was notified of an update to the data plan.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Resource Manager was notified of an update to the data plan. DateSource [Source] BillingCycle [BillingCycle].

Message #

The Resource Manager was notified of an update to the data plan. %1 [Source] %2 [BillingCycle].

Fields #

Name	Description
`DateSource` UInt32	—
`BillingCycle` FILETIME	—

Event ID 1018 — The Resource Manager reset the Mobile Broadband Usage statistics.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Resource Manager reset the Mobile Broadband Usage statistics.

Message #

The Resource Manager reset the Mobile Broadband Usage statistics.

Event ID 1019 — The Resource Manager was notified that user session state changed to Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The Resource Manager was notified that user session state changed to Status.

Message #

The Resource Manager was notified that user session state changed to %1.

Fields #

Name	Description
`Status` UInt32	— NTSTATUS reference

Event ID 1020 — The Connection Provider status changed to a failure state: {Status}.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

The Connection Provider status changed to a failure state: {Status}.

Message #

The Connection Provider status changed to a failure state: {Status}.

Fields #

Name	Description
`Status`	— NTSTATUS reference

Event ID 1021 — The Connection Manager has failed to connect: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

The Connection Manager has failed to connect: ErrorCode.

Message #

The Connection Manager has failed to connect: %1.

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 1022 — ConnectWork is requesting ConnectionManager to connect.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

ConnectWork is requesting ConnectionManager to connect.

Message #

ConnectWork is requesting ConnectionManager to connect.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1022,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036963827968,
    "time_created": "2023-11-05T22:41:17.175463+00:00",
    "event_record_id": 2592,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 5364
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1023 — No internet connection available, WorkItemName is queued for next network status change.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

No internet connection available, WorkItemName is queued for next network status change.

Message #

No internet connection available, %1 is queued for next network status change.

Fields #

Name	Description
`WorkItemName` UnicodeString	—

Event ID 1024 — Internet connection status changed to IsConnected, submitting pending workitems: count = PendingCount.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Internet connection status changed to IsConnected, submitting pending workitems: count = PendingCount.

Message #

Internet connection status changed to %1, submitting pending workitems: count = %2.

Fields #

Name	Description
`IsConnected` Boolean	—
`PendingCount` UInt32	—

Event ID 1025 — A Power event was fired: PowerEventType [PowerEventType] IsEnabled [Enabled].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

A Power event was fired: PowerEventType [PowerEventType] IsEnabled [Enabled].

Message #

A Power event was fired: %1 [PowerEventType] %2 [Enabled].

Fields #

Name	Description
`PowerEventType` UnicodeString	A Power event was fired.
`IsEnabled` Boolean	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1025,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223407221226864896,
    "time_created": "2023-11-06T01:08:05.390569+00:00",
    "event_record_id": 2761,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 5432
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "PowerEventType": "MonitorSettingChange",
    "IsEnabled": true
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1100 — Connecting to the Windows Push Notification Service.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Connecting to the Windows Push Notification Service. UserId [UserId] UserType [UserType] FeatureSet [FeatureSet] AuthType [AuthType] AuthPayload [AuthPayload] BindPayload [BindPayload].

Message #

Connecting to the Windows Push Notification Service. %1 [UserId] %2 [UserType] %3 [FeatureSet] %4 [AuthType] %6 [AuthPayload] %8 [BindPayload].

Fields #

Name	Description
`UserId` UInt64	—
`UserType` UInt32	—
`FeatureSet` AnsiString	—
`AuthType` AnsiString	—
`AuthPayloadSize` UInt32	—
`AuthPayload` Binary	—
`BindPayloadSize` UInt32	—
`BindPayload` Binary	—

Event ID 1101 — Windows Push Notification Service connection result: Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Windows Push Notification Service connection result: Error.

Message #

Windows Push Notification Service connection result: %1.

Fields #

Name	Description
`Error` UInt32	—

Event ID 1102 — Sending Channel WNP Protocol command: Sending_Channel_WNP_Protocol_command [TransactionId] TransactionId [ChannelId] ChannelId [PackageFullName] PackageFullName [Properties] CommandSize [Command] C...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Channel WNP Protocol command: Sending_Channel_WNP_Protocol_command [TransactionId] TransactionId [ChannelId] ChannelId [PackageFullName] PackageFullName [Properties] CommandSize [Command] Command [Namespace] Namespace [ContextId] PayloadSize [Payload] Payload [UserId].

Message #

Sending Channel WNP Protocol command: %1 [TransactionId] %2 [ChannelId] %3 [PackageFullName] %4 [Properties] %6 [Command] %7 [Namespace] %8 [ContextId] %10 [Payload] %11 [UserId].

Fields #

Name	Description
`Sending_Channel_WNP_Protocol_command`	—
`TransactionId` Int32	—
`ChannelId` AnsiString	—
`PackageFullName` AnsiString	—
`Properties` UInt32	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—
`UserId` UInt64	—

Event ID 1103 — Channel WNP Protocol command tracking information: TransactionId [TransactionId] TrID [TrID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Channel WNP Protocol command tracking information: TransactionId [TransactionId] TrID [TrID].

Message #

Channel WNP Protocol command tracking information: %1 [TransactionId] %2 [TrID].

Fields #

Name	Description
`TransactionId` Int32	—
`TrID` UInt32	—

Event ID 1104 — Sending Revoke WNP Protocol command: Sending_Revoke_WNP_Protocol_command [ChannelId] CommandSize [Command] Command [Namespace] Namespace [ContextId] PayloadSize [Payload] Payload [UserId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Revoke WNP Protocol command: Sending_Revoke_WNP_Protocol_command [ChannelId] CommandSize [Command] Command [Namespace] Namespace [ContextId] PayloadSize [Payload] Payload [UserId].

Message #

Sending Revoke WNP Protocol command: %1 [ChannelId] %3 [Command] %4 [Namespace] %5 [ContextId] %7 [Payload] %8 [UserId].

Fields #

Name	Description
`Sending_Revoke_WNP_Protocol_command`	—
`ChannelId` AnsiString	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—
`UserId` UInt64	—

Event ID 1105 — Sending Block/Unblock WNP Protocol command: ChannelId [ChannelId] NotificationType [NotificationType] Enabled [Enabled] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payloa...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Block/Unblock WNP Protocol command: ChannelId [ChannelId] NotificationType [NotificationType] Enabled [Enabled] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payload] UserId [UserId].

Message #

Sending Block/Unblock WNP Protocol command: %1 [ChannelId] %2 [NotificationType] %3 [Enabled] %5 [Command] %6 [Namespace] %7 [ContextId] %9 [Payload] %10 [UserId].

Fields #

Name	Description
`ChannelId` AnsiString	—
`NotificationType` UInt32	—
`Enabled` Boolean	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—
`UserId` UInt64	—

Event ID 1106 — Sending Options WNP Protocol command: Sending_Options_WNP_Protocol_command [State] CommandSize [Command] Command [Namespace] Namespace [ContextId] PayloadSize [Payload].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Options WNP Protocol command: Sending_Options_WNP_Protocol_command [State] CommandSize [Command] Command [Namespace] Namespace [ContextId] PayloadSize [Payload].

Message #

Sending Options WNP Protocol command: %1 [State] %3 [Command] %4 [Namespace] %5 [ContextId] %7 [Payload].

Fields #

Name	Description
`Sending_Options_WNP_Protocol_command`	—
`BatchingState` UInt32	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—

Event ID 1107 — WNP Protocol command response: WNP_Protocol_command_response [TrID] TrID [Error] Error [ContextId] ContextId [UserId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Protocol command response: WNP_Protocol_command_response [TrID] TrID [Error] Error [ContextId] ContextId [UserId].

Message #

WNP Protocol command response: %1 [TrID] %2 [Error] %3 [ContextId] %4 [UserId].

Fields #

Name	Description
`WNP_Protocol_command_response`	—
`TrID` UInt32	—
`Error` UInt32	—
`ContextId` UInt64	—
`UserId` UInt64	—

Event ID 1108 — WNP Protocol delivered notification: WNP_Protocol_delivered_notification [Namespace] Namespace [UserId] UserId [PayloadSize] PayloadSize [MsgId] MsgId [Ack].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Protocol delivered notification: WNP_Protocol_delivered_notification [Namespace] Namespace [UserId] UserId [PayloadSize] PayloadSize [MsgId] MsgId [Ack].

Message #

WNP Protocol delivered notification: %1 [Namespace] %2 [UserId] %3 [PayloadSize] %4 [MsgId] %5 [Ack].

Fields #

Name	Description
`WNP_Protocol_delivered_notification`	—
`Namespace` AnsiString	—
`UserId` AnsiString	—
`PayloadSize` UInt32	—
`MsgId` UInt64	—
`Ack` Boolean	—

Event ID 1109 — Disconnecting from the Windows Push Notification Service.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Disconnecting from the Windows Push Notification Service.

Message #

Disconnecting from the Windows Push Notification Service.

Event ID 1110 — Windows Push Notification Service disconnection result: Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Windows Push Notification Service disconnection result: Error.

Message #

Windows Push Notification Service disconnection result: %1.

Fields #

Name	Description
`Error` UInt32	—

Event ID 1112 — Requesting Device Compact Ticket for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ConnectionEstablishment
Opcode: Start

Description

Requesting Device Compact Ticket for the ConnectionType.

Message #

Requesting Device Compact Ticket for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1113 — Device Compact Ticket request completed with Device Id DeviceId for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Stop

Description

Device Compact Ticket request completed with Device Id DeviceId for the ConnectionType.

Message #

Device Compact Ticket request completed with Device Id %1 for the %2.

Fields #

Name	Description
`DeviceId` AnsiString	—
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1113,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 2,
    "keywords": 9223372036854890496,
    "time_created": "2023-11-05T22:36:06.776267+00:00",
    "event_record_id": 2554,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0018800CFC3A4A31",
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1114 — Sending Filter/Unfilter WNP Protocol command: NotificationType [NotificationType] Enabled [Enabled] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payload] UserId [UserId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Filter/Unfilter WNP Protocol command: NotificationType [NotificationType] Enabled [Enabled] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payload] UserId [UserId].

Message #

Sending Filter/Unfilter WNP Protocol command: %1 [NotificationType] %2 [Enabled] %4 [Command] %5 [Namespace] %6 [ContextId] %8 [Payload] %9 [UserId].

Fields #

Name	Description
`NotificationType` UInt32	—
`Enabled` Boolean	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—
`UserId` UInt64	—

Event ID 1115 — Sending Ack WNP Protocol command: Sending_Ack_WNP_Protocol_command [MsgId] CommandSize [Command] Command [Namespace] PayloadSize [Payload].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Ack WNP Protocol command: Sending_Ack_WNP_Protocol_command [MsgId] CommandSize [Command] Command [Namespace] PayloadSize [Payload].

Message #

Sending Ack WNP Protocol command: %1 [MsgId] %3 [Command] %4 [Namespace] %6 [Payload].

Fields #

Name	Description
`Sending_Ack_WNP_Protocol_command`	—
`MsgId` UInt64	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`PayloadSize` UInt32	—
`Payload` Binary	—

Event ID 1116 — Device Compact Ticket request failed with error Error for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment
Opcode: Stop

Description

Device Compact Ticket request failed with error Error for the ConnectionType.

Message #

Device Compact Ticket request failed with error %1 for the %2.

Fields #

Name	Description
`Error` UInt32	—
`ConnectionType` UInt32	—

Event ID 1117 — Windows Push Notification Service was disconnected due to error: Error and will now enter reconnect mode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Windows Push Notification Service was disconnected due to error: Error and will now enter reconnect mode.

Message #

Windows Push Notification Service was disconnected due to error: %1 and will now enter reconnect mode.

Fields #

Name	Description
`Error` UInt32	Windows Push Notification Service was disconnected due to error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372037022564352,
    "time_created": "2023-11-05T22:36:04.732833+00:00",
    "event_record_id": 2541,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Error": 2147952453
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1118 — Sending Challenge Response WNP Protocol command: Nonce [Nonce] Response [Response] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payload].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Sending Challenge Response WNP Protocol command: Nonce [Nonce] Response [Response] Command [Command] Namespace [Namespace] ContextId [ContextId] Payload [Payload].

Message #

Sending Challenge Response WNP Protocol command: %1 [Nonce] %2 [Response] %4 [Command] %5 [Namespace] %6 [ContextId] %8 [Payload].

Fields #

Name	Description
`Nonce` AnsiString	—
`Response` AnsiString	—
`CommandSize` UInt32	—
`Command` Binary	—
`Namespace` AnsiString	—
`ContextId` UInt64	—
`PayloadSize` UInt32	—
`Payload` Binary	—

Event ID 1201 — WNP Transport Layer Connect call initiated for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer Connect call initiated for the ConnectionType.

Message #

WNP Transport Layer Connect call initiated for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1202 — WNP Transport Layer Connect call completed for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer Connect call completed for the ConnectionType.

Message #

WNP Transport Layer Connect call completed for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1203 — WNP Transport Layer SendCommand call initiated for TrID CommandTrid on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Start

Description

WNP Transport Layer SendCommand call initiated for TrID CommandTrid on the ConnectionType.

Message #

WNP Transport Layer SendCommand call initiated for TrID %1 on the %2.

Fields #

Name	Description
`CommandTrid` UInt32	—
`ConnectionType` UInt32	—

Event ID 1204 — WNP Transport Layer SendCommand call completed for TrID CommandTrid on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Stop

Description

WNP Transport Layer SendCommand call completed for TrID CommandTrid on the ConnectionType.

Message #

WNP Transport Layer SendCommand call completed for TrID %1 on the %2.

Fields #

Name	Description
`CommandTrid` UInt32	—
`ConnectionType` UInt32	—
`Error` UInt32	—

Event ID 1205 — WNP Transport Layer Disconnect call initiated for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: PlatformShutdown
Opcode: Start

Description

WNP Transport Layer Disconnect call initiated for the ConnectionType.

Message #

WNP Transport Layer Disconnect call initiated for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1205,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 1,
    "keywords": 9223372036861067264,
    "time_created": "2023-11-06T00:20:42.969404+00:00",
    "event_record_id": 2746,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1206 — WNP Transport Layer Disconnect call completed for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: PlatformShutdown
Opcode: Stop

Description

WNP Transport Layer Disconnect call completed for the ConnectionType.

Message #

WNP Transport Layer Disconnect call completed for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1206,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 2,
    "keywords": 9223372036861067264,
    "time_created": "2023-11-06T00:20:43.006766+00:00",
    "event_record_id": 2749,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1207 — WNP Transport Layer resolving DNS initiated for host HostName for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer resolving DNS initiated for host HostName for the ConnectionType.

Message #

WNP Transport Layer resolving DNS initiated for host %2 for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—
`HostName` AnsiString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1207,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 1,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.645586+00:00",
    "event_record_id": 2542,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "HostName": "client.wns.windows.com"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1208 — WNP Transport Layer resolving DNS completed for the ConnectionType with code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer resolving DNS completed for the ConnectionType with code ErrorCode.

Message #

WNP Transport Layer resolving DNS completed for the %1 with code %2.

Fields #

Name	Description
`ConnectionType` UInt32	—
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1208,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 2,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.671837+00:00",
    "event_record_id": 2543,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "ErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1209 — WNP Transport Layer retrieving proxy information initiated for the {ConnectionType}.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNP Transport Layer retrieving proxy information initiated for the {ConnectionType}.

Message #

WNP Transport Layer retrieving proxy information initiated for the {ConnectionType}.

Fields #

Name	Description
`ConnectionType`	—

Event ID 1210 — WNP Transport Layer retrieving proxy information completed for the {ConnectionType}.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNP Transport Layer retrieving proxy information completed for the {ConnectionType}.

Message #

WNP Transport Layer retrieving proxy information completed for the {ConnectionType}.

Fields #

Name	Description
`ConnectionType`	—

Event ID 1211 — WNP Transport Layer initial server connection initiated to server HostName on port Port for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer initial server connection initiated to server HostName on port Port for the ConnectionType.

