detection.wiki

Microsoft-Windows-UserDataAccess-CEMAPI

141 events across 1 channel

EventTitleChannel
1Error: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
2Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.Operational
3TraceOperational
4011FOLDER_EMPTYFOLDERStartOperational
4012FOLDER_EMPTYFOLDERStopOperational
4013FOLDER_CREATEMESSAGEStartOperational
4014FOLDER_CREATEMESSAGEStopOperational
4015FOLDER_DELETEMESSAGESStartOperational
4016FOLDER_DELETEMESSAGESStopOperational
4017FOLDER_COPYMESSAGESStartOperational
4018FOLDER_COPYMESSAGESStopOperational
4019FOLDER_GETHIERARCHYTABLEStartOperational
4020FOLDER_GETHIERARCHYTABLEStopOperational
4021FOLDER_GETCONTENTSTABLEStartOperational
4022FOLDER_GETCONTENTSTABLEStopOperational
4023FOLDER_DELETEFOLDERStartOperational
4024FOLDER_DELETEFOLDERStopOperational
4025FOLDER_COPYFOLDERStartOperational
4026FOLDER_COPYFOLDERStopOperational
4027FOLDER_CREATEFOLDERStartOperational
4028FOLDER_CREATEFOLDERStopOperational
4100QUERYROWS_ATTACHMENTSStartOperational
4101QUERYROWS_ATTACHMENTSStopOperational
4102QUERYROWS_RECIPIENTSStartOperational
4103QUERYROWS_RECIPIENTSStopOperational
4104QUERYROWS_FOLDERCONTENTSStartOperational
4105QUERYROWS_FOLDERCONTENTSStopOperational
4106QUERYROWS_FOLDERHIERARCHYStartOperational
4107QUERYROWS_FOLDERHIERARCHYStopOperational
4108QUERYROWS_SEARCHFOLDERStartOperational
4109QUERYROWS_SEARCHFOLDERStopOperational
4110QUERYROWS_STORESStartOperational
4111QUERYROWS_STORESStopOperational
4112QUERYROWS_CONVERSATIONSStartOperational
4113QUERYROWS_CONVERSATIONSStopOperational
4200STORE_GETIDSFROMNAMESStartOperational
4201STORE_GETIDSFROMNAMESStopOperational
4202STORE_OPENFOLDERStartOperational
4203STORE_OPENFOLDERStopOperational
4204STORE_OPENMESSAGEStartOperational
4205STORE_OPENMESSAGEStopOperational
4206STORE_ISANCESTORStartOperational
4207STORE_ISANCESTORStopOperational
4208STORE_CREATESPECIALFOLDERSStartOperational
4209STORE_CREATESPECIALFOLDERSStopOperational
4210STORE_LOADRULESLISTStartOperational
4211STORE_LOADRULESLISTStopOperational
4212STORE_RUNRULESStartOperational
4213STORE_RUNRULESStopOperational
4300MAPILOGONEXStartOperational
4301MAPILOGONEXStopOperational
4302CTX_GETSTOREMANAGERStartOperational
4303CTX_GETSTOREMANAGERStopOperational
4304CTX_CREATESESSIONStartOperational
4305CTX_CREATESESSIONStopOperational
4306CTX_CREATEINSTANCEStartOperational
4307CTX_CREATEINSTANCEStopOperational
4308CTX_INITMESSAGESTORESStartOperational
4309CTX_INITMESSAGESTORESStopOperational
4310CTX_CREATESMSSTOREStartOperational
4311CTX_CREATESMSSTOREStopOperational
4312CTX_LOADDEFAULTMESSAGESTOREStartOperational
4313CTX_LOADDEFAULTMESSAGESTOREStopOperational
4314CTX_CREATEMESSAGESTOREStartOperational
4315CTX_CREATEMESSAGESTOREStopOperational
4316CTX_OPENENTRYStartOperational
4317CTX_OPENENTRYStopOperational
4318CTX_ADVISEStartOperational
