Microsoft-Windows-SettingSync-Desktop

18 events across 2 channels

Event	Title	Channel
5001	The system failed to request a sync for collection {CollectionId} (operation: …	Operational
5002	The setting unit {SettingUnitId} for collection {CollectionId} is invalid.	Operational
5003	Starting or stopping setting change publisher for {CollectionId} failed.	Operational
5004	Failed to create process '{CollectionId}' (Result: {HRESULT}).	Operational
5005	Starting the setting monitor SSO failed.	Operational
5006	Starting the WNF listener failed.	Operational
5007	Event ID 5007	Operational
5008	Event ID 5008	Operational
5009	Event ID 5009	Operational
6001	The sync provider requested that {CollectionId} not upload now.	Debug
6002	Starting or stopping setting change publisher for {CollectionId} failed.	Debug
6501	Wnf event callback failure.	Debug
6502	StartLayoutSync - Load layout data from stream.	Debug
6503	PicturePasswordPicture image validation failed (HRESULT: {HRESULT}).	Debug
6509	Event ID 6509	Debug
6510	Event ID 6510	Debug
6511	Event ID 6511	Debug
6512	Monitor SSO {Message} blocked.	Debug

Event ID 5001: The system failed to request a sync for collection {CollectionId} (operation: {Operation}; Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

The system failed to request a sync for collection {CollectionId} (operation: {Operation}; Result: {HRESULT}).

Message #

The system failed to request a sync for collection {CollectionId} (operation: {Operation}; Result: {HRESULT}).

Fields #

Name	Description
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`HRESULT`

Event ID 5002: The setting unit {SettingUnitId} for collection {CollectionId} is invalid.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

The setting unit {SettingUnitId} for collection {CollectionId} is invalid. (operation: {Operation}; Result: {HRESULT}).

Message #

The setting unit {SettingUnitId} for collection {CollectionId} is invalid. (operation: {Operation}; Result: {HRESULT}).

Fields #

Name	Description
`SettingUnitId`
`CollectionId`
`Operation`	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`HRESULT`

Event ID 5003: Starting or stopping setting change publisher for {CollectionId} failed.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT}).

Message #

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 5004: Failed to create process '{CollectionId}' (Result: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

Failed to create process '{CollectionId}' (Result: {HRESULT}).

Message #

Failed to create process '{CollectionId}' (Result: {HRESULT}).

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 5005: Starting the setting monitor SSO failed.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

Starting the setting monitor SSO failed. (Message: {Message}; Result: {HRESULT}).

Message #

Starting the setting monitor SSO failed.  (Message: {Message}; Result: {HRESULT})

Fields #

Name	Description
`Message`
`HRESULT`

Event ID 5006: Starting the WNF listener failed.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

Starting the WNF listener failed. (Message: {Message}; Result: {HRESULT}).

Message #

Starting the WNF listener failed.  (Message: {Message}; Result: {HRESULT})

Fields #

Name	Description
`Message`
`HRESULT`

Event ID 5007:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 5008:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 5009:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Operational

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 6001: The sync provider requested that {CollectionId} not upload now.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

The sync provider requested that {CollectionId} not upload now. It will retry the upload later.

Message #

The sync provider requested that {CollectionId} not upload now.  It will retry the upload later.

Fields #

Name	Description
`CollectionId`

Event ID 6002: Starting or stopping setting change publisher for {CollectionId} failed.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT}).

Message #

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT})

Fields #

Name	Description
`CollectionId`
`HRESULT`

Event ID 6501: Wnf event callback failure.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

Wnf event callback failure. State Name: {Message}. HRESULT: {HRESULT}.

Message #

Wnf event callback failure. State Name: {Message}. HRESULT: {HRESULT}.

Fields #

Name	Description
`Message`
`HRESULT`

Event ID 6502: StartLayoutSync - Load layout data from stream.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

StartLayoutSync - Load layout data from stream. (HRESULT: {HRESULT}).

Message #

StartLayoutSync - Load layout data from stream. (HRESULT: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 6503: PicturePasswordPicture image validation failed (HRESULT: {HRESULT}).

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

PicturePasswordPicture image validation failed (HRESULT: {HRESULT}).

Message #

PicturePasswordPicture image validation failed (HRESULT: {HRESULT})

Fields #

Name	Description
`HRESULT`

Event ID 6509:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 6510:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 6511:

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

{Message}.

Message #

{Message}

Fields #

Name	Description
`Message`

Event ID 6512: Monitor SSO {Message} blocked.

Provider: Microsoft-Windows-SettingSync-Desktop
Channel: Debug

Description

Monitor SSO {Message} blocked. SSF monitors not required as uploads are blocked by removal policy.

Message #

Monitor SSO {Message} blocked. SSF monitors not required as uploads are blocked by removal policy.

Fields #

Name	Description
`Message`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)