Message #

WNP Transport Layer initial server connection initiated to server %2 on port %3 for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—
`HostName` AnsiString	—
`Port` UInt16	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1211,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 1,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.672509+00:00",
    "event_record_id": 2544,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "HostName": "client.wns.windows.com",
    "Port": 443
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1212 — WNP Transport Layer initial server connection completed to server HostName on port Port for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer initial server connection completed to server HostName on port Port for the ConnectionType.

Message #

WNP Transport Layer initial server connection completed to server %2 on port %3 for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—
`HostName` AnsiString	—
`Port` UInt16	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1212,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 2,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.697481+00:00",
    "event_record_id": 2545,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "HostName": "client.wns.windows.com",
    "Port": 443
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1213 — WNP Transport Layer proxy connection initiated for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer proxy connection initiated for the ConnectionType.

Message #

WNP Transport Layer proxy connection initiated for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1214 — WNP Transport Layer proxy connection completed to server HostName for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer proxy connection completed to server HostName for the ConnectionType.

Message #

WNP Transport Layer proxy connection completed to server %2 for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—
`HostName` UnicodeString	—

Event ID 1215 — WNP Transport Layer proxy negotiation initiated for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer proxy negotiation initiated for the ConnectionType.

Message #

WNP Transport Layer proxy negotiation initiated for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1216 — WNP Transport Layer proxy negotiation completed for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer proxy negotiation completed for the ConnectionType.

Message #

WNP Transport Layer proxy negotiation completed for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1217 — WNP Transport Layer TLS negotiation initiated for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Start

Description

WNP Transport Layer TLS negotiation initiated for the ConnectionType.

Message #

WNP Transport Layer TLS negotiation initiated for the %1.

Fields #

Name	Description
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1217,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 1,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.697498+00:00",
    "event_record_id": 2546,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1218 — WNP Transport Layer TLS negotiation completed for the ConnectionType with code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ConnectionEstablishment
Opcode: Stop

Description

WNP Transport Layer TLS negotiation completed for the ConnectionType with code ErrorCode.

Message #

WNP Transport Layer TLS negotiation completed for the %1 with code %2.

Fields #

Name	Description
`ConnectionType` UInt32	—
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1218,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 2,
    "keywords": 9223372036859068416,
    "time_created": "2023-11-05T22:36:06.766754+00:00",
    "event_record_id": 2553,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "ErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1219 — WNP Transport Layer sent Bytes bytes on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Transport Layer sent Bytes bytes on the ConnectionType.

Message #

WNP Transport Layer sent %1 bytes on the %2.

Fields #

Name	Description
`Bytes` UInt32	—
`ConnectionType` UInt32	—

Event ID 1220 — WNP Transport Layer received Bytes bytes on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Transport Layer received Bytes bytes on the ConnectionType.

Message #

WNP Transport Layer received %1 bytes on the %2.

Fields #

Name	Description
`Bytes` UInt32	—
`ConnectionType` UInt32	—

Event ID 1223 — WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Verbose
Opcode: Info

Description

WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer sent command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload: %6. IsLongRunning: %7.

Fields #

Name	Description
`Verb` AnsiString	WNP Transport Layer sent command.
`TrID` UInt32	—
`Namespace` AnsiString	—
`CorrelationVector` AnsiString	—
`Bytes` UInt32	—
`Payload` Binary	5 bytes of payload.
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1223,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.345596+00:00",
    "event_record_id": 2773,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19",
    "Bytes": 29,
    "Payload": "436F6E746578743A20336635303563336636353833666465640D0A0D0A",
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1224 — WNP Transport Layer received Bytes bytes of payload: Payload.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer received Bytes bytes of payload: Payload.

Message #

WNP Transport Layer received %1 bytes of payload: %2.

Fields #

Name	Description
`Bytes` UInt32	—
`Payload` Binary	—
`ConnectionType` UInt32	—

Event ID 1225 — WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Verbose
Opcode: Info

Description

WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer received command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload: %6. IsLongRunning: %7.

Fields #

Name	Description
`Verb` AnsiString	WNP Transport Layer received command.
`TrID` UInt32	—
`Namespace` AnsiString	—
`CorrelationVector` AnsiString	—
`Bytes` UInt32	—
`Payload` Binary	5 bytes of payload.
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1225,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.384647+00:00",
    "event_record_id": 2775,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19.0",
    "Bytes": 126,
    "Payload": "4D532D43563A2076665034596D4E79786B5367485649742E31392E300D0A0D0A3C70696E672D726573706F6E73653E3C776169743E34333C2F776169743E3C636F6E6E656374696F6E2D7374617475733E436F6E6E65637465643C2F636F6E6E656374696F6E2D7374617475733E3C2F70696E672D726573706F6E73653E",
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1226 — WNP Transport Layer received proxy server response for the ConnectionType of Bytes bytes with payload: Payload.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer received proxy server response for the ConnectionType of Bytes bytes with payload: Payload.

Message #

WNP Transport Layer received proxy server response for the %3 of %1 bytes with payload: %2.

Fields #

Name	Description
`Bytes` UInt32	—
`Payload` Binary	—
`ConnectionType` UInt32	—

Event ID 1227 — WNP Transport Layer received command when disconnected with Verb: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer received command when disconnected with Verb: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer received command when disconnected with Verb: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload: %6. IsLongRunning: %7.

Fields #

Name	Description
`Verb` AnsiString	—
`TrID` UInt32	—
`Namespace` AnsiString	—
`CorrelationVector` AnsiString	—
`Bytes` UInt32	—
`Payload` Binary	—
`ConnectionType` UInt32	—

Event ID 1228 — WNP Keep Alive Detector received OnConnected event from the test connection with Error: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector received OnConnected event from the test connection with Error: ErrorCode.

Message #

WNP Keep Alive Detector received OnConnected event from the test connection with Error: %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1229 — WNP Keep Alive Detector received OnReconnecting event from the test connection with Error: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector received OnReconnecting event from the test connection with Error: ErrorCode.

Message #

WNP Keep Alive Detector received OnReconnecting event from the test connection with Error: %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1230 — WNP Keep Alive Detector received OnDisconnected event from the test connection with Error: ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector received OnDisconnected event from the test connection with Error: ErrorCode.

Message #

WNP Keep Alive Detector received OnDisconnected event from the test connection with Error: %1

Fields #

Name	Description
`ErrorCode` UInt32	—

Event ID 1231 — WNP Keep Alive Detector received KA hint from server: ServerKaHint seconds.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector received KA hint from server: ServerKaHint seconds.

Message #

WNP Keep Alive Detector received KA hint from server: %1 seconds

Fields #

Name	Description
`ServerKaHint` UInt32	—

Event ID 1232 — WNP Keep Alive Detector updating cached Ka time with value: KaValue seconds; type: KaValueType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector updating cached Ka time with value: KaValue seconds; type: KaValueType.

Message #

WNP Keep Alive Detector updating cached Ka time with value: %2 seconds; type: %1

Fields #

Name	Description
`KaValueType` UInt32	—
`KaValue` UInt32	—

Event ID 1233 — Fast reconnect triggered for previous WNS session (SessionId) on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Fast reconnect triggered for previous WNS session (SessionId) on the ConnectionType. It has been SecondsSinceLastSentPacket seconds since last packet.

Message #

Fast reconnect triggered for previous WNS session (%1) on the %3.  It has been %2 seconds since last packet.

Fields #

Name	Description
`SessionId` AnsiString	—
`SecondsSinceLastSentPacket` UInt64	—
`ConnectionType` UInt32	—

Event ID 1234 — ConnectionType TCP connection established over ProtocolType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

ConnectionType TCP connection established over ProtocolType.

Message #

%2 TCP connection established over %1.

Fields #

Name	Description
`ProtocolType` UInt32	—
`ConnectionType` UInt32	—

Event ID 1235 — WNP Keep Alive Detector resetting Idle Failed Interval.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector resetting Idle Failed Interval. Last Idle-Succeeded interval IdleSucceededInterval seconds is larger than Idle-Failed interval IdleFailedInterval seconds.

Message #

WNP Keep Alive Detector resetting Idle Failed Interval. Last Idle-Succeeded interval %1 seconds is larger than Idle-Failed interval %2 seconds

Fields #

Name	Description
`IdleSucceededInterval` UInt32	—
`IdleFailedInterval` UInt32	—

Event ID 1236 — WNP Keep Alive Detector incrementing Idle-Succeeded count to IdleSucceededCount.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector incrementing Idle-Succeeded count to IdleSucceededCount.

Message #

WNP Keep Alive Detector incrementing Idle-Succeeded count to %1

Fields #

Name	Description
`IdleSucceededCount` UInt32	—

Event ID 1237 — WNP Keep Alive Detector encountered failed idle interval of IdleFailedInterval seconds.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Keep Alive Detector encountered failed idle interval of IdleFailedInterval seconds.

Message #

WNP Keep Alive Detector encountered failed idle interval of %1 seconds

Fields #

Name	Description
`IdleFailedInterval` UInt32	—

Event ID 1238 — WNP Keep Alive Detector starting Test Connection

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Keep Alive Detector starting Test Connection.

Message #

WNP Keep Alive Detector starting Test Connection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1238,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:33:26.748563+00:00",
    "event_record_id": 2458,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1239 — WNP Keep Alive Detector starting KA measurement with value: KaValue seconds; type: KaValueType; Min Limit: KaMinLimit seconds.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Keep Alive Detector starting KA measurement with value: KaValue seconds; type: KaValueType; Min Limit: KaMinLimit seconds.

Message #

WNP Keep Alive Detector starting KA measurement with value: %2 seconds; type: %1; Min Limit: %3 seconds

Fields #

Name	Description
`KaValueType` UInt32	seconds; type.
`KaValue` UInt32	WNP Keep Alive Detector starting KA measurement with value.
`KaMinLimit` UInt32	; Min Limit.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1239,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:33:26.736302+00:00",
    "event_record_id": 2457,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 3672
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "KaValueType": 0,
    "KaValue": 60,
    "KaMinLimit": 60
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1240 — WNP Keep Alive Detector stopping KA measurement

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Keep Alive Detector stopping KA measurement.

Message #

WNP Keep Alive Detector stopping KA measurement

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1240,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2026-02-10T04:19:29.950446+00:00",
    "event_record_id": 936,
    "correlation": {},
    "execution": {
      "process_id": 3980,
      "thread_id": 9792
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 1241 — WNP Keep Alive Detector lost network over ProtocolType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Keep Alive Detector lost network over ProtocolType.

Message #

WNP Keep Alive Detector lost network over %1.

Fields #

Name	Description
`ProtocolType` UInt32	—

Event ID 1242 — WNP Transport Layer received Power Management event with type PowerManagementType on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer received Power Management event with type PowerManagementType on the ConnectionType.

Message #

WNP Transport Layer received Power Management event with type %1 on the %2.

Fields #

Name	Description
`PowerManagementType` UInt32	—
`ConnectionType` UInt32	—

Event ID 1243 — WNP Transport Layer received Power Management event with type PowerManagementType on the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Transport Layer received Power Management event with type PowerManagementType on the ConnectionType. Message is ignored.

Message #

WNP Transport Layer received Power Management event with type %1 on the %2.  Message is ignored

Fields #

Name	Description
`PowerManagementType` UInt32	—
`ConnectionType` UInt32	—

Event ID 1244 — Connection to the Windows Push Notification Service (HostName:Port) failed because proxy host detected (ProxyHostName) could not be used to establish the connection.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Message #

Connection to the Windows Push Notification Service (%1:%2) failed because proxy host detected (%3) could not be used to establish the connection.  Please check the proxy configuration on the client as well as verify that the proxy host detected is operating correctly.

Fields #

Name	Description
`HostName` UnicodeString	—
`Port` UInt16	—
`ProxyHostName` UnicodeString	—

Event ID 1245 — Connection to the Windows Push Notification Service (HostName:Port) failed because the proxy host detected (ProxyHostName) explicitly requires user authentication.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Admin
Opcode: Info

Message #

Connection to the Windows Push Notification Service (%1:%2) failed because the proxy host detected (%3) explicitly requires user authentication.  Only proxies configured with NTLM authentication are supported.

Fields #

Name	Description
`HostName` UnicodeString	—
`Port` UInt16	—
`ProxyHostName` UnicodeString	—

Event ID 1246 — WNP Transport Layer was disconnected from the Windows Push Notification Service due to a loss of network connectivity.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer was disconnected from the Windows Push Notification Service due to a loss of network connectivity.

Message #

WNP Transport Layer was disconnected from the Windows Push Notification Service due to a loss of network connectivity.

Event ID 1247 — Connection to the Windows Push Notification Service failed because of a failure to configure the connection to run properly in low-power states.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Admin
Opcode: Info

Description

Connection to the Windows Push Notification Service failed because of a failure to configure the connection to run properly in low-power states. Please ensure all network drivers are up to date.

Message #

Connection to the Windows Push Notification Service failed because of a failure to configure the connection to run properly in low-power states.  Please ensure all network drivers are up to date.

Fields #

Name	Description
`ControlChannelTriggerStatus` UInt32	—

Event ID 1248 — Connection to the Windows Push Notification Service (HostName:Port) failed because the proxy host detected (ProxyHostName) could not be connected to.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Admin
Opcode: Info

Description

Connection to the Windows Push Notification Service (HostName:Port) failed because the proxy host detected (ProxyHostName) could not be connected to. The HTTP request failed with HTTP Status: HttpStatus.

Message #

Connection to the Windows Push Notification Service (%1:%2) failed because the proxy host detected (%3) could not be connected to. The HTTP request failed with HTTP Status: %4.

Fields #

Name	Description
`HostName` UnicodeString	—
`Port` UInt16	—
`ProxyHostName` UnicodeString	—
`HttpStatus` UInt32	—

Event ID 1249 — StopKeepAliveMeasurement was called from message loop.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

StopKeepAliveMeasurement was called from message loop.

Message #

StopKeepAliveMeasurement was called from message loop.

Event ID 1250 — The KA measurement was never started.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The KA measurement was never started.

Message #

The KA measurement was never started.

Event ID 1251 — The test connection disconnect failed synchronously due to error: Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The test connection disconnect failed synchronously due to error: Error.

Message #

The test connection disconnect failed synchronously due to error: %1

Fields #

Name	Description
`Error` UInt32	—

Event ID 1252 — The KA value has converged.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

The KA value has converged. Now disconnect test connection.

Message #

The KA value has converged.  Now disconnect test connection.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1252,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-06T00:20:42.944747+00:00",
    "event_record_id": 2745,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1253 — The test connection will be disconnected due to idle failure.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The test connection will be disconnected due to idle failure.

Message #

The test connection will be disconnected due to idle failure.

Event ID 1254 — WNP Transport Layer for ConnectionType detected preferred interface change.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Transport Layer for ConnectionType detected preferred interface change. Old index OldIndex, old address family OldAddressFamily. New index NewIndex, new address family NewAddressFamily, NDIS_PHYSICAL_MEDIUM NewPhysicalMediumType.

Message #

WNP Transport Layer for %1 detected preferred interface change. Old index %2, old address family %3. New index %4, new address family %5, NDIS_PHYSICAL_MEDIUM %6.

Fields #

Name	Description
`ConnectionType` UInt32	—
`OldIndex` UInt32	—
`OldAddressFamily` UInt32	—
`NewIndex` UInt32	—
`NewAddressFamily` UInt32	—
`NewPhysicalMediumType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1254,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:33:26.761426+00:00",
    "event_record_id": 2462,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 0,
    "OldIndex": 0,
    "OldAddressFamily": 0,
    "NewIndex": 9,
    "NewAddressFamily": 0,
    "NewPhysicalMediumType": 14
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1255 — WNP Transport Layer for ConnectionType reacting to preferred interface change, disconnect and immediately reconnect.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer for ConnectionType reacting to preferred interface change, disconnect and immediately reconnect.