4319CTX_ADVISEStopOperational
4320CTX_UNADVISEStartOperational
4321CTX_UNADVISEStopOperational
4322CTX_INITSTORESINKStartOperational
4323CTX_INITSTORESINKStopOperational
4324CTX_GETSTOREBYIDStartOperational
4325CTX_GETSTOREBYIDStopOperational
4326CTX_GETSTOREFROMDATABASEStartOperational
4327CTX_GETSTOREFROMDATABASEStopOperational
4328CTX_OPENMSGSTOREStartOperational
4329CTX_OPENMSGSTOREStopOperational
4330CTX_DELETEMSGSTOREStartOperational
4331CTX_DELETEMSGSTOREStopOperational
4332CTX_REFRESHRULECLIENTSStartOperational
4333CTX_REFRESHRULECLIENTSStopOperational
4400MSG_CREATEATTACHStartOperational
4401MSG_CREATEATTACHStopOperational
4402MSG_DELETEATTACHStartOperational
4403MSG_DELETEATTACHStopOperational
4404MSG_OPENATTACHStartOperational
4405MSG_OPENATTACHStopOperational
4406MSG_GETATTACHTABLEStartOperational
4407MSG_GETATTACHTABLEStopOperational
4408MSG_MODIFYRECIPIENTSStartOperational
4409MSG_MODIFYRECIPIENTSStopOperational
4410MSG_SUBMITMESSAGEStartOperational
4411MSG_SUBMITMESSAGEStopOperational
4412MSG_DELETERECIPIENTSStartOperational
4413MSG_DELETERECIPIENTSStopOperational
4414MSG_ADDRECIPIENTSStartOperational
4415MSG_ADDRECIPIENTSStopOperational
4416MSG_UPDATERECIPIENTTABLEStartOperational
4417MSG_UPDATERECIPIENTTABLEStopOperational
4418MSG_PREPROCESSWRITEStartOperational
4419MSG_PREPROCESSWRITEStopOperational
4420MSG_POSTPROCESSWRITEStartOperational
4421MSG_POSTPROCESSWRITEStopOperational
4500SETPROPSStartOperational
4501SETPROPSStopOperational
4502GETPROPSStartOperational
4503GETPROPSStopOperational
4504DELETEPROPSStartOperational
4505DELETEPROPSStopOperational
4506OPENSTREAMPROPERTYStartOperational
4507OPENSTREAMPROPERTYStopOperational
4508RUNRULEStartOperational
4509RUNRULEStopOperational
4510SESSION_GETSTORESTABLEStartOperational
4511SESSION_GETSTORESTABLEStopOperational
4512SINK_ONNOTIFYStartOperational
4513SINK_ONNOTIFYStopOperational
4514SINK_ONNOTIFYWRAPPERStartOperational
4515SINK_ONNOTIFYWRAPPERStopOperational
4600CONVERSATION_DELETEStartOperational
4601CONVERSATION_DELETEStopOperational
4602CONVERSATION_SOFTDELETEStartOperational
4603CONVERSATION_SOFTDELETEStopOperational
4604CONVERSATION_MSGPROPSETStartOperational
4605CONVERSATION_MSGPROPSETStopOperational
4606CONVERSATION_MSGPROPDELETEStartOperational
4607CONVERSATION_MSGPROPDELETEStopOperational
4608CONVERSATION_DELETEMESSAGESStartOperational
4609CONVERSATION_DELETEMESSAGESStopOperational
4610CONVERSATIONID_SETStartOperational
4611CONVERSATIONID_SETStopOperational
4612CONVERSATIONID_CREATEHASHStartOperational
4613CONVERSATIONID_CREATEHASHStopOperational
4700SHARECONTENTStartOperational
4701SHARECONTENTStopOperational
4800MAPI Context is being deletedOperational
4801MAPI Event is lostOperational
4802MAPI Event data errorOperational
4803Unknown prop tag seen in ConvertDatabasePropertyTagsToMapiTags: Prop_Hex_UInt32.Operational

