Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP

54 events across 4 channels

Event	Title	Channel
2	Event ID 2	Debug
2	Event ID 2	Operational
3	Event ID 3	Debug
3	Event ID 3	Operational
4	Event ID 4	Analytic
4	Event ID 4	Operational
5	Event ID 5	Analytic
5	Event ID 5	Operational
6	Event ID 6	Debug
6	Event ID 6	Operational
7	Event ID 7	Debug
7	Event ID 7	Operational
8	Event ID 8	Analytic
8	Event ID 8	Operational
9	Event ID 9	Analytic
9	Event ID 9	Operational
100	Remote Desktop IP Virtualization has started.	Admin
100	Event ID 100	Operational
101	Remote Desktop IP Virtualization has ended.	Admin
101	Event ID 101	Operational
102	An error occurred when the computer tried to start Remote Desktop IP …	Admin
102	Event ID 102	Operational
103	Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID …	Admin
103	Event ID 103	Operational
104	Remote Desktop IP Virtualization released the IP address, Param1, for session ID …	Admin
104	Event ID 104	Operational
105	Remote Desktop IP Virtualization could not acquire an IP address for session ID …	Admin
105	Event ID 105	Operational
106	Remote Desktop IP Virtualization could not release the IP address for session ID …	Admin
106	Event ID 106	Operational
107	Remote Desktop IP Virtualization will virtualize the application, Param1, on …	Admin
107	Event ID 107	Operational
108	Remote Desktop IP Virtualization will virtualize the application, Param1, on …	Admin
108	Event ID 108	Operational
109	Remote Desktop IP Virtualization did not virtualize the application, Param1, on …	Admin
109	Event ID 109	Operational
110	Remote Desktop IP Virtualization did not virtualize the application, Param1, on …	Admin
110	Event ID 110	Operational
111	Remote Desktop IP Virtualization detected more than one network adapter.	Admin
111	Event ID 111	Operational
112	Remote Desktop IP Virtualization will use the network adapter with the MAC …	Admin
112	Event ID 112	Operational
113	Remote Desktop IP Virtualization could not find the network adapter that matches …	Admin
113	Event ID 113	Operational
114	Remote Desktop IP Virtualization could not load Param1.	Admin
114	Event ID 114	Operational
115	Remote Desktop IP Virtualization could not renew the IP address, Param1.	Admin
115	Event ID 115	Operational
116	Remote Desktop IP Virtualization could not renew the IP address, Param1, for …	Admin
116	Event ID 116	Operational
117	Remote Desktop IP Virtualization successfully renewed the IP address, message.	Admin
117	Event ID 117	Operational
118	Remote Desktop IP Virtualization could not allocate the IP address, Param1, for …	Admin
118	Event ID 118	Operational

Event ID 2:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 2:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 3:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 3:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 4:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 4:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 5:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 5:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 6:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 6:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 7:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 7:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 8:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 8:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 9:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 9:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 100: Remote Desktop IP Virtualization has started.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization has started.

Message #

Remote Desktop IP Virtualization has started.

Event ID 100:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization has started.

Event ID 101: Remote Desktop IP Virtualization has ended.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization has ended.

Message #

Remote Desktop IP Virtualization has ended.

Event ID 101:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization has ended.

Event ID 102: An error occurred when the computer tried to start Remote Desktop IP Virtualization: Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

An error occurred when the computer tried to start Remote Desktop IP Virtualization: Param1.

Message #

An error occurred when the computer tried to start Remote Desktop IP Virtualization: %1.

Fields #

Name	Description
`Param1` HexInt32

Event ID 102:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

An error occurred when the computer tried to start Remote Desktop IP Virtualization: .

Fields #

Name	Description
`Param1` HexInt32

Event ID 103: Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization assigned the IP address, %1,  to session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 103:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization assigned the IP address, , to session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 104: Remote Desktop IP Virtualization released the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization released the IP address, Param1, for session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization released the IP address, %1, for session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 104:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization released the IP address, , for session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 105: Remote Desktop IP Virtualization could not acquire an IP address for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not acquire an IP address for session ID Param2. Error code: Param1.

Message #

Remote Desktop IP Virtualization could not acquire an IP address for session ID %1.  Error code: %2

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 105:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not acquire an IP address for session ID . Error code.

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 106: Remote Desktop IP Virtualization could not release the IP address for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not release the IP address for session ID Param2. Error code: Param1.

Message #

Remote Desktop IP Virtualization could not release the IP address for session ID %1. Error code: %2

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 106:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not release the IP address for session ID . Error code.

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 107: Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param3.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param3.

Message #

Remote Desktop IP Virtualization will virtualize the application, %1, on session ID %2, with IP address, %3.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString

Event ID 107:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will virtualize the application, , on session ID , with IP address, .

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString

Event ID 108: Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param5.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param5. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization will virtualize the application, %1, on session ID %2, with IP address, %5. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString
`Param5` UnicodeString

Event ID 108:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will virtualize the application, , on session ID , with IP address, . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString
`Param5` UnicodeString

Event ID 109: Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Message #

Remote Desktop IP Virtualization did not virtualize the application, %2, on session ID %1.

Fields #

Name	Description
`Param2` Int32
`Param1` UnicodeString

Event ID 109:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization did not virtualize the application, , on session ID .

Fields #

Name	Description
`Param2` Int32
`Param1` UnicodeString

Event ID 110: Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization did not virtualize the application, %1, on session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 110:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization did not virtualize the application, , on session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 111: Remote Desktop IP Virtualization detected more than one network adapter.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Message #

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Event ID 111:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Event ID 112: Remote Desktop IP Virtualization will use the network adapter with the MAC address of message to provide IP virtualization.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will use the network adapter with the MAC address of message to provide IP virtualization.

Message #

Remote Desktop IP Virtualization will use the network adapter with the MAC address of %1 to provide IP virtualization.

Fields #

Name	Description
`message` UnicodeString

Event ID 112:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will use the network adapter with the MAC address of to provide IP virtualization.

Fields #

Name	Description
`message` UnicodeString

Event ID 113: Remote Desktop IP Virtualization could not find the network adapter that matches Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not find the network adapter that matches Param1. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not find the network adapter that matches %1. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 113:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not find the network adapter that matches . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 114: Remote Desktop IP Virtualization could not load Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not load Param1. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not load %1. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 114:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not load . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 115: Remote Desktop IP Virtualization could not renew the IP address, Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not renew the IP address, Param1. Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not renew the IP address, %1. Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 115:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not renew the IP address, . Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 116: Remote Desktop IP Virtualization could not renew the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not renew the IP address, Param1, for session ID Param2. Error code: Param3.

Message #

Remote Desktop IP Virtualization could not renew the IP address, %1, for session ID %2.  Error code: %3

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 116:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not renew the IP address, , for session ID . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 117: Remote Desktop IP Virtualization successfully renewed the IP address, message.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization successfully renewed the IP address, message.

Message #

Remote Desktop IP Virtualization successfully renewed the IP address, %1.

Fields #

Name	Description
`message` UnicodeString

Event ID 117:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization successfully renewed the IP address, .

Fields #

Name	Description
`message` UnicodeString

Event ID 118: Remote Desktop IP Virtualization could not allocate the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not allocate the IP address, Param1, for session ID Param2. Error code: Param3.

Message #

Remote Desktop IP Virtualization could not allocate the IP address, %1, for session ID %2.  Error code: %3

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 118:

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not allocate the IP address, , for session ID . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)