Message #

WNP Transport Layer for %1 reacting to preferred interface change, disconnect and immediately reconnect.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1256 — WNP Transport Layer for ConnectionType reacting to preferred interface change, immediately reconnect.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer for ConnectionType reacting to preferred interface change, immediately reconnect.

Message #

WNP Transport Layer for %1 reacting to preferred interface change, immediately reconnect.

Fields #

Name	Description
`ConnectionType` UInt32	—

Event ID 1257 — WNP Transport Layer for ConnectionType called InitializeSecurityContext and got return code Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Transport Layer for ConnectionType called InitializeSecurityContext and got return code Error.

Message #

WNP Transport Layer for %1 called InitializeSecurityContext and got return code %2.

Fields #

Name	Description
`ConnectionType` UInt32	—
`Error` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1257,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:36:06.766744+00:00",
    "event_record_id": 2552,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "Error": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1258 — WNP Transport Layer for ConnectionType received asynchronous connection error SocketError.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Transport Layer for ConnectionType received asynchronous connection error SocketError.

Message #

WNP Transport Layer for %1 received asynchronous connection error %2.

Fields #

Name	Description
`ConnectionType` UInt32	—
`SocketError` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1258,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:36:03.277507+00:00",
    "event_record_id": 2540,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 1,
    "SocketError": 10053
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1259 — WNP Transport Layer for the Data Connection sending out of band keep alive (PNG) request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer for the Data Connection sending out of band keep alive (PNG) request.

Message #

WNP Transport Layer for the Data Connection sending out of band keep alive (PNG) request.

Event ID 1260 — WNP Transport Layer for the Data Connection received cellular state change WNF event.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer for the Data Connection received cellular state change WNF event.

Message #

WNP Transport Layer for the Data Connection received cellular state change WNF event.

Event ID 1261 — Adding new user to the Windows Push Notification Service.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Adding new user to the Windows Push Notification Service. DeviceId [DeviceId] UserId [UserId] UserType [UserType].

Message #

Adding new user to the Windows Push Notification Service. %1 [DeviceId] %2 [UserId] %3 [UserType].

Fields #

Name	Description
`DeviceId` AnsiString	—
`UserId` UInt64	—
`UserType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1261,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:41:17.176465+00:00",
    "event_record_id": 2593,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0018800CFC3A4A31",
    "UserId": 0,
    "UserType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1262 — Removing existing user from the Windows Push Notification Service.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Removing existing user from the Windows Push Notification Service. DeviceId [DeviceId] UserId [UserId] UserType [UserType].

Message #

Removing existing user from the Windows Push Notification Service. %1 [DeviceId] %2 [UserId] %3 [UserType].

Fields #

Name	Description
`DeviceId` AnsiString	—
`UserId` UInt64	—
`UserType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1262,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:31:33.631380+00:00",
    "event_record_id": 2379,
    "correlation": {},
    "execution": {
      "process_id": 3280,
      "thread_id": 1712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0018800CFC3A4A31",
    "UserId": 17056889,
    "UserType": 2
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1263 — Replacing existing user from the Windows Push Notification Service.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Replacing existing user from the Windows Push Notification Service. DeviceId [DeviceId] OldUserId [OldUserId] OldUserType [OldUserType] NewUserId [NewUserId] NewUserType [NewUserType].

Message #

Replacing existing user from the Windows Push Notification Service. %1 [DeviceId] %2 [OldUserId] %3 [OldUserType] %4 [NewUserId] %5 [NewUserType].

Fields #

Name	Description
`DeviceId` AnsiString	—
`OldUserId` UInt64	—
`OldUserType` UInt32	—
`NewUserId` UInt64	—
`NewUserType` UInt32	—

Event ID 1264 — Adding new user to the Windows Push Notification Service completed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Adding new user to the Windows Push Notification Service completed. DeviceId [DeviceId] UserId [UserId] Error [ErrorCode].

Message #

Adding new user to the Windows Push Notification Service completed. %1 [DeviceId] %2 [UserId] %3 [ErrorCode].

Fields #

Name	Description
`DeviceId` AnsiString	—
`UserId` UInt64	—
`Error` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1264,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:41:17.203291+00:00",
    "event_record_id": 2598,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0018800CFC3A4A31",
    "UserId": 0,
    "Error": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1265 — Removing existing user from the Windows Push Notification Service completed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Removing existing user from the Windows Push Notification Service completed. DeviceId [DeviceId] UserId [UserId] Error [ErrorCode].

Message #

Removing existing user from the Windows Push Notification Service completed. %1 [DeviceId] %2 [UserId] %3 [ErrorCode].

Fields #

Name	Description
`DeviceId` AnsiString	—
`UserId` UInt64	—
`Error` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1265,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:31:33.659387+00:00",
    "event_record_id": 2384,
    "correlation": {},
    "execution": {
      "process_id": 3280,
      "thread_id": 1712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "DeviceId": "0018800CFC3A4A31",
    "UserId": 17056889,
    "Error": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1266 — Replacing existing user from the Windows Push Notification Service completed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Replacing existing user from the Windows Push Notification Service completed. DeviceId [DeviceId] OldUserId [OldUserId] NewUserId [NewUserId] Error [ErrorCode].

Message #

Replacing existing user from the Windows Push Notification Service completed. %1 [DeviceId] %2 [OldUserId] %3 [NewUserId] %4 [ErrorCode].

Fields #

Name	Description
`DeviceId` AnsiString	—
`OldUserId` UInt64	—
`NewUserId` UInt64	—
`Error` UInt32	—

Event ID 1267 — WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Verbose
Opcode: Info

Description

WNP Transport Layer sent command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only. However, full payload including header is: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer sent command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload only. However, full payload including header is: %6. IsLongRunning: %7.

Fields #

Name	Description
`Verb` AnsiString	WNP Transport Layer sent command.
`TrID` UInt32	—
`Namespace` AnsiString	—
`CorrelationVector` AnsiString	—
`Bytes` UInt32	—
`Payload` Binary	5 bytes of payload only. However, full payload including header is.
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1267,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.345599+00:00",
    "event_record_id": 2774,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19",
    "Bytes": 72,
    "Payload": "504E4720313920434F4E2035370D0A4D532D43563A2076665034596D4E79786B5367485649742E31390D0A436F6E746578743A20336635303563336636353833666465640D0A0D0A",
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1268 — WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Verbose
Opcode: Info

Description

WNP Transport Layer received command: Verb, Trid: TrID, Namespace: Namespace, CV: CorrelationVector containing Bytes bytes of payload only. However, full payload including header is: Payload. IsLongRunning: ConnectionType.

Message #

WNP Transport Layer received command: %1, Trid: %2, Namespace: %3, CV: %4 containing %5 bytes of payload only. However, full payload including header is: %6. IsLongRunning: %7.

Fields #

Name	Description
`Verb` AnsiString	WNP Transport Layer received command.
`TrID` UInt32	—
`Namespace` AnsiString	—
`CorrelationVector` AnsiString	—
`Bytes` UInt32	—
`Payload` Binary	5 bytes of payload only. However, full payload including header is.
`ConnectionType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1268,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036959633408,
    "time_created": "2023-11-06T01:49:11.384651+00:00",
    "event_record_id": 2776,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 4140
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Verb": "PNG",
    "TrID": 19,
    "Namespace": "CON",
    "CorrelationVector": "vfP4YmNyxkSgHVIt.19.0",
    "Bytes": 126,
    "Payload": "504E4720313920434F4E003132360D0A4D532D43563A2076665034596D4E79786B5367485649742E31392E300D0A0D0A3C70696E672D726573706F6E73653E3C776169743E34333C2F776169743E3C636F6E6E656374696F6E2D7374617475733E436F6E6E65637465643C2F636F6E6E656374696F6E2D7374617475733E",
    "ConnectionType": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1300 — Started tracking connection establishment performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Started tracking connection establishment performance.

Message #

Started tracking connection establishment performance.

Event ID 1301 — Finished tracking connection establishment performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Finished tracking connection establishment performance.

Message #

Finished tracking connection establishment performance.

Event ID 1302 — PDC Intialization finished with error code [ErrorCode] and Initialization Count is [InitCount].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC Intialization finished with error code [ErrorCode] and Initialization Count is [InitCount].

Message #

PDC Intialization finished with error code [%1] and Initialization Count is [%2].

Fields #

Name	Description
`ErrorCode` Int32	—
`InitCount` Int64	—

Event ID 1303 — PDC Unintialization finished with error code [ErrorCode] and Initialization Count is [InitCount].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC Unintialization finished with error code [ErrorCode] and Initialization Count is [InitCount].

Message #

PDC Unintialization finished with error code [%1] and Initialization Count is [%2].

Fields #

Name	Description
`ErrorCode` Int32	—
`InitCount` Int64	—

Event ID 1304 — PDC Activation finished with error code [ErrorCode], Initialization Count is [InitCount], and Reason is [PdcReason] for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC Activation finished with error code [ErrorCode], Initialization Count is [InitCount], and Reason is [PdcReason] for the ConnectionType.

Message #

PDC Activation finished with error code [%1], Initialization Count is [%2], and Reason is [%3] for the %4.

Fields #

Name	Description
`ErrorCode` Int32	—
`InitCount` Int64	—
`PdcReason` Int64	—
`ConnectionType` UInt32	—

Event ID 1305 — PDC Deactivation finished with error code [ErrorCode], Initialization Count is [InitCount], and Reason is [PdcReason] for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PDC Deactivation finished with error code [ErrorCode], Initialization Count is [InitCount], and Reason is [PdcReason] for the ConnectionType.

Message #

PDC Deactivation finished with error code [%1], Initialization Count is [%2], and Reason is [%3] for the %4.

Fields #

Name	Description
`ErrorCode` Int32	—
`InitCount` Int64	—
`PdcReason` Int64	—
`ConnectionType` UInt32	—

Event ID 1306 — WNP protocol state for Device Id DeviceId is State State for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP protocol state for Device Id DeviceId is State State for the ConnectionType.

Message #

WNP protocol state for Device Id %1 is State %2 for the %3.

Fields #

Name	Description
`DeviceId` AnsiString	—
`State` Int64	—
`ConnectionType` UInt32	—

Event ID 1307 — WNP Connector state for Connector Id ConnectorId is State State for the ConnectionType.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Connector state for Connector Id ConnectorId is State State for the ConnectionType.

Message #

WNP Connector state for Connector Id %1 is State %2 for the %3.

Fields #

Name	Description
`ConnectorId` UInt32	—
`State` Int64	—
`ConnectionType` UInt32	—

Event ID 1308 — WNP Transport Layer for Connector Id ConnectorId requested NCSI probe for the ConnectionType and got error code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Transport Layer for Connector Id ConnectorId requested NCSI probe for the ConnectionType and got error code ErrorCode.

Message #

WNP Transport Layer for Connector Id %1 requested NCSI probe for the %2 and got error code %3.

Fields #

Name	Description
`ConnectorId` UInt32	—
`ConnectionType` UInt32	—
`ErrorCode` Int32	—

Event ID 1309 — WNP Transport Layer for Auth Manager requested NCSI probe for the ConnectionType and got error code ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

WNP Transport Layer for Auth Manager requested NCSI probe for the ConnectionType and got error code ErrorCode.

Message #

WNP Transport Layer for Auth Manager requested NCSI probe for the %1 and got error code %2.

Fields #

Name	Description
`ConnectionType` UInt32	—
`ErrorCode` Int32	—

Event ID 1310 — WNP Transport Layer for ConnectionType detected first fallback interface change.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

WNP Transport Layer for ConnectionType detected first fallback interface change. Old index OldIndex, old address family OldAddressFamily. New index NewIndex, new address family NewAddressFamily, NDIS_PHYSICAL_MEDIUM NewPhysicalMediumType.

Message #

WNP Transport Layer for %1 detected first fallback interface change. Old index %2, old address family %3. New index %4, new address family %5, NDIS_PHYSICAL_MEDIUM %6.

Fields #

Name	Description
`ConnectionType` UInt32	—
`OldIndex` UInt32	—
`OldAddressFamily` UInt32	—
`NewIndex` UInt32	—
`NewAddressFamily` UInt32	—
`NewPhysicalMediumType` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 1310,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036858970112,
    "time_created": "2023-11-05T22:33:26.761428+00:00",
    "event_record_id": 2463,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0003-9850-DBE43710DA01"
    },
    "execution": {
      "process_id": 3380,
      "thread_id": 5052
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ConnectionType": 0,
    "OldIndex": 0,
    "OldAddressFamily": 0,
    "NewIndex": 4,
    "NewAddressFamily": 0,
    "NewPhysicalMediumType": 14
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1311 — WNP Transport Layer for ConnectionType detected second fallback interface change.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer for ConnectionType detected second fallback interface change. Old index OldIndex, old address family OldAddressFamily. New index NewIndex, new address family NewAddressFamily, NDIS_PHYSICAL_MEDIUM NewPhysicalMediumType.

Message #

WNP Transport Layer for %1 detected second fallback interface change. Old index %2, old address family %3. New index %4, new address family %5, NDIS_PHYSICAL_MEDIUM %6.

Fields #

Name	Description
`ConnectionType` UInt32	—
`OldIndex` UInt32	—
`OldAddressFamily` UInt32	—
`NewIndex` UInt32	—
`NewAddressFamily` UInt32	—
`NewPhysicalMediumType` UInt32	—

Event ID 1312 — WNP Transport Layer detected low WIFI signal quality level (value = TriggerValue); and hence sending out of band keep alive (PNG) request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer detected low WIFI signal quality level (value = TriggerValue); and hence sending out of band keep alive (PNG) request.

Message #

WNP Transport Layer detected low WIFI signal quality level (value = %1); and hence sending out of band keep alive (PNG) request.

Fields #

Name	Description
`TriggerValue` UInt32	—

Event ID 1313 — WNP Transport Layer detected a significant drop in WIFI signal quality (delta = TriggerValue); and hence sending out of band keep alive (PNG) request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer detected a significant drop in WIFI signal quality (delta = TriggerValue); and hence sending out of band keep alive (PNG) request.

Message #

WNP Transport Layer detected a significant drop in WIFI signal quality (delta = %1); and hence sending out of band keep alive (PNG) request.

Fields #

Name	Description
`TriggerValue` UInt32	—

Event ID 1314 — WNP Transport Layer detected a change in WIFI interface availability (event TriggerValue); and hence sending out of band keep alive (PNG) request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer detected a change in WIFI interface availability (event TriggerValue); and hence sending out of band keep alive (PNG) request.

Message #

WNP Transport Layer detected a change in WIFI interface availability (event %1); and hence sending out of band keep alive (PNG) request.

Fields #

Name	Description
`TriggerValue` UInt32	—

Event ID 1315 — WNP Transport Layer detected a change in WIFI interface connectivity status (event TriggerValue); and hence sending out of band keep alive (PNG) request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

WNP Transport Layer detected a change in WIFI interface connectivity status (event TriggerValue); and hence sending out of band keep alive (PNG) request.

Message #

WNP Transport Layer detected a change in WIFI interface connectivity status (event %1); and hence sending out of band keep alive (PNG) request.

Fields #

Name	Description
`TriggerValue` UInt32	—

Event ID 1316 — WNS delivered notification dropped in CP: ErrorCode [ErrorCode] Namespace [Namespace] UserId [UserId] PayloadSize [PayloadSize] MsgId [MsgId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNS delivered notification dropped in CP: ErrorCode [ErrorCode] Namespace [Namespace] UserId [UserId] PayloadSize [PayloadSize] MsgId [MsgId].

Message #

WNS delivered notification dropped in CP: %1 [ErrorCode] %2 [Namespace] %3 [UserId] %4 [PayloadSize] %5 [MsgId].

Fields #

Name	Description
`ErrorCode` UInt32	—
`Namespace` AnsiString	—
`UserId` AnsiString	—
`PayloadSize` UInt32	—
`MsgId` UInt64	—

Event ID 1316 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNS delivered notification dropped in CP: [ErrorCode] [Namespace] [UserId] [PayloadSize] [MsgId].