Event ID 1: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 3: Trace

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
Trace

Fields #

NameDescription
Message Pointer

Event ID 4011: FOLDER_EMPTYFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_EMPTYFOLDER
Opcode
Start

Event ID 4012: FOLDER_EMPTYFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_EMPTYFOLDER
Opcode
Stop

Event ID 4013: FOLDER_CREATEMESSAGEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_CREATEMESSAGE
Opcode
Start

Event ID 4014: FOLDER_CREATEMESSAGEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_CREATEMESSAGE
Opcode
Stop

Event ID 4015: FOLDER_DELETEMESSAGESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_DELETEMESSAGES
Opcode
Start

Event ID 4016: FOLDER_DELETEMESSAGESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_DELETEMESSAGES
Opcode
Stop

Event ID 4017: FOLDER_COPYMESSAGESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_COPYMESSAGES
Opcode
Start

Event ID 4018: FOLDER_COPYMESSAGESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_COPYMESSAGES
Opcode
Stop

Event ID 4019: FOLDER_GETHIERARCHYTABLEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_GETHIERARCHYTABLE
Opcode
Start

Event ID 4020: FOLDER_GETHIERARCHYTABLEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_GETHIERARCHYTABLE
Opcode
Stop

Event ID 4021: FOLDER_GETCONTENTSTABLEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_GETCONTENTSTABLE
Opcode
Start

Event ID 4022: FOLDER_GETCONTENTSTABLEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_GETCONTENTSTABLE
Opcode
Stop

Event ID 4023: FOLDER_DELETEFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_DELETEFOLDER
Opcode
Start

Event ID 4024: FOLDER_DELETEFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_DELETEFOLDER
Opcode
Stop

Event ID 4025: FOLDER_COPYFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_COPYFOLDER
Opcode
Start

Event ID 4026: FOLDER_COPYFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_COPYFOLDER
Opcode
Stop

Event ID 4027: FOLDER_CREATEFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_CREATEFOLDER
Opcode
Start

Event ID 4028: FOLDER_CREATEFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
FOLDER_CREATEFOLDER
Opcode
Stop

Event ID 4100: QUERYROWS_ATTACHMENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_ATTACHMENTS
Opcode
Start

Event ID 4101: QUERYROWS_ATTACHMENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_ATTACHMENTS
Opcode
Stop

Event ID 4102: QUERYROWS_RECIPIENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_RECIPIENTS
Opcode
Start

Event ID 4103: QUERYROWS_RECIPIENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_RECIPIENTS
Opcode
Stop

Event ID 4104: QUERYROWS_FOLDERCONTENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_FOLDERCONTENTS
Opcode
Start

Event ID 4105: QUERYROWS_FOLDERCONTENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_FOLDERCONTENTS
Opcode
Stop

Event ID 4106: QUERYROWS_FOLDERHIERARCHYStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_FOLDERHIERARCHY
Opcode
Start

Event ID 4107: QUERYROWS_FOLDERHIERARCHYStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_FOLDERHIERARCHY
Opcode
Stop

Event ID 4108: QUERYROWS_SEARCHFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_SEARCHFOLDER
Opcode
Start

Event ID 4109: QUERYROWS_SEARCHFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_SEARCHFOLDER
Opcode
Stop

Event ID 4110: QUERYROWS_STORESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_STORES
Opcode
Start

Event ID 4111: QUERYROWS_STORESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_STORES
Opcode
Stop

Event ID 4112: QUERYROWS_CONVERSATIONSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_CONVERSATIONS
Opcode
Start

Event ID 4113: QUERYROWS_CONVERSATIONSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
QUERYROWS_CONVERSATIONS
Opcode
Stop

Event ID 4200: STORE_GETIDSFROMNAMESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_GETIDSFROMNAMES
Opcode
Start

Event ID 4201: STORE_GETIDSFROMNAMESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_GETIDSFROMNAMES
Opcode
Stop

Event ID 4202: STORE_OPENFOLDERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_OPENFOLDER
Opcode
Start

Event ID 4203: STORE_OPENFOLDERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_OPENFOLDER
Opcode
Stop

Event ID 4204: STORE_OPENMESSAGEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_OPENMESSAGE
Opcode
Start

Event ID 4205: STORE_OPENMESSAGEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_OPENMESSAGE
Opcode
Stop

Event ID 4206: STORE_ISANCESTORStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_ISANCESTOR
Opcode
Start

Event ID 4207: STORE_ISANCESTORStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_ISANCESTOR
Opcode
Stop

Event ID 4208: STORE_CREATESPECIALFOLDERSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_CREATESPECIALFOLDERS
Opcode
Start

Event ID 4209: STORE_CREATESPECIALFOLDERSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_CREATESPECIALFOLDERS
Opcode
Stop

Event ID 4210: STORE_LOADRULESLISTStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_LOADRULESLIST
Opcode
Start