Fields #

Name	Description
`ErrorCode` UInt32	—
`Namespace` AnsiString	—
`UserId` AnsiString	—
`PayloadSize` UInt32	—
`MsgId` UInt64	—

Event ID 1317 — NotificationType associated with ChannelId ChannelId and AppUserModelId AppUserModelId with X-WNS-MSG-ID MessageId failed to be submitted to threadpool.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival

Description

NotificationType associated with ChannelId ChannelId and AppUserModelId AppUserModelId with X-WNS-MSG-ID MessageId failed to be submitted to threadpool. ErrorCode ErrorCode.

Message #

%1 associated with ChannelId %2 and AppUserModelId %3 with X-WNS-MSG-ID %4 failed to be submitted to threadpool. ErrorCode %5

Fields #

Name	Description
`NotificationType` UInt32	—
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`MessageId` UInt64	—
`ErrorCode` UInt32	—

Event ID 1317 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival

Description

associated with ChannelId and AppUserModelId with X-WNS-MSG-ID failed to be submitted to threadpool. ErrorCode.

Fields #

Name	Description
`NotificationType` UInt32	—
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`MessageId` UInt64	—
`ErrorCode` UInt32	—

Event ID 1318 — WNP Protocol delivered notification: Namespace [Namespace] UserId [UserId] PayloadSize [PayloadSize] MsgId [MsgId] Ack [Ack] CorrelationVector [CorrelationVector].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNP Protocol delivered notification: Namespace [Namespace] UserId [UserId] PayloadSize [PayloadSize] MsgId [MsgId] Ack [Ack] CorrelationVector [CorrelationVector].

Message #

WNP Protocol delivered notification: %1 [Namespace] %2 [UserId] %3 [PayloadSize] %4 [MsgId] %5 [Ack] %6 [CorrelationVector].

Fields #

Name	Description
`Namespace` AnsiString	—
`UserId` AnsiString	—
`PayloadSize` UInt32	—
`MsgId` UInt64	—
`Ack` Boolean	—
`CorrelationVector` AnsiString	—

Event ID 1318 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

WNP Protocol delivered notification: [Namespace] [UserId] [PayloadSize] [MsgId] [Ack] [CorrelationVector].

Fields #

Name	Description
`Namespace` AnsiString	—
`UserId` AnsiString	—
`PayloadSize` UInt32	—
`MsgId` UInt64	—
`Ack` Boolean	—
`CorrelationVector` AnsiString	—

Event ID 2000 — The Windows Push Notification Platform has received a channel request with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestChannel
Opcode: Start

Description

The Windows Push Notification Platform has received a channel request with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId].

Message #

The Windows Push Notification Platform has received a channel request with the following parameters: %1 [PackageFullName] %2 [AppUserModelId].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelId` UnicodeString	—

Event ID 2001 — The channel table has added a valid channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: RequestChannel
Opcode: Stop

Description

The channel table has added a valid channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

The channel table has added a valid channel mapping: %1 [ChannelId] %2 [AppUserModelId] %3 [ErrorCode].

Fields #

Name	Description
`ChannelId` UnicodeString	The channel table has added a valid channel mapping.
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 2001,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": 9223372036863164928,
    "time_created": "2023-11-05T22:41:17.323597+00:00",
    "event_record_id": 2606,
    "correlation": {},
    "execution": {
      "process_id": 3380,
      "thread_id": 5016
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ChannelId": "1;15334591640917018673",
    "AppUserModelId": "Microsoft.Windows.PushToInstall",
    "ErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2002 — The channel table has removed a channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

The channel table has removed a channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

The channel table has removed a channel mapping: %1 [ChannelId] %2 [AppUserModelId] %3 [ErrorCode].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 2003 — The channel table has updated a channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: RequestChannel
Opcode: Stop

Description

The channel table has updated a channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

The channel table has updated a channel mapping: %1 [ChannelId] %2 [AppUserModelId] %3 [ErrorCode].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 2004 — The channel table has returned a cached channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestChannel
Opcode: Stop

Description

The channel table has returned a cached channel mapping: ChannelId [ChannelId] AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

The channel table has returned a cached channel mapping: %1 [ChannelId] %2 [AppUserModelId] %3 [ErrorCode].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 2005 — A cloud notification callback was added: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cloud notification callback was added: AppUserModelId [AppUserModelId].

Message #

A cloud notification callback was added: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2006 — A cloud notification callback was removed: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cloud notification callback was removed: AppUserModelId [AppUserModelId].

Message #

A cloud notification callback was removed: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2007 — A cloud notification could not be delivered to a callback due to an error: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cloud notification could not be delivered to a callback due to an error: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

A cloud notification could not be delivered to a callback due to an error: %1 [AppUserModelId] %2 [ErrorCode].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 2008 — A cloud notification was delivered to a callback: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cloud notification was delivered to a callback: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId].

Message #

A cloud notification was delivered to a callback: %1 [AppUserModelId] %2 [NotificationType] %3 [NotificationTrackingId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—

Event ID 2009 — A local notification was submitted to threadpool: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId] NotificationSource [NotificationSource].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewLocalNotificationArrival
Opcode: Start

Description

A local notification was submitted to threadpool: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId] NotificationSource [NotificationSource].

Message #

A local notification was submitted to threadpool: %1 [AppUserModelId] %2 [NotificationType] %3 [NotificationTrackingId] %4 [NotificationSource].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`NotificationSource` UInt32	—

Event ID 2010 — A clear tile message was received from an application endpoint: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A clear tile message was received from an application endpoint: AppUserModelId [AppUserModelId].

Message #

A clear tile message was received from an application endpoint: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2011 — A clear badge message was received from an application endpoint: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A clear badge message was received from an application endpoint: AppUserModelId [AppUserModelId].

Message #

A clear badge message was received from an application endpoint: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2012 — A cancel toast message was received from an application endpoint: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cancel toast message was received from an application endpoint: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId].

Message #

A cancel toast message was received from an application endpoint: %1 [AppUserModelId] %2 [NotificationTrackingId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—

Event ID 2013 — A clear toast message was received from an application endpoint: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A clear toast message was received from an application endpoint: AppUserModelId [AppUserModelId].

Message #

A clear toast message was received from an application endpoint: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2014 — A remove toast message was received from an application endpoint: AppUserModelId [AppUserModelId] for Tag [Tag] and Group [Group].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A remove toast message was received from an application endpoint: AppUserModelId [AppUserModelId] for Tag [Tag] and Group [Group].

Message #

A remove toast message was received from an application endpoint: %1 [AppUserModelId] for %2 [Tag] and %3 [Group].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`Tag` UnicodeString	—
`Group` UnicodeString	—

Event ID 2015 — A channel request failed due to an error: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A channel request failed due to an error: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

A channel request failed due to an error: %1 [AppUserModelId] %2 [ErrorCode].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 2016 — A clear mixview message was received from an application endpoint: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A clear mixview message was received from an application endpoint: AppUserModelId [AppUserModelId].

Message #

A clear mixview message was received from an application endpoint: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2025 — A toast feedback callback was added: TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A toast feedback callback was added: TrackingId [NotificationTrackingId].

Message #

A toast feedback callback was added: %1 [NotificationTrackingId].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 2026 — A toast feedback callback was removed: TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A toast feedback callback was removed: TrackingId [NotificationTrackingId].

Message #

A toast feedback callback was removed: %1 [NotificationTrackingId].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 2027 — A toast feedback callback was invoked: TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A toast feedback callback was invoked: TrackingId [NotificationTrackingId].

Message #

A toast feedback callback was invoked: %1 [NotificationTrackingId].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 2028 — A scheduled toast was added: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled toast was added: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId].

Message #

A scheduled toast was added: %1 [PackageFullName] %2 [AppUserModelId].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—
`Duetime` FILETIME	—

Event ID 2029 — A scheduled toast was removed: PackageFullName [PackageFullName] AppUserModelID [AppUserModelID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled toast was removed: PackageFullName [PackageFullName] AppUserModelID [AppUserModelID].

Message #

A scheduled toast was removed: %1 [PackageFullName] %2 [AppUserModelID].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—

Event ID 2030 — A scheduled toast is about to be raised: AppUserModelID [AppUserModelID] TimerId [TimerId] Duetime [Duetime].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled toast is about to be raised: AppUserModelID [AppUserModelID] TimerId [TimerId] Duetime [Duetime].

Message #

A scheduled toast is about to be raised: %1 [AppUserModelID] %2 [TimerId] %3 [Duetime].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—
`Duetime` FILETIME	—

Event ID 2031 — A background task to application mapping has been added: AppUserModelID [AppUserModelID] EventId [EventId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A background task to application mapping has been added: AppUserModelID [AppUserModelID] EventId [EventId].

Message #

A background task to application mapping has been added: %1 [AppUserModelID]  %2 [EventId].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`EventId` GUID	—

Event ID 2032 — A background task to application mapping has been removed: AppUserModelID [AppUserModelID] EventId [EventId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A background task to application mapping has been removed: AppUserModelID [AppUserModelID] EventId [EventId].

Message #

A background task to application mapping has been removed: %1 [AppUserModelID]  %2 [EventId].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`EventId` GUID	—

Event ID 2033 — A raw notification has activated a background task: AppUserModelID [AppUserModelID] EventId [EventId] NotificationId [NotificationID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival
Opcode: Stop

Description

A raw notification has activated a background task: AppUserModelID [AppUserModelID] EventId [EventId] NotificationId [NotificationID].

Message #

A raw notification has activated a background task: %1 [AppUserModelID] %2 [EventId] %3 [NotificationID].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`EventId` GUID	—
`NotificationId` UInt32	—

Event ID 2034 — A raw notification has activated a system task: AppUserModelID [AppUserModelID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A raw notification has activated a system task: AppUserModelID [AppUserModelID].

Message #

A raw notification has activated a system task: %1 [AppUserModelID].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—

Event ID 2035 — A scheduled tile was added: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] TimerId [Cookie].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled tile was added: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] TimerId [Cookie].

Message #

A scheduled tile was added: %1 [PackageFullName] %2 [AppUserModelId] %3 [Cookie].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—
`Duetime` FILETIME	—

Event ID 2036 — A scheduled tile was removed: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] TimerId [Cookie].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled tile was removed: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] TimerId [Cookie].

Message #

A scheduled tile was removed: %1 [PackageFullName] %2 [AppUserModelId] %3 [Cookie].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—

Event ID 2037 — A scheduled tile is being raised: AppUserModelID [AppUserModelId] TimerId [Cookie].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled tile is being raised: AppUserModelID [AppUserModelId] TimerId [Cookie].

Message #

A scheduled tile is being raised: %1 [AppUserModelId] %2 [Cookie].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—
`Duetime` FILETIME	—

Event ID 2038 — A scheduled tile was removed because the number of scheduled tiles per app exceeded maximum queue size: AppUserModelID [AppUserModelId] TimerId [Cookie].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A scheduled tile was removed because the number of scheduled tiles per app exceeded maximum queue size: AppUserModelID [AppUserModelId] TimerId [Cookie].

Message #

A scheduled tile was removed because the number of scheduled tiles per app exceeded maximum queue size: %1 [AppUserModelId] %2 [Cookie].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`TimerId` GUID	—
`Duetime` FILETIME	—

Event ID 2039 — A periodic update has been set: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] NotificationType [Type].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A periodic update has been set: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] NotificationType [Type].

Message #

A periodic update has been set: %1 [PackageFullName] %2 [AppUserModelId] %3 [Type].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`TimerId` GUID	—
`URL` UnicodeString	—

Event ID 2040 — A periodic update has been reset: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] NotificationType [Type].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A periodic update has been reset: PackageFullName [PackageFullName] AppUserModelID [AppUserModelId] NotificationType [Type].

Message #

A periodic update has been reset: %1 [PackageFullName] %2 [AppUserModelId] %3 [Type].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—

Event ID 2041 — A periodic update has started polling URL: AppUserModelID [AppUserModelId] NotificationType [Type].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Start

Description

A periodic update has started polling URL: AppUserModelID [AppUserModelId] NotificationType [Type].

Message #

A periodic update has started polling URL: %1 [AppUserModelId] %2 [Type].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`TimerId` GUID	—

Event ID 2042 — A periodic update has finished polling URL: AppUserModelID [AppUserModelId] NotificationType [Type].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has finished polling URL: AppUserModelID [AppUserModelId] NotificationType [Type].

Message #

A periodic update has finished polling URL: %1 [AppUserModelId] %2 [Type].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—

Event ID 2043 — A periodic update has rejected polling URL because size of notification exceeded maximum: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has rejected polling URL because size of notification exceeded maximum: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Message #

A periodic update has rejected polling URL because size of notification exceeded maximum: %1 [AppUserModelId] %2 [Type] %3 [URL].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—

Event ID 2044 — A periodic update has rejected polling URL due to mobile broadband connection such as roaming or reaching quota : AppUserModelID [AppUserModelId] NotificationType [Type].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has rejected polling URL due to mobile broadband connection such as roaming or reaching quota : AppUserModelID [AppUserModelId] NotificationType [Type].

Message #

A periodic update has rejected polling URL due to mobile broadband connection such as roaming or reaching quota : %1 [AppUserModelId] %2 [Type].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—

Event ID 2045 — A periodic update has failed polling URL.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has failed polling URL. Please refer error description for detail: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL] Error [Error].

Message #

A periodic update has failed polling URL. Please refer error description for detail: %1 [AppUserModelId] %2 [Type] %3 [URL] %4 [Error].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—
`Error` Int32	—

Event ID 2046 — A background task application mapping entry has been removed: AppUserModelID [AppUserModelID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A background task application mapping entry has been removed: AppUserModelID [AppUserModelID].

Message #

A background task application mapping entry has been removed: %1 [AppUserModelID].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—

Event ID 2047 — Notification API call for AppUserModelId [AppUserModelId] failed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Message #

Notification API call for %1 [AppUserModelId] failed. If you are logged into multiple sessions as the same user, please logoff and use a single user session.  If you are using the Visual Studio debugging simulator, exit the simulator to resolve this error.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2048 — A raw notification has failed to activate a background task: AppUserModelID [AppUserModelID] EventId [EventId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

A raw notification has failed to activate a background task: AppUserModelID [AppUserModelID] EventId [EventId] ErrorCode [ErrorCode].

Message #

A raw notification has failed to activate a background task: %1 [AppUserModelID] %2 [EventId] %3 [ErrorCode].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`EventId` GUID	—
`ErrorCode` UInt32	—

Event ID 2049 — A periodic update has found HTTP Status Code rather than 200: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL] HttpStatusCode [HTTP Status Code].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll

Description

A periodic update has found HTTP Status Code rather than 200: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL] HttpStatusCode [HTTP Status Code].

Message #

A periodic update has found HTTP Status Code rather than 200: %1 [AppUserModelId] %2 [Type] %3 [URL] %4 [HTTP Status Code].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—
`HttpStatusCode` UInt32	—

Event ID 2050 — A periodic update has failed polling URL because X-WNS-TAG header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has failed polling URL because X-WNS-TAG header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Message #

A periodic update has failed polling URL because X-WNS-TAG header is invalid: %1 [AppUserModelId] %2 [Type] %3 [URL].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—

Event ID 2051 — A periodic update has failed polling URL because X-WNS-EXPIRY header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has failed polling URL because X-WNS-EXPIRY header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Message #

A periodic update has failed polling URL because X-WNS-EXPIRY header is invalid: %1 [AppUserModelId] %2 [Type] %3 [URL].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—

Event ID 2052 — A periodic update of Type NotificationType for AppUserModelId AppUserModelID at URL URL has been skipped due to settings.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update of Type NotificationType for AppUserModelId AppUserModelID at URL URL has been skipped due to settings. Error Code: Error.

Message #

A periodic update of Type %2 for AppUserModelId %1  at URL %3 has been skipped due to settings.  Error Code: %4

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—
`Error` Int32	—

Event ID 2053 — A periodic update has failed polling URL because X-WNS-GROUP header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: PeriodicPoll
Opcode: Stop

Description

A periodic update has failed polling URL because X-WNS-GROUP header is invalid: AppUserModelID [AppUserModelId] NotificationType [Type] URL [URL].

Message #

A periodic update has failed polling URL because X-WNS-GROUP header is invalid: %1 [AppUserModelId] %2 [Type] %3 [URL].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—
`NotificationType` UInt32	—
`URL` UnicodeString	—

Event ID 2100 — A cloud notification was dropped because the following channel is not valid: ChannelId [ChannelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A cloud notification was dropped because the following channel is not valid: ChannelId [ChannelId].

Message #

A cloud notification was dropped because the following channel is not valid: %1 [ChannelId].

Fields #

Name	Description
`ChannelId` UnicodeString	—

Event ID 2101 — A notification was dropped because the expiration time was in the past: TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the expiration time was in the past: TrackingId [NotificationTrackingId].

Message #

A notification was dropped because the expiration time was in the past: %1 [NotificationTrackingId].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 2102 — A notification was dropped because of global settings: RequestFlags [PolicyLevel] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because of global settings: RequestFlags [PolicyLevel] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because of global settings: %1 [PolicyLevel] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`RequestFlags` UInt32	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2103 — A notification was dropped because cloud notifications are disabled globally: RequestFlags [PolicyLevel] TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because cloud notifications are disabled globally: RequestFlags [PolicyLevel] TrackingId [NotificationTrackingId].

Message #

A notification was dropped because cloud notifications are disabled globally: %1 [PolicyLevel]  %2 [NotificationTrackingId].

Fields #

Name	Description
`RequestFlags` UInt32	—
`TrackingId` UInt32	—

Event ID 2104 — A notification was dropped because of application settings: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because of application settings: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because of application settings: %1 [AppUserModelId] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2105 — A notification was dropped because the application does not have the network capability: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the application does not have the network capability: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId].

Message #

A notification was dropped because the application does not have the network capability: %1 [AppUserModelId] %2 [NotificationTrackingId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—

Event ID 2106 — A notification was dropped because the application does not have the capability for the type: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [N...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the application does not have the capability for the type: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because the application does not have the capability for the type: %1 [AppUserModelId] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2107 — A notification was dropped because the current network is costly: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the current network is costly: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because the current network is costly: %1 [AppUserModelId] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UInt32	—

Event ID 2108 — A notification was dropped because the mobile broadband cap has been reached: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the mobile broadband cap has been reached: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because the mobile broadband cap has been reached: %1 [AppUserModelId] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UInt32	—

Event ID 2109 — Network traffic related to notifications was attributed to the following AppUserModelId: AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Network traffic related to notifications was attributed to the following AppUserModelId: AppUserModelId. NotificationType [NotificationType] Size [Size] NetworkType [NetworkType].

Message #

Network traffic related to notifications was attributed to the following AppUserModelId: %1. %2 [NotificationType] %3 [Size] %4 [NetworkType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UInt32	—
`Size` UInt64	—
`NetworkType` UInt32	—

Event ID 2110 — A notification was dropped because cloud notifications are disabled for the application: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [Notifi...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because cloud notifications are disabled for the application: AppUserModelId [AppUserModelId] TrackingId [NotificationTrackingId] NotificationType [NotificationType].

Message #

A notification was dropped because cloud notifications are disabled for the application: %1 [AppUserModelId] %2 [NotificationTrackingId] %3 [NotificationType].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2111 — A notification was dropped because the application is not registered: AppUserModelId [AppUserModelId] NotificationType [NotificationType].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A notification was dropped because the application is not registered: AppUserModelId [AppUserModelId] NotificationType [NotificationType].

Message #

A notification was dropped because the application is not registered: %1 [AppUserModelId] %2 [NotificationType]

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UnicodeString	—

Event ID 2112 — A NotificationType notification with trackingid TrackingId is getting posted for the application AppUserModelId with setting override.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A NotificationType notification with trackingid TrackingId is getting posted for the application AppUserModelId with setting override.

Message #

A %3 notification with trackingid %2 is getting posted for the application %1 with setting override.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2150 — An application setting was changed: AppUserModelId [AppUserModelId] SettingType [SettingType] Enabled [Enabled].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

An application setting was changed: AppUserModelId [AppUserModelId] SettingType [SettingType] Enabled [Enabled].

Message #

An application setting was changed: %1 [AppUserModelId] %2 [SettingType] %3 [Enabled].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`SettingType` UInt32	—
`Enabled` Boolean	—

Event ID 2151 — A group policy setting was changed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A group policy setting was changed. Notification Service connection was updated: Enabled [Enabled].

Message #

A group policy setting was changed. Notification Service connection was updated: %1 [Enabled].

Fields #

Name	Description
`Enabled` Boolean	—

Event ID 2152 — An application setting was queried: AppUserModelId [AppUserModelId] SettingType [SettingType] Enabled [Enabled].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

An application setting was queried: AppUserModelId [AppUserModelId] SettingType [SettingType] Enabled [Enabled].

Message #

An application setting was queried: %1 [AppUserModelId] %2 [SettingType] %3 [Enabled].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`SettingType` UInt32	—
`Enabled` Boolean	—

Event ID 2153 — A global setting was changed: SettingType [SettingType] Enabled [Enabled] PolicyLevel [PolicyLevel].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A global setting was changed: SettingType [SettingType] Enabled [Enabled] PolicyLevel [PolicyLevel].

Message #

A global setting was changed: %1 [SettingType] %2 [Enabled] %3 [PolicyLevel].

Fields #

Name	Description
`SettingType` UInt32	—
`Enabled` Boolean	—
`PolicyLevel` UInt32	—

Event ID 2154 — A global setting was queried: SettingType [SettingType] Enabled [Enabled] PolicyLevel [PolicyLevel].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A global setting was queried: SettingType [SettingType] Enabled [Enabled] PolicyLevel [PolicyLevel].

Message #

A global setting was queried: %1 [SettingType] %2 [Enabled] %3 [PolicyLevel].

Fields #

Name	Description
`SettingType` UInt32	—
`Enabled` Boolean	—
`PolicyLevel` UInt32	—

Event ID 2155 — The list of apps with capability: SettingType [SettingType] was requested.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The list of apps with capability: SettingType [SettingType] was requested.

Message #

The list of apps with capability: %1 [SettingType] was requested.

Fields #

Name	Description
`SettingType` UInt32	—

Event ID 2156 — Callback registered for SettingType [SettingType] with Cookie Cookie [Cookie Value].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Callback registered for SettingType [SettingType] with Cookie Cookie [Cookie Value].

Message #

Callback registered for %1 [SettingType] with Cookie %2 [Cookie Value].

Fields #

Name	Description
`SettingType` UInt32	—
`Cookie` UInt32	—

Event ID 2157 — Callback unregistered : Callback_unregistered [Cookie Value].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Callback unregistered : Callback_unregistered [Cookie Value].

Message #

Callback unregistered : %1 [Cookie Value].

Fields #

Name	Description
`Callback_unregistered` UInt32	—
`Cookie` UInt32	—

Event ID 2158 — End of clearing Tile Notification Queues and Image Cache.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAll
Opcode: Stop

Description

End of clearing Tile Notification Queues and Image Cache.

Message #

End of clearing Tile Notification Queues and Image Cache.

Event ID 2159 — Mobile Broadband Tile Cap Queried: Mobile_Broadband_Tile_Cap_Queried [Cap Value (Bytes)].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Mobile Broadband Tile Cap Queried: Mobile_Broadband_Tile_Cap_Queried [Cap Value (Bytes)].

Message #

Mobile Broadband Tile Cap Queried: %1 [Cap Value (Bytes)].

Fields #

Name	Description
`Mobile_Broadband_Tile_Cap_Queried` UInt64	—
`SettingsValue` UInt64	—

Event ID 2160 — Mobile Broadband Tile Cap Changed: Mobile_Broadband_Tile_Cap_Changed [Cap Value (Bytes)].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Mobile Broadband Tile Cap Changed: Mobile_Broadband_Tile_Cap_Changed [Cap Value (Bytes)].

Message #

Mobile Broadband Tile Cap Changed: %1 [Cap Value (Bytes)].

Fields #

Name	Description
`Mobile_Broadband_Tile_Cap_Changed` UInt64	—
`SettingsValue` UInt64	—

Event ID 2161 — Mobile Broadband Tile Usage Queried: Mobile_Broadband_Tile_Usage_Queried [Usage Value (Bytes)].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Mobile Broadband Tile Usage Queried: Mobile_Broadband_Tile_Usage_Queried [Usage Value (Bytes)].

Message #

Mobile Broadband Tile Usage Queried: %1 [Usage Value (Bytes)].

Fields #

Name	Description
`Mobile_Broadband_Tile_Usage_Queried` UInt64	—
`SettingsValue` UInt64	—

Event ID 2162 — Mobile Broadband Reset Dates Queried.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Mobile Broadband Reset Dates Queried.

Message #

Mobile Broadband Reset Dates Queried.

Event ID 2163 — The list of apps with capability: SettingType [SettingType] in Package: PackageFamilyName [PackageFamilyName] was requested.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The list of apps with capability: SettingType [SettingType] in Package: PackageFamilyName [PackageFamilyName] was requested.

Message #

The list of apps with capability: %1 [SettingType] in Package: %2 [PackageFamilyName] was requested.

Fields #

Name	Description
`SettingType` UInt32	—
`PackageFamilyName` UnicodeString	—

Event ID 2164 — Start of clearing Tile Notification Queues and Image Cache.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAll
Opcode: Start

Description

Start of clearing Tile Notification Queues and Image Cache.

Message #

Start of clearing Tile Notification Queues and Image Cache.

Event ID 2165 — Mobile Broadband Cap Enforcement Callback invoked: Enabled [Enabled].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Mobile Broadband Cap Enforcement Callback invoked: Enabled [Enabled].

Message #

Mobile Broadband Cap Enforcement Callback invoked: %1 [Enabled].

Fields #

Name	Description
`Enabled` Boolean	—

Event ID 2166 — Toasts have been Temporarily Suspended until WakeupTime [UTC FILETIME].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Toasts have been Temporarily Suspended until WakeupTime [UTC FILETIME].

Message #

Toasts have been Temporarily Suspended until %1 [UTC FILETIME].

Fields #

Name	Description
`WakeupTime` FILETIME	—
`IsValid` Boolean	—

Event ID 2167 — Toast Temporary Suspend Time was queried: Is Suspended?

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Toast Temporary Suspend Time was queried: Is Suspended? IsValid wakeupTime? WakeupTime [UTC FILETIME].

Message #

Toast Temporary Suspend Time was queried: Is Suspended? %2 wakeupTime? %1 [UTC FILETIME].

Fields #

Name	Description
`WakeupTime` FILETIME	—
`IsValid` Boolean	—

Event ID 2168 — Toast Wakeup Timer has fired.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Toast Wakeup Timer has fired.

Message #

Toast Wakeup Timer has fired.

Event ID 2169 — The list of Polling apps in Package: PackageFamilyName [PackageFamilyName] was requested.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The list of Polling apps in Package: PackageFamilyName [PackageFamilyName] was requested.

Message #

The list of Polling apps in Package: %1 [PackageFamilyName] was requested.

Fields #

Name	Description
`PackageFamilyName` UnicodeString	—

Event ID 2170 — A Setting Sync was scheduled: PackageFamilyName [PackageFamilyName] CollectionId [Collection ID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A Setting Sync was scheduled: PackageFamilyName [PackageFamilyName] CollectionId [Collection ID].

Message #

A Setting Sync was scheduled: %1 [PackageFamilyName] %2 [Collection ID].

Fields #

Name	Description
`PackageFamilyName` UnicodeString	—
`CollectionId` UnicodeString	—

Event ID 2171 — A call to the settings endpoint happened to unblock all channels for all types.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

A call to the settings endpoint happened to unblock all channels for all types.

Message #

A call to the settings endpoint happened to unblock all channels for all types.

Event ID 2200 — A channel request was not allowed because of global settings: RequestFlags [PolicyLevel] AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A channel request was not allowed because of global settings: RequestFlags [PolicyLevel] AppUserModelId [AppUserModelId].

Message #

A channel request was not allowed because of global settings: %1 [PolicyLevel] %2 [AppUserModelId].

Fields #

Name	Description
`RequestFlags` UInt32	—
`AppUserModelId` UnicodeString	—

Event ID 2201 — A channel request was not allowed because the application does not have the network capability: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A channel request was not allowed because the application does not have the network capability: AppUserModelId [AppUserModelId].

Message #

A channel request was not allowed because the application does not have the network capability: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2202 — A NotificationType notification with NotificationTrackingId TrackingId was dropped because appropriate privilege is not held.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A NotificationType notification with NotificationTrackingId TrackingId was dropped because appropriate privilege is not held. Please check out Mosh Debugger is running on your machine.

Message #

A %2 notification with NotificationTrackingId %1 was dropped because appropriate privilege is not held. Please check out Mosh Debugger is running on your machine.

Fields #

Name	Description
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2203 — A NotificationType notification with NotificationTrackingId TrackingId is being delivered to application AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

A NotificationType notification with NotificationTrackingId TrackingId is being delivered to application AppUserModelId.

Message #

A %3 notification with NotificationTrackingId %2 is being delivered to application %1.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—
`NotificationType` UnicodeString	—

Event ID 2250 — Notification channels associated with a package are able to receive raw notifications: [PackageFullName] PackageFullName.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Notification channels associated with a package are able to receive raw notifications: [PackageFullName] PackageFullName.

Message #

Notification channels associated with a package are able to receive raw notifications: [PackageFullName] %1

Fields #

Name	Description
`PackageFullName` UnicodeString	—

Event ID 2300 — The following application was added to the lock screen: PackageFullName [PackageFullName] PackageRelativeApplicationId [PackageRelativeApplicationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The following application was added to the lock screen: PackageFullName [PackageFullName] PackageRelativeApplicationId [PackageRelativeApplicationId].

Message #

The following application was added to the lock screen: %1 [PackageFullName] %2 [PackageRelativeApplicationId].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`PackageRelativeApplicationId` UnicodeString	—

Event ID 2301 — The following application was removed from the lock screen: PackageFullName [PackageFullName] PackageRelativeApplicationId [PackageRelativeApplicationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The following application was removed from the lock screen: PackageFullName [PackageFullName] PackageRelativeApplicationId [PackageRelativeApplicationId].

Message #

The following application was removed from the lock screen: %1 [PackageFullName] %2 [PackageRelativeApplicationId].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`PackageRelativeApplicationId` UnicodeString	—

Event ID 2400 — System application was registered with the following paramaeters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] Capabilities [Settings] WNFEventName [WNFEventName].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

System application was registered with the following paramaeters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] Capabilities [Settings] WNFEventName [WNFEventName].

Message #

System application was registered with the following paramaeters: %1 [PackageFullName] %2 [AppUserModelId] %3 [Settings] %5 [WNFEventName].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelId` UnicodeString	—
`Capabilities` UInt32	—
`WNFEventNameLength` UInt32	—
`WNFEventName` Binary	—

Event ID 2401 — System application was unregistered with the following parameters: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

System application was unregistered with the following parameters: AppUserModelId [AppUserModelId].

Message #

System application was unregistered with the following parameters: %1 [AppUserModelId]

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2402 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2403 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2404 — Phone VoIP application was registered with the following parameters: AppUserModelId [AppUserModelId] PhoneVoipAgentId [PhoneVoipAgentId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Phone VoIP application was registered with the following parameters: AppUserModelId [AppUserModelId] PhoneVoipAgentId [PhoneVoipAgentId].

Message #

Phone VoIP application was registered with the following parameters: %1 [AppUserModelId] %2 [PhoneVoipAgentId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`PhoneVoipAgentId` GUID	—

Event ID 2405 — Phone VoIP application was unregistered with the following parameters: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Phone VoIP application was unregistered with the following parameters: AppUserModelId [AppUserModelId].