Event ID 4211: STORE_LOADRULESLISTStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_LOADRULESLIST
Opcode
Stop

Event ID 4212: STORE_RUNRULESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_RUNRULES
Opcode
Start

Event ID 4213: STORE_RUNRULESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
STORE_RUNRULES
Opcode
Stop

Event ID 4300: MAPILOGONEXStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MAPILOGONEX
Opcode
Start

Event ID 4301: MAPILOGONEXStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MAPILOGONEX
Opcode
Stop

Event ID 4302: CTX_GETSTOREMANAGERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREMANAGER
Opcode
Start

Event ID 4303: CTX_GETSTOREMANAGERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREMANAGER
Opcode
Stop

Event ID 4304: CTX_CREATESESSIONStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATESESSION
Opcode
Start

Event ID 4305: CTX_CREATESESSIONStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATESESSION
Opcode
Stop

Event ID 4306: CTX_CREATEINSTANCEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATEINSTANCE
Opcode
Start

Event ID 4307: CTX_CREATEINSTANCEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATEINSTANCE
Opcode
Stop

Event ID 4308: CTX_INITMESSAGESTORESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_INITMESSAGESTORES
Opcode
Start

Event ID 4309: CTX_INITMESSAGESTORESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_INITMESSAGESTORES
Opcode
Stop

Event ID 4310: CTX_CREATESMSSTOREStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATESMSSTORE
Opcode
Start

Event ID 4311: CTX_CREATESMSSTOREStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATESMSSTORE
Opcode
Stop

Event ID 4312: CTX_LOADDEFAULTMESSAGESTOREStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_LOADDEFAULTMESSAGESTORE
Opcode
Start

Event ID 4313: CTX_LOADDEFAULTMESSAGESTOREStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_LOADDEFAULTMESSAGESTORE
Opcode
Stop

Event ID 4314: CTX_CREATEMESSAGESTOREStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATEMESSAGESTORE
Opcode
Start

Event ID 4315: CTX_CREATEMESSAGESTOREStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_CREATEMESSAGESTORE
Opcode
Stop

Event ID 4316: CTX_OPENENTRYStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_OPENENTRY
Opcode
Start

Event ID 4317: CTX_OPENENTRYStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_OPENENTRY
Opcode
Stop

Event ID 4318: CTX_ADVISEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_ADVISE
Opcode
Start

Event ID 4319: CTX_ADVISEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_ADVISE
Opcode
Stop

Event ID 4320: CTX_UNADVISEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_UNADVISE
Opcode
Start

Event ID 4321: CTX_UNADVISEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_UNADVISE
Opcode
Stop

Event ID 4322: CTX_INITSTORESINKStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_INITSTORESINK
Opcode
Start

Event ID 4323: CTX_INITSTORESINKStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_INITSTORESINK
Opcode
Stop

Event ID 4324: CTX_GETSTOREBYIDStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREBYID
Opcode
Start

Event ID 4325: CTX_GETSTOREBYIDStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREBYID
Opcode
Stop

Event ID 4326: CTX_GETSTOREFROMDATABASEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREFROMDATABASE
Opcode
Start

Event ID 4327: CTX_GETSTOREFROMDATABASEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_GETSTOREFROMDATABASE
Opcode
Stop

Event ID 4328: CTX_OPENMSGSTOREStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_OPENMSGSTORE
Opcode
Start

Event ID 4329: CTX_OPENMSGSTOREStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_OPENMSGSTORE
Opcode
Stop

Event ID 4330: CTX_DELETEMSGSTOREStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_DELETEMSGSTORE
Opcode
Start

Event ID 4331: CTX_DELETEMSGSTOREStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_DELETEMSGSTORE
Opcode
Stop

Event ID 4332: CTX_REFRESHRULECLIENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_REFRESHRULECLIENTS
Opcode
Start

Event ID 4333: CTX_REFRESHRULECLIENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CTX_REFRESHRULECLIENTS
Opcode
Stop

Event ID 4400: MSG_CREATEATTACHStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_CREATEATTACH
Opcode
Start

Event ID 4401: MSG_CREATEATTACHStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_CREATEATTACH
Opcode
Stop