Message #

Phone VoIP application was unregistered with the following parameters: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2406 — The Windows Push Notification Platform has received a phone legacy channel request with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserM...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestChannel
Opcode: Start

Description

The Windows Push Notification Platform has received a phone legacy channel request with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] ChannelName [ChannelName] ServiceName [ServiceName].

Message #

The Windows Push Notification Platform has received a phone legacy channel request with the following parameters: %1 [PackageFullName] %2 [AppUserModelId] %3 [ChannelName] %4 [ServiceName].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelId` UnicodeString	—
`ChannelName` UnicodeString	—
`ServiceName` UnicodeString	—

Event ID 2407 — PhoneLegacy push notification is being processed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PhoneLegacy push notification is being processed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId].

Message #

PhoneLegacy push notification is being processed: ChannelId [%1], NotificationType [%2], TrackingId [%3] AppId [%4]

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—

Event ID 2408 — PhoneLegacy voip notification is being processed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId], PhoneVoipAgentId [PhoneVoipAgentId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

PhoneLegacy voip notification is being processed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId], PhoneVoipAgentId [PhoneVoipAgentId].

Message #

PhoneLegacy voip notification is being processed: ChannelId [%1], NotificationType [%2], TrackingId [%3] AppId [%4], PhoneVoipAgentId [%5]

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PhoneVoipAgentId` GUID	—

Event ID 2409 — A connection status callback was added: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A connection status callback was added: AppUserModelId [AppUserModelId].

Message #

A connection status callback was added: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2410 — A connection status callback was removed: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A connection status callback was removed: AppUserModelId [AppUserModelId].

Message #

A connection status callback was removed: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2411 — A connection status callback was updated: AppUserModelId [AppUserModelId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A connection status callback was updated: AppUserModelId [AppUserModelId].

Message #

A connection status callback was updated: %1 [AppUserModelId].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 2412 — A connection status was delivered to a callback: AppUserModelId [AppUserModelId] IsConnected [IsConnected] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

A connection status was delivered to a callback: AppUserModelId [AppUserModelId] IsConnected [IsConnected] ErrorCode [ErrorCode].

Message #

A connection status was delivered to a callback: %1 [AppUserModelId] %2 [IsConnected] %3 [ErrorCode].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`IsConnected` Boolean	—
`ErrorCode` Int32	—

Event ID 2413 — An application was registered with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] AppSettings [Settings] AppType [AppType] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

An application was registered with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] AppSettings [Settings] AppType [AppType] ErrorCode [ErrorCode].

Message #

An application was registered with the following parameters: %1 [PackageFullName] %2 [AppUserModelId] %3 [Settings] %4 [AppType] %5 [ErrorCode].

Fields #

Name	Description
`PackageFullName` UnicodeString	An application was registered with the following parameters.
`AppUserModelId` UnicodeString	—
`AppSettings` UInt32	—
`AppType` UInt32	—
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 2413,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036863164928,
    "time_created": "2023-11-06T01:42:41.646445+00:00",
    "event_record_id": 2772,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-14D2-F0E43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 17760
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "PackageFullName": "SpotifyAB.SpotifyMusic_1.222.982.0_x64__zpdnekdrzrea0",
    "AppUserModelId": "SpotifyAB.SpotifyMusic_zpdnekdrzrea0!Widget",
    "AppSettings": 67141376,
    "AppType": 268435456,
    "ErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2414 — An application resgistration was updated with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] AppSettings [Settings] AppType [AppType] ErrorCode [Err...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

An application resgistration was updated with the following parameters: PackageFullName [PackageFullName] AppUserModelId [AppUserModelId] AppSettings [Settings] AppType [AppType] ErrorCode [ErrorCode].

Message #

An application resgistration was updated with the following parameters: %1 [PackageFullName] %2 [AppUserModelId] %3 [Settings] %4 [AppType] %5 [ErrorCode].

Fields #

Name	Description
`PackageFullName` UnicodeString	—
`AppUserModelId` UnicodeString	—
`AppSettings` UInt32	—
`AppType` UInt32	—
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 2414,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036863164928,
    "time_created": "2026-02-14T21:02:02.291561+00:00",
    "event_record_id": 1143,
    "correlation": {
      "ActivityID": "EAB545B2-3409-4E30-9F30-BC4AC7110E3B"
    },
    "execution": {
      "process_id": 8924,
      "thread_id": 7064
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "PackageFullName": "Microsoft.DesktopAppInstaller_1.27.470.0_x64__8wekyb3d8bbwe",
    "AppUserModelId": "Microsoft.DesktopAppInstaller_8wekyb3d8bbwe!WinGetMCPServer",
    "AppSettings": 67141376,
    "AppType": 268435456,
    "ErrorCode": 0
  },
  "message": ""
}

Event ID 2415 — An application was unregistered with the following parameters: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

An application was unregistered with the following parameters: AppUserModelId [AppUserModelId] ErrorCode [ErrorCode].

Message #

An application was unregistered with the following parameters: %1 [AppUserModelId] %2 [ErrorCode]

Fields #

Name	Description
`AppUserModelId` UnicodeString	An application was unregistered with the following parameters.
`ErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 2415,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036863164928,
    "time_created": "2023-11-05T22:35:45.133086+00:00",
    "event_record_id": 2537,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 4488
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "AppUserModelId": "Microsoft.SkyDrive.Desktop",
    "ErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2416 — A local notification was received from AppUserModelId [AppUserModelId] with a NotificationId [NotificationId] through an application endpoint.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A local notification was received from AppUserModelId [AppUserModelId] with a NotificationId [NotificationId] through an application endpoint.

Message #

A local notification was received from %1 [AppUserModelId] with a %2 [NotificationId] through an application endpoint.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—

Event ID 2416 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A local notification was received from [AppUserModelId] with a [NotificationId] through an application endpoint.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—

Event ID 2417 — A local notification failed to be submitted to threadpool: ErrorCode [HResult].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A local notification failed to be submitted to threadpool: ErrorCode [HResult].

Message #

A local notification failed to be submitted to threadpool: %1 [HResult]

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 2417 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A local notification failed to be submitted to threadpool: [HResult].

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 2418 — A local notification was submitted to threadpool: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId] NotificationSource [NotificationSource].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewLocalNotificationArrival
Opcode: Start

Description

A local notification was submitted to threadpool: AppUserModelId [AppUserModelId] NotificationType [NotificationType] TrackingId [NotificationTrackingId] NotificationSource [NotificationSource].

Message #

A local notification was submitted to threadpool: %1 [AppUserModelId] %2 [NotificationType] %3 [NotificationTrackingId] %4 [NotificationSource].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`NotificationSource` UInt32	—

Event ID 2418 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewLocalNotificationArrival
Opcode: Start

Description

A local notification was submitted to threadpool: [AppUserModelId] [NotificationType] [NotificationTrackingId] [NotificationSource].

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`NotificationSource` UInt32	—

Event ID 2419 — A raw notification has activated a system task: AppUserModelID [AppUserModelID].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A raw notification has activated a system task: AppUserModelID [AppUserModelID].

Message #

A raw notification has activated a system task: %1 [AppUserModelID].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—

Event ID 2419 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

A raw notification has activated a system task: [AppUserModelID].

Fields #

Name	Description
`AppUserModelID` UnicodeString	—

Event ID 3000 — Tile session creation is requested for ProcessName endpoint Object.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionCreate
Opcode: Start

Description

Tile session creation is requested for ProcessName endpoint Object.

Message #

Tile session creation is requested for %2 endpoint %1.

Fields #

Name	Description
`Object` Pointer	—
`ProcessName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3000,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T23:54:29.275475+00:00",
    "event_record_id": 2733,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 7872
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Object": "0x12fc9788eb8",
    "ProcessName": "C:\\Windows\\explorer.exe"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3001 — Tile session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionCreate
Opcode: Stop

Description

Tile session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id. Queued Closes = QueuedTileCloses, Queued Cleanups = QueuedTileCleanups.

Message #

Tile session creation is finished for %4 from endpoint %1 with result %3, and %2 is assigned as session id. Queued Closes = %5, Queued Cleanups = %6

Fields #

Name	Description
`Endpoint` Pointer	—
`SessionId` UInt32	—
`Error` Int32	—
`ProcessName` UnicodeString	—
`QueuedTileCloses` Int32	—
`QueuedTileCleanups` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3001,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T23:54:29.275653+00:00",
    "event_record_id": 2734,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 7872
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Endpoint": "0x12fc9788eb8",
    "SessionId": 5,
    "Error": 0,
    "ProcessName": "C:\\Windows\\explorer.exe",
    "QueuedTileCloses": 0,
    "QueuedTileCleanups": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3002 — Tile session SessionId is being updated.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileSessionUpdate
Opcode: Start

Description

Tile session SessionId is being updated.

Message #

Tile session %1 is being updated.

Fields #

Name	Description
`SessionId` UInt32	—

Event ID 3003 — Tile session SessionId is updated with error code Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileSessionUpdate
Opcode: Stop

Description

Tile session SessionId is updated with error code Error.

Message #

Tile session %1 is updated with error code %3.

Fields #

Name	Description
`SessionId` UInt32	—
`Count` UInt32	—
`Error` Int32	—

Event ID 3004 — Tile session SessionId is being closed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionClose
Opcode: Start

Description

Tile session SessionId is being closed.

Message #

Tile session %1 is being closed

Fields #

Name	Description
`SessionId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3004,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.077911+00:00",
    "event_record_id": 2370,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0000-90E3-A0593710DA01"
    },
    "execution": {
      "process_id": 4768,
      "thread_id": 6712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 3
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3005 — Tile session SessionId is closed with error code Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionClose
Opcode: Stop

Description

Tile session SessionId is closed with error code Error.

Message #

Tile session %1 is closed with error code %2.

Fields #

Name	Description
`SessionId` UInt32	—
`Error` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3005,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.077926+00:00",
    "event_record_id": 2371,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0000-90E3-A0593710DA01"
    },
    "execution": {
      "process_id": 4768,
      "thread_id": 6712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 3,
    "Error": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3006 — Toast session creation is requested for ProcessName from endpoint Object.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ToastSessionCreate
Opcode: Start

Description

Toast session creation is requested for ProcessName from endpoint Object.

Message #

Toast session creation is requested for %2 from endpoint %1.

Fields #

Name	Description
`Object` Pointer	—
`ProcessName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3006,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:32:25.705153+00:00",
    "event_record_id": 2392,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 4488
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Object": "0x12fc8ff4f88",
    "ProcessName": "C:\\Windows\\System32\\svchost.exe"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3007 — Toast session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ToastSessionCreate
Opcode: Stop

Description

Toast session creation is finished for ProcessName from endpoint Endpoint with result Error, and SessionId is assigned as session id.

Message #

Toast session creation is finished for %4 from endpoint %1 with result %3, and %2 is assigned as session id.

Fields #

Name	Description
`Endpoint` Pointer	—
`SessionId` UInt32	—
`Error` Int32	—
`ProcessName` UnicodeString	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3007,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:32:25.705164+00:00",
    "event_record_id": 2393,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 4488
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Endpoint": "0x12fc8ff4f88",
    "SessionId": 1,
    "Error": 0,
    "ProcessName": "C:\\Windows\\System32\\svchost.exe"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3008 — Toast session SessionId is being closed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ToastSessionClose
Opcode: Start

Description

Toast session SessionId is being closed.

Message #

Toast session %1 is being closed

Fields #

Name	Description
`SessionId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3008,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 1,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.570014+00:00",
    "event_record_id": 2374,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0000-90E3-A0593710DA01"
    },
    "execution": {
      "process_id": 4768,
      "thread_id": 6712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3009 — Toast session SessionId is closed with error code Error.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ToastSessionClose
Opcode: Stop

Description

Toast session SessionId is closed with error code Error.

Message #

Toast session %1 is closed with error code %2.

Fields #

Name	Description
`SessionId` UInt32	—
`Error` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3009,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.570027+00:00",
    "event_record_id": 2375,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0000-90E3-A0593710DA01"
    },
    "execution": {
      "process_id": 4768,
      "thread_id": 6712
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 1,
    "Error": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3010 — Started tracking Notification Request performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestNotification
Opcode: Start

Description

Started tracking Notification Request performance.

Message #

Started tracking Notification Request performance.

Event ID 3011 — Finished tracking Notification Request performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestNotification
Opcode: Stop

Description

Finished tracking Notification Request performance.

Message #

Finished tracking Notification Request performance.

Event ID 3012 — Toast with notification tracking id TrackingId is delivered to AppUserModelId on session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

Toast with notification tracking id TrackingId is delivered to AppUserModelId on session SessionId.

Message #

Toast with notification tracking id %1 is delivered to %2 on session %3.

Fields #

Name	Description
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—

Event ID 3013 — NotificationType with notification tracking id TrackingId is delivered to AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

NotificationType with notification tracking id TrackingId is delivered to AppUserModelId.

Message #

%1 with notification tracking id %2 is delivered to %3.

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—
`ErrorCode` Int32	—
`SessionErrorCode` Int32	—

Event ID 3014 — Tile queue entry is created for AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Tile queue entry is created for AppUserModelId.

Message #

Tile queue entry is created for %1.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—

Event ID 3015 — Tile notification id NotificationId for AppUserModelId is stored at QueueIndex in queue.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

Tile notification id NotificationId for AppUserModelId is stored at QueueIndex in queue.

Message #

Tile notification id %2 for %1 is stored at %3 in queue.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—
`QueueIndex` UInt16	—

Event ID 3016 — Tile notification id OverridingNotificationId overrided existing notification id OverridedNotificationId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Tile notification id OverridingNotificationId overrided existing notification id OverridedNotificationId.

Message #

Tile notification id %2 overrided existing notification id %1.

Fields #

Name	Description
`OverridedNotificationId` UInt32	—
`OverridingNotificationId` UInt32	—

Event ID 3017 — This is a verbose debug event that dumps Tile Queue information.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

This is a verbose debug event that dumps Tile Queue information.

Message #

This is a verbose debug event that dumps Tile Queue information.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`SessionMask` UInt32	—
`Flag` UInt16	—
`UpdateIndex` UInt16	—
`KeystoneNotificationId` UInt32	—
`KeystoneFlag` UInt16	—
`Appspace` Int32	—

Event ID 3018 — Badge notification id TrackingId is stored for AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival

Description

Badge notification id TrackingId is stored for AppUserModelId.

Message #

Badge notification id %2 is stored for %1.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—

Event ID 3019 — Tile image request RequestId has started.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload
Opcode: Start

Description

Tile image request RequestId has started.

Message #

Tile image request %1 has started.

Fields #

Name	Description
`RequestId` UInt32	—
`RequestCountInHighPriority` UInt32	—
`RequestCountInMedPriority` UInt32	—
`RequestCountInLowPriority` UInt32	—

Event ID 3020 — Tile image request RequestId has been canceled due to new request.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload

Description

Tile image request RequestId has been canceled due to new request.

Message #

Tile image request %1 has been canceled due to new request.

Fields #

Name	Description
`RequestId` UInt32	—

Event ID 3021 — Tile image request for notification NotificationId in AppUserModelId contains URLCount URL.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload

Description

Tile image request for notification NotificationId in AppUserModelId contains URLCount URL.

Message #

Tile image request for notification %3 in %2 contains %4 URL.

Fields #

Name	Description
`PriorityIndex` UInt32	—
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—
`URLCount` UInt32	—
`Flag` UInt32	—

Event ID 3022 — Image download request is being processed for first time: resource id [ResourceId], URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload

Description

Image download request is being processed for first time: resource id [ResourceId], URL [URL].

Message #

Image download request is being processed for first time: resource id [%1],  URL [%2]

Fields #

Name	Description
`ResourceId` UInt32	—
`URL` UnicodeString	—

Event ID 3023 — Image download is complete for a single URL: notification id [NotificationId], resource id [ResourceId], local path [LocalPath], error code [ErrorCode], flags [Flag].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload

Description

Image download is complete for a single URL: notification id [NotificationId], resource id [ResourceId], local path [LocalPath], error code [ErrorCode], flags [Flag].

Message #

Image download is complete for a single URL: notification id [%1], resource id [%2], local path [%3], error code [%4], flags [%5]

Fields #

Name	Description
`NotificationId` UInt32	—
`ResourceId` UInt32	—
`LocalPath` UnicodeString	—
`ErrorCode` Int32	—
`Flag` UInt32	—

Event ID 3024 — Image download is complete for all URL with notification id [NotificationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileImageDownload
Opcode: Stop

Description

Image download is complete for all URL with notification id [NotificationId].

Message #

Image download is complete for all URL with notification id [%1]

Fields #

Name	Description
`NotificationId` UInt32	—
`Flag` UInt32	—
`Count` UInt32	—
`URLComplete` UInt8	—

Event ID 3025 — Processing initial batch on Image request for toast: AppUserModelId [AppUserModelId], Notification Id [NotificationId], UrlCount [URLCount], Flags [Flag].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Processing initial batch on Image request for toast: AppUserModelId [AppUserModelId], Notification Id [NotificationId], UrlCount [URLCount], Flags [Flag].

Message #

Processing initial batch on Image request for toast: AppUserModelId [%1], Notification Id [%2], UrlCount [%3], Flags [%4]

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—
`URLCount` UInt32	—
`Flag` UInt32	—

Event ID 3026 — Processing Toast Image request URL: Resource Id [ResourceId], URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Processing Toast Image request URL: Resource Id [ResourceId], URL [URL].

Message #

Processing Toast Image request URL: Resource Id [%1], URL [%2]

Fields #

Name	Description
`ResourceId` UInt32	—
`URL` UnicodeString	—

Event ID 3027 — Scheduling Image Download Task: [Slot Index] SlotIndex, [Notification Id] NotificationId, [Priority] BITSPriority, [IsTile] IsTile, [URL] URL.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Scheduling Image Download Task: [Slot Index] SlotIndex, [Notification Id] NotificationId, [Priority] BITSPriority, [IsTile] IsTile, [URL] URL.

Message #

Scheduling Image Download Task: [Slot Index] %1, [Notification Id] %2, [Priority] %3, [IsTile] %4, [URL] %5

Fields #

Name	Description
`SlotIndex` UInt32	—
`NotificationId` UInt32	—
`BITSPriority` UInt32	—
`IsTile` Boolean	—
`URL` UnicodeString	—

Event ID 3028 — Completed Image Download Task: [Notification Id] NotificationId, [IsTile] IsTile, [Path] Path.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Completed Image Download Task: [Notification Id] NotificationId, [IsTile] IsTile, [Path] Path.

Message #

Completed Image Download Task: [Notification Id] %1, [IsTile] %2, [Path] %3

Fields #

Name	Description
`NotificationId` UInt32	—
`IsTile` Boolean	—
`Path` UnicodeString	—

Event ID 3029 — Download image has failed: [Notification Id] NotificationId [Tile] IsTile [ErrorCode] ErrorCode [URL] URL.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Download image has failed: [Notification Id] NotificationId [Tile] IsTile [ErrorCode] ErrorCode [URL] URL.

Message #

Download image has failed: [Notification Id] %1 [Tile] %2 [ErrorCode] %3 [URL] %4

Fields #

Name	Description
`NotificationId` UInt32	—
`IsTile` Boolean	—
`ErrorCode` Int32	—
`URL` UnicodeString	—

Event ID 3030 — Image resource is being processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestResource
Opcode: Start

Description

Image resource is being processed.

Message #

Image resource is being processed.

Event ID 3031 — Image resource has been processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestResource
Opcode: Stop

Description

Image resource has been processed.

Message #

Image resource has been processed.

Event ID 3032 — Clearing all tile notifiction is being processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAllTiles
Opcode: Start

Description

Clearing all tile notifiction is being processed.

Message #

Clearing all tile notifiction is being processed.

Event ID 3033 — Clearing all tile notifiction has been processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAllTiles
Opcode: Stop

Description

Clearing all tile notifiction has been processed.

Message #

Clearing all tile notifiction has been processed.

Event ID 3034 — Clearing all images is being processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAllImages
Opcode: Start

Description

Clearing all images is being processed.

Message #

Clearing all images is being processed.

Event ID 3035 — Clearing all images has been processed.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearAllImages
Opcode: Stop

Description

Clearing all images has been processed.

Message #

Clearing all images has been processed.

Event ID 3036 — Image Download Manager policy is changed to IDM_Enabled.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Image Download Manager policy is changed to IDM_Enabled.

Message #

Image Download Manager policy is changed to %1.

Fields #

Name	Description
`IDM_Enabled` Boolean	—

Event ID 3037 — Detail event for tile session SessionId update.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: TileSessionUpdate
Opcode: Start

Description

Detail event for tile session SessionId update.

Message #

Detail event for tile session %1 update.

Fields #

Name	Description
`SessionId` UInt32	—
`Count` UInt32	—
`UpdateControl` Int8	—

Event ID 3038 — Detail event at start of Notification Request performance tracking.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RequestNotification
Opcode: Start

Description

Detail event at start of Notification Request performance tracking.

Message #

Detail event at start of Notification Request performance tracking.

Fields #

Name	Description
`Count` UInt32	—
`RequestControl` AnsiString	—

Event ID 3039 — Image Download Manager drop request due to newer request arrival.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Image Download Manager drop request due to newer request arrival.

Message #

Image Download Manager drop request due to newer request arrival.

Event ID 3040 — Downloading image has failed because protocol is not supported: URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Downloading image has failed because protocol is not supported: URL [URL].

Message #

Downloading image has failed because protocol is not supported: URL [%1]

Fields #

Name	Description
`URL` UnicodeString	—

Event ID 3041 — Downloading image has failed because downloaded image it too big over maximum 150KB: URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Downloading image has failed because downloaded image it too big over maximum 150KB: URL [URL].

Message #

Downloading image has failed because downloaded image it too big over maximum 150KB: URL [%1]

Fields #

Name	Description
`URL` UnicodeString	—

Event ID 3042 — Downloading image has failed because downloaded image is empty: URL [URL].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Downloading image has failed because downloaded image is empty: URL [URL].

Message #

Downloading image has failed because downloaded image is empty: URL [%1]

Fields #

Name	Description
`URL` UnicodeString	—

Event ID 3043 — The new tile notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The new tile notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Message #

The new tile notification was found to be a duplicate of a previous notification: new notification id [%1], previous notification id [%2]

Fields #

Name	Description
`NewNotificationId` UInt64	—
`OldNotificationId` UInt64	—

Event ID 3044 — The new badge notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The new badge notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Message #

The new badge notification was found to be a duplicate of a previous notification: new notification id [%1], previous notification id [%2]

Fields #

Name	Description
`NewNotificationId` UInt64	—
`OldNotificationId` UInt64	—

Event ID 3045 — Started tracking Toast Notification Request performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ToastRequestNotification
Opcode: Start

Description

Started tracking Toast Notification Request performance.

Message #

Started tracking Toast Notification Request performance.

Event ID 3046 — Finished tracking Toast Notification Request performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ToastRequestNotification
Opcode: Start

Description

Finished tracking Toast Notification Request performance.

Message #

Finished tracking Toast Notification Request performance.

Event ID 3047 — The new tile flyout notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

The new tile flyout notification was found to be a duplicate of a previous notification: new notification id [NewNotificationId], previous notification id [OldNotificationId].

Message #

The new tile flyout notification was found to be a duplicate of a previous notification: new notification id [%1], previous notification id [%2]

Fields #

Name	Description
`NewNotificationId` UInt64	—
`OldNotificationId` UInt64	—

Event ID 3048 — Badge notification id TrackingId is stored for AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival

Description

Badge notification id TrackingId is stored for AppUserModelId.

Message #

Badge notification id %2 is stored for %1.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`TrackingId` UInt32	—

Event ID 3049 — Endpoint Object is being cleanedup.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

Endpoint Object is being cleanedup.

Message #

Endpoint %1 is being cleanedup

Fields #

Name	Description
`Object` Pointer	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3049,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T23:53:35.736084+00:00",
    "event_record_id": 2728,
    "correlation": {},
    "execution": {
      "process_id": 4304,
      "thread_id": 7872
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Object": "0x12fc974a468"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3050 — Toast notification id NotificationId for AppUserModelId is stored at QueueIndex in queue.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: NewCloudNotificationArrival
Opcode: Stop

Description

Toast notification id NotificationId for AppUserModelId is stored at QueueIndex in queue.

Message #

Toast notification id %2 for %1 is stored at %3 in queue.

Fields #

Name	Description
`AppUserModelId` UnicodeString	—
`NotificationId` UInt32	—
`QueueIndex` UInt16	—

Event ID 3051 — Toast notification id OverridingNotificationId overrided existing notification id OverridedNotificationId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Toast notification id OverridingNotificationId overrided existing notification id OverridedNotificationId.

Message #

Toast notification id %2 overrided existing notification id %1.

Fields #

Name	Description
`OverridedNotificationId` UInt32	—
`OverridingNotificationId` UInt32	—

Event ID 3052 — Toast with notification tracking id TrackingId is being delivered to AppUserModelId on session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: NewCloudNotificationArrival
Opcode: Start

Description

Toast with notification tracking id TrackingId is being delivered to AppUserModelId on session SessionId.

Message #

Toast with notification tracking id %1 is being delivered to %2 on session %3.

Fields #

Name	Description
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3052,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 1,
    "keywords": 9223372039010650115,
    "time_created": "2023-11-05T23:08:15.563064+00:00",
    "event_record_id": 2631,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 2676
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "TrackingId": 2,
    "AppUserModelId": "Windows.SystemToast.StartupApp",
    "SessionId": 1,
    "MessageId": "84982492-82D7-4F7D-B9DA-5695C011C30E"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3053 — NotificationType with notification tracking id TrackingId is being delivered to AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival
Opcode: Start

Description

NotificationType with notification tracking id TrackingId is being delivered to AppUserModelId.

Message #

%1 with notification tracking id %2 is being delivered to %3.

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—

Event ID 3054 — Toast with notification tracking id TrackingId is canceled by AppUserModelId - informed session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Toast with notification tracking id TrackingId is canceled by AppUserModelId - informed session SessionId.

Message #

Toast with notification tracking id %1 is canceled by %2 - informed session %3.

Fields #

Name	Description
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—

Event ID 3055 — Some toast notifications have been cleared - informed session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: ClearToastNotification

Description

Some toast notifications have been cleared - informed session SessionId.

Message #

Some toast notifications have been cleared - informed session %1.

Fields #

Name	Description
`SessionId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3055,
    "version": 0,
    "level": 4,
    "task": 23,
    "opcode": 0,
    "keywords": 9223372039564789760,
    "time_created": "2023-11-05T23:08:15.715873+00:00",
    "event_record_id": 2632,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 3760
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3056 — NotificationType are being cleared for AppUserModelId - informed session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Opcode: Info

Description

NotificationType are being cleared for AppUserModelId - informed session SessionId.

Message #

%1 are being cleared for %2 - informed session %3.

Fields #

Name	Description
`NotificationType` UInt32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`ErrorCode` Int32	—
`SessionErrorCode` Int32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3056,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372039564789760,
    "time_created": "2023-11-05T22:35:45.134029+00:00",
    "event_record_id": 2538,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-1D4E-DBE43710DA01"
    },
    "execution": {
      "process_id": 4304,
      "thread_id": 7884
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "NotificationType": 2,
    "AppUserModelId": "Microsoft.SkyDrive.Desktop",
    "SessionId": 2,
    "ErrorCode": 0,
    "SessionErrorCode": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3057 — Presentation Endpoint received a call to close session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionClose
Opcode: Start

Description

Presentation Endpoint received a call to close session SessionId.

Message #

Presentation Endpoint received a call to close session %1.

Fields #

Name	Description
`SessionId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3057,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 1,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.077802+00:00",
    "event_record_id": 2368,
    "correlation": {},
    "execution": {
      "process_id": 4768,
      "thread_id": 5408
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 3
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3058 — Presentation Endpoint ended a call to close session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Level: Informational
Task: TileSessionClose
Opcode: Stop

Description

Presentation Endpoint ended a call to close session SessionId.

Message #

Presentation Endpoint ended a call to close session %1.

Fields #

Name	Description
`SessionId` UInt32	—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PushNotifications-Platform",
    "guid": "88CD9180-4491-4640-B571-E3BEE2527943",
    "event_source_name": "",
    "event_id": 3058,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 2,
    "keywords": 9223372036854777856,
    "time_created": "2023-11-05T22:31:33.077872+00:00",
    "event_record_id": 2369,
    "correlation": {},
    "execution": {
      "process_id": 4768,
      "thread_id": 5408
    },
    "channel": "Microsoft-Windows-PushNotification-Platform/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "SessionId": 3
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3100 — Started tracking Clear Toast Notification performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotification
Opcode: Start

Description

Started tracking Clear Toast Notification performance.

Message #

Started tracking Clear Toast Notification performance.

Event ID 3101 — Finished tracking Clear Toast Notification performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotification
Opcode: Start

Description

Finished tracking Clear Toast Notification performance.

Message #

Finished tracking Clear Toast Notification performance.

Event ID 3102 — Started tracking Clear Toast Notifications performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotifications
Opcode: Start

Description

Started tracking Clear Toast Notifications performance.

Message #

Started tracking Clear Toast Notifications performance.

Event ID 3103 — Finished tracking Clear Toast Notifications performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotifications
Opcode: Start

Description

Finished tracking Clear Toast Notifications performance.

Message #

Finished tracking Clear Toast Notifications performance.

Event ID 3104 — Toast with notification id [TrackingId] has expired and will be removed from the queue.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Toast with notification id [TrackingId] has expired and will be removed from the queue.

Message #

Toast with notification id [%1] has expired and will be removed from the queue.

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 3105 — Started tracking Remove Toast Notifications performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RemoveToastNotifications
Opcode: Start

Description

Started tracking Remove Toast Notifications performance.

Message #

Started tracking Remove Toast Notifications performance.

Event ID 3106 — Finished tracking Remove Toast Notifications performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: RemoveToastNotifications
Opcode: Start

Description

Finished tracking Remove Toast Notifications performance.

Message #

Finished tracking Remove Toast Notifications performance.

Event ID 3107 — Processing of Push Notification has failed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

Processing of Push Notification has failed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] ErrorCode [ErrorCode].

Message #

Processing of Push Notification has failed: ChannelId [%1], NotificationType [%2], TrackingId [%3] AppId [%4] ErrorCode [%5]

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3108 — Started tracking Clear Toast Notification Rollover performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotificationRollover
Opcode: Start

Description

Started tracking Clear Toast Notification Rollover performance.

Message #

Started tracking Clear Toast Notification Rollover performance.

Event ID 3109 — Finished tracking Clear Toast Notification Rollover performance.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Task: ClearToastNotificationRollover
Opcode: Stop

Description

Finished tracking Clear Toast Notification Rollover performance.

Message #

Finished tracking Clear Toast Notification Rollover performance.

Event ID 3110 — Toast Notification Forwarding Global Settings: isFwToCdpEnabled = IsFwdToCdpEnabled isMirrorMasterSwitchEnabled = IsMirrorMasterSwitchEnabled MirroringDisabled = MirroringEnabled.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCForwardToast

Description

Toast Notification Forwarding Global Settings: isFwToCdpEnabled = IsFwdToCdpEnabled isMirrorMasterSwitchEnabled = IsMirrorMasterSwitchEnabled MirroringDisabled = MirroringEnabled.

Message #

Toast Notification Forwarding Global Settings: isFwToCdpEnabled = %1 isMirrorMasterSwitchEnabled = %2 MirroringDisabled = %3

Fields #

Name	Description
`IsFwdToCdpEnabled` Boolean	—
`IsMirrorMasterSwitchEnabled` Boolean	—
`MirroringEnabled` Boolean	—

Event ID 3111 — Start Toast Notification Forwarding activity

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCForwardToast
Opcode: Start

Description

Start Toast Notification Forwarding activity.

Message #

Start Toast Notification Forwarding activity

Event ID 3112 — Stop Toast Notification Forwarding activity

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCForwardToast
Opcode: Stop

Description

Stop Toast Notification Forwarding activity.

Message #

Stop Toast Notification Forwarding activity

Event ID 3113 — Toast Notification Forwarding Local Settings: isDeveloperAppMirroringEnabled = IsFwdToCdpEnabled isMirrorMasterSwitchEnabled = IsMirrorMasterSwitchEnabled isGroupPolicyEnabled = IsGPEnabled.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCForwardToast

Description

Toast Notification Forwarding Local Settings: isDeveloperAppMirroringEnabled = IsFwdToCdpEnabled isMirrorMasterSwitchEnabled = IsMirrorMasterSwitchEnabled isGroupPolicyEnabled = IsGPEnabled.

Message #

Toast Notification Forwarding Local Settings: isDeveloperAppMirroringEnabled = %1 isMirrorMasterSwitchEnabled = %2 isGroupPolicyEnabled = %3

Fields #

Name	Description
`IsFwdToCdpEnabled` Boolean	—
`IsMirrorMasterSwitchEnabled` Boolean	—
`IsGPEnabled` Boolean	—

Event ID 3114 — Start Toast Notification Forwarding Do Forward To AFC

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDoForwardToast
Opcode: Start

Description

Start Toast Notification Forwarding Do Forward To AFC.

Message #

Start Toast Notification Forwarding Do Forward To AFC

Event ID 3115 — Stop Toast Notification Forwarding Do Forward To AFC

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDoForwardToast
Opcode: Stop

Description

Stop Toast Notification Forwarding Do Forward To AFC.

Message #

Stop Toast Notification Forwarding Do Forward To AFC

Event ID 3116 — Start Toast Notification Forwarding Make Activity from Notification

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity
Opcode: Start

Description

Start Toast Notification Forwarding Make Activity from Notification.

Message #

Start Toast Notification Forwarding Make Activity from Notification

Event ID 3117 — Stop Toast Notification Forwarding Make Activity from Notification

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity
Opcode: Stop

Description

Stop Toast Notification Forwarding Make Activity from Notification.

Message #

Stop Toast Notification Forwarding Make Activity from Notification

Event ID 3118 — Toast Notification Forwarding Finished Decorating Payload

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity

Description

Toast Notification Forwarding Finished Decorating Payload.

Message #

Toast Notification Forwarding Finished Decorating Payload

Event ID 3119 — Toast Notification Forwarding Finished Loading Payload onto Activity

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity

Description

Toast Notification Forwarding Finished Loading Payload onto Activity.

Message #

Toast Notification Forwarding Finished Loading Payload onto Activity

Event ID 3120 — Toast Notification Forwarding Finished setting attributes onto activity

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity

Description

Toast Notification Forwarding Finished setting attributes onto activity.

Message #

Toast Notification Forwarding Finished setting attributes onto activity

Event ID 3121 — Start Toast Notification Forwarding Asset Resolution

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Start

Description

Start Toast Notification Forwarding Asset Resolution.

Message #

Start Toast Notification Forwarding Asset Resolution

Event ID 3122 — Toast Notification Forwarding Asset Resolution Successful

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Stop

Description

Toast Notification Forwarding Asset Resolution Successful.

Message #

Toast Notification Forwarding Asset Resolution Successful

Event ID 3123 — Toast Notification Forwarding Making Activity TrackingId = TrackingId AppUserModelId = AppUserModelId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCMakeActivity

Description

Toast Notification Forwarding Making Activity TrackingId = TrackingId AppUserModelId = AppUserModelId.

Message #

Toast Notification Forwarding Making Activity TrackingId = %1 AppUserModelId = %2

Fields #

Name	Description
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—

Event ID 3124 — Toast Notification Forwarding Published Activity with Result = ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDoForwardToast

Description

Toast Notification Forwarding Published Activity with Result = ErrorCode.

Message #

Toast Notification Forwarding Published Activity with Result = %1

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 3125 — VerboseLog.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDoForwardToast

Message #

%1

Fields #

Name	Description
`VerboseLog` UnicodeString	—

Event ID 3126 — Sync Dismiss: Dismiss Activities for App Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDismissActivitiesForApp
Opcode: Start

Description

Sync Dismiss: Dismiss Activities for App Start.

Message #

Sync Dismiss: Dismiss Activities for App Start

Event ID 3127 — Sync Dismiss: Dismiss Activities for App Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDismissActivitiesForApp
Opcode: Stop

Description

Sync Dismiss: Dismiss Activities for App Stop.

Message #

Sync Dismiss: Dismiss Activities for App Stop

Event ID 3128 — Sync Dismiss: Dismiss Activities Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDismissActivities
Opcode: Start

Description

Sync Dismiss: Dismiss Activities Start.

Message #

Sync Dismiss: Dismiss Activities Start

Event ID 3129 — Sync Dismiss: Dismiss Activities Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCDismissActivities
Opcode: Stop

Description

Sync Dismiss: Dismiss Activities Stop.

Message #

Sync Dismiss: Dismiss Activities Stop

Event ID 3130 — Sync Dismiss: Dismiss Activities Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCOnActivityDismissed
Opcode: Start

Description

Sync Dismiss: Dismiss Activities Start.

Message #

Sync Dismiss: Dismiss Activities Start

Event ID 3131 — Sync Dismiss: Dismiss Activities Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCOnActivityDismissed
Opcode: Stop

Description

Sync Dismiss: Dismiss Activities Stop.

Message #

Sync Dismiss: Dismiss Activities Stop

Event ID 3132 — Sync Dismiss: Remove Notification using Activity Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCRemoveNotificationUsingActivity
Opcode: Start

Description

Sync Dismiss: Remove Notification using Activity Start.

Message #

Sync Dismiss: Remove Notification using Activity Start

Event ID 3133 — Sync Dismiss: Remove Notification using Activity Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCRemoveNotificationUsingActivity
Opcode: Stop

Description

Sync Dismiss: Remove Notification using Activity Stop.

Message #

Sync Dismiss: Remove Notification using Activity Stop

Event ID 3134 — Sync Dismiss: Get Activities Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCGetActivities
Opcode: Stop

Description

Sync Dismiss: Get Activities Start.

Message #

Sync Dismiss: Get Activities Start

Event ID 3135 — Sync Dismiss: Get Activities Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCGetActivities
Opcode: Stop

Description

Sync Dismiss: Get Activities Stop.

Message #

Sync Dismiss: Get Activities Stop

Event ID 3136 — Sync Dismiss: CDPGetPlatformDeviceId Start

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCGetPlatformDeviceId
Opcode: Start

Description

Sync Dismiss: CDPGetPlatformDeviceId Start.

Message #

Sync Dismiss: CDPGetPlatformDeviceId Start

Event ID 3137 — Sync Dismiss: CDPGetPlatformDeviceId Stop

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCGetPlatformDeviceId
Opcode: Stop

Description

Sync Dismiss: CDPGetPlatformDeviceId Stop.

Message #

Sync Dismiss: CDPGetPlatformDeviceId Stop

Event ID 3138 — VerboseLog.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Message #

%1

Fields #

Name	Description
`VerboseLog` UnicodeString	—

Event ID 3139 — Sync Dismiss Removed Activity with Result = ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Sync Dismiss Removed Activity with Result = ErrorCode.

Message #

Sync Dismiss Removed Activity with Result = %1

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 3140 — Sync Dismiss Removed Notification with Result = ErrorCode.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCRemoveNotificationUsingActivity

Description

Sync Dismiss Removed Notification with Result = ErrorCode.

Message #

Sync Dismiss Removed Notification with Result = %1

Fields #

Name	Description
`ErrorCode` Int32	—

Event ID 3141 — SyncDismissRemoveNotificationUsingActivityParams: MatchOnNotificationId = MatchOnNotificationId NotificationId = NotificationId ActivityId = ActivityId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCRemoveNotificationUsingActivity

Description

SyncDismissRemoveNotificationUsingActivityParams: MatchOnNotificationId = MatchOnNotificationId NotificationId = NotificationId ActivityId = ActivityId.

Message #

SyncDismissRemoveNotificationUsingActivityParams: MatchOnNotificationId = %1 NotificationId = %2 ActivityId = %3

Fields #

Name	Description
`MatchOnNotificationId` Boolean	—
`NotificationId` UInt32	—
`ActivityId` UnicodeString	—

Event ID 3142 — Sync Dismiss: Matched Activity using Notification!

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Sync Dismiss: Matched Activity using Notification!

Message #

Sync Dismiss: Matched Activity using Notification!

Event ID 3143 — Sync Dismiss: Matched Notification using Activity!

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: AFCRemoveNotificationUsingActivity

Description

Sync Dismiss: Matched Notification using Activity!

Message #

Sync Dismiss: Matched Notification using Activity!

Event ID 3144 — Received WNF_CDP_CDPUSERSVC_READY

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

Received WNF_CDP_CDPUSERSVC_READY.

Message #

Received WNF_CDP_CDPUSERSVC_READY

Event ID 3145 — [Sqlite][Informational] Status: SqliteInformational_Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

[Sqlite][Informational] Status: SqliteInformational_Status. Message: Message.

Message #

[Sqlite][Informational] Status: %1. Message: %2

Fields #

Name	Description
`SqliteInformational_Status` Int32	[Sqlite][Informational] Status.
`Message` AnsiString	—
`Error` Int32	—

Event ID 3146 — [Sqlite][Warning] Status: SqliteWarning_Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

[Sqlite][Warning] Status: SqliteWarning_Status. Message: Message.

Message #

[Sqlite][Warning] Status: %1. Message: %2

Fields #

Name	Description
`SqliteWarning_Status` Int32	[Sqlite][Warning] Status.
`Message` AnsiString	—
`Error` Int32	—

Event ID 3147 — [Sqlite][Error] Status: SqliteError_Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Opcode: Info

Description

[Sqlite][Error] Status: SqliteError_Status. Message: Message.

Message #

[Sqlite][Error] Status: %1. Message: %2

Fields #

Name	Description
`SqliteError_Status` Int32	[Sqlite][Error] Status.
`Message` AnsiString	—
`Error` Int32	—

Event ID 3148 — [Sqlite][Other] Status: SqliteOther_Status.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

[Sqlite][Other] Status: SqliteOther_Status. Message: Message.

Message #

[Sqlite][Other] Status: %1. Message: %2

Fields #

Name	Description
`SqliteOther_Status` Int32	[Sqlite][Other] Status.
`Message` AnsiString	—
`Error` Int32	—

Event ID 3149 — Processing of Push Notification has succeeded: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] MessageId [MessageId] PolicyReason [PolicyR...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug

Description

Processing of Push Notification has succeeded: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] MessageId [MessageId] PolicyReason [PolicyReason] HResult [ErrorCode].

Message #

Processing of Push Notification has succeeded: ChannelId [%1], NotificationType [%2], TrackingId [%3] AppId [%4]  MessageId [%5] PolicyReason [%6] HResult [%7]

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`MessageId` UInt64	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3149 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Push Notification has succeeded: ChannelId [], NotificationType [], TrackingId [] AppId [] MessageId [] PolicyReason [] HResult [].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`MessageId` UInt64	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3150 — Processing of Local Notification has failed: NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] PolicyReason [PolicyReason] HResult [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Local Notification has failed: NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] PolicyReason [PolicyReason] HResult [ErrorCode].

Message #

Processing of Local Notification has failed: NotificationType [%1], TrackingId [%2] AppId [%3] PolicyReason [%4] HResult [%5]

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3150 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Local Notification has failed: NotificationType [], TrackingId [] AppId [] PolicyReason [] HResult [].

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3151 — Processing of Local Notification has succeeded: NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] PolicyReason [PolicyReason] HResult [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug

Description

Processing of Local Notification has succeeded: NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId] PolicyReason [PolicyReason] HResult [ErrorCode].

Message #

Processing of Local Notification has succeeded: NotificationType [%1], TrackingId [%2] AppId [%3] PolicyReason [%4] HResult [%5]

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3151 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Local Notification has succeeded: NotificationType [], TrackingId [] AppId [] PolicyReason [] HResult [].

Fields #

Name	Description
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3152 — Processing of Push Notification has failed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId], PolicyReason [PolicyReason] ErrorCode [ErrorC...

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Push Notification has failed: ChannelId [ChannelId], NotificationType [NotificationType], TrackingId [TrackingId] AppId [AppUserModelId], PolicyReason [PolicyReason] ErrorCode [ErrorCode].

Message #

Processing of Push Notification has failed: ChannelId [%1], NotificationType [%2], TrackingId [%3] AppId [%4], PolicyReason [%5] ErrorCode [%6]

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3152 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Push Notification has failed: ChannelId [], NotificationType [], TrackingId [] AppId [], PolicyReason [] ErrorCode [].

Fields #

Name	Description
`ChannelId` UnicodeString	—
`NotificationType` UnicodeString	—
`TrackingId` UInt32	—
`AppUserModelId` UnicodeString	—
`PolicyReason` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3153 — Toast with notification tracking id TrackingId is delivered to AppUserModelId on session SessionId.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival
Opcode: Stop

Description

Toast with notification tracking id TrackingId is delivered to AppUserModelId on session SessionId.

Message #

Toast with notification tracking id %1 is delivered to %2 on session %3.

Fields #

Name	Description
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—

Event ID 3153 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational
Task: NewCloudNotificationArrival
Opcode: Stop

Description

Toast with notification tracking id is delivered to on session .

Fields #

Name	Description
`TrackingId` Int32	—
`AppUserModelId` UnicodeString	—
`SessionId` UInt32	—
`MessageId` GUID	—

Event ID 3154 — Processing and publishing of Resume Notification has succeeded: TrackingId [TrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug

Description

Processing and publishing of Resume Notification has succeeded: TrackingId [TrackingId].

Message #

Processing and publishing of Resume Notification has succeeded: TrackingId [%1]

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 3154 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing and publishing of Resume Notification has succeeded: TrackingId [].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 3155 — Processing and publishing of Resume Notification has failed: TrackingId [TrackingId], Location [Location], ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing and publishing of Resume Notification has failed: TrackingId [TrackingId], Location [Location], ErrorCode [ErrorCode].

Message #

Processing and publishing of Resume Notification has failed: TrackingId [%1], Location [%2], ErrorCode [%3]

Fields #

Name	Description
`TrackingId` UInt32	—
`Location` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3155 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing and publishing of Resume Notification has failed: TrackingId [], Location [], ErrorCode [].

Fields #

Name	Description
`TrackingId` UInt32	—
`Location` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3156 — Processing of Resume Response has succeeded: TrackingId [TrackingId].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug

Description

Processing of Resume Response has succeeded: TrackingId [TrackingId].

Message #

Processing of Resume Response has succeeded: TrackingId [%1]

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 3156 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Resume Response has succeeded: TrackingId [].

Fields #

Name	Description
`TrackingId` UInt32	—

Event ID 3157 — Processing of Resume Response has failed: TrackingId [TrackingId], Location [Location], ErrorCode [ErrorCode].

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Resume Response has failed: TrackingId [TrackingId], Location [Location], ErrorCode [ErrorCode].

Message #

Processing of Resume Response has failed: TrackingId [%1], Location [%2], ErrorCode [%3]

Fields #

Name	Description
`TrackingId` UInt32	—
`Location` UnicodeString	—
`ErrorCode` Int32	—

Event ID 3157 —

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Operational

Description

Processing of Resume Response has failed: TrackingId [], Location [], ErrorCode [].

Fields #

Name	Description
`TrackingId` UInt32	—
`Location` UnicodeString	—
`ErrorCode` Int32	—

Event ID 10000 — DebugTrace: DebugTrace.

Provider: Microsoft-Windows-PushNotifications-Platform
Channel: Debug
Opcode: Info

Description

DebugTrace: DebugTrace.

Message #

DebugTrace: %1

Fields #

Name	Description
`DebugTrace` UnicodeString	—
`debugString` UnicodeString	—