Event ID 4402: MSG_DELETEATTACHStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_DELETEATTACH
Opcode
Start

Event ID 4403: MSG_DELETEATTACHStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_DELETEATTACH
Opcode
Stop

Event ID 4404: MSG_OPENATTACHStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_OPENATTACH
Opcode
Start

Event ID 4405: MSG_OPENATTACHStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_OPENATTACH
Opcode
Stop

Event ID 4406: MSG_GETATTACHTABLEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_GETATTACHTABLE
Opcode
Start

Event ID 4407: MSG_GETATTACHTABLEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_GETATTACHTABLE
Opcode
Stop

Event ID 4408: MSG_MODIFYRECIPIENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_MODIFYRECIPIENTS
Opcode
Start

Event ID 4409: MSG_MODIFYRECIPIENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_MODIFYRECIPIENTS
Opcode
Stop

Event ID 4410: MSG_SUBMITMESSAGEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_SUBMITMESSAGE
Opcode
Start

Event ID 4411: MSG_SUBMITMESSAGEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_SUBMITMESSAGE
Opcode
Stop

Event ID 4412: MSG_DELETERECIPIENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_DELETERECIPIENTS
Opcode
Start

Event ID 4413: MSG_DELETERECIPIENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_DELETERECIPIENTS
Opcode
Stop

Event ID 4414: MSG_ADDRECIPIENTSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_ADDRECIPIENTS
Opcode
Start

Event ID 4415: MSG_ADDRECIPIENTSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_ADDRECIPIENTS
Opcode
Stop

Event ID 4416: MSG_UPDATERECIPIENTTABLEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_UPDATERECIPIENTTABLE
Opcode
Start

Event ID 4417: MSG_UPDATERECIPIENTTABLEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_UPDATERECIPIENTTABLE
Opcode
Stop

Event ID 4418: MSG_PREPROCESSWRITEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_PREPROCESSWRITE
Opcode
Start

Event ID 4419: MSG_PREPROCESSWRITEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_PREPROCESSWRITE
Opcode
Stop

Event ID 4420: MSG_POSTPROCESSWRITEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_POSTPROCESSWRITE
Opcode
Start

Event ID 4421: MSG_POSTPROCESSWRITEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
MSG_POSTPROCESSWRITE
Opcode
Stop

Event ID 4500: SETPROPSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SETPROPS
Opcode
Start

Event ID 4501: SETPROPSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SETPROPS
Opcode
Stop

Event ID 4502: GETPROPSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
GETPROPS
Opcode
Start

Event ID 4503: GETPROPSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
GETPROPS
Opcode
Stop

Event ID 4504: DELETEPROPSStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
DELETEPROPS
Opcode
Start

Event ID 4505: DELETEPROPSStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
DELETEPROPS
Opcode
Stop

Event ID 4506: OPENSTREAMPROPERTYStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
OPENSTREAMPROPERTY
Opcode
Start

Event ID 4507: OPENSTREAMPROPERTYStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
OPENSTREAMPROPERTY
Opcode
Stop

Event ID 4508: RUNRULEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
RUNRULE
Opcode
Start

Event ID 4509: RUNRULEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
RUNRULE
Opcode
Stop

Event ID 4510: SESSION_GETSTORESTABLEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SESSION_GETSTORESTABLE
Opcode
Start

Event ID 4511: SESSION_GETSTORESTABLEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SESSION_GETSTORESTABLE
Opcode
Stop

Event ID 4512: SINK_ONNOTIFYStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SINK_ONNOTIFY
Opcode
Start

Event ID 4513: SINK_ONNOTIFYStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SINK_ONNOTIFY
Opcode
Stop

Event ID 4514: SINK_ONNOTIFYWRAPPERStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SINK_ONNOTIFYWRAPPER
Opcode
Start

Event ID 4515: SINK_ONNOTIFYWRAPPERStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SINK_ONNOTIFYWRAPPER
Opcode
Stop

Event ID 4600: CONVERSATION_DELETEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_DELETE
Opcode
Start

Event ID 4601: CONVERSATION_DELETEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_DELETE
Opcode
Stop

Event ID 4602: CONVERSATION_SOFTDELETEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_SOFTDELETE
Opcode
Start

Event ID 4603: CONVERSATION_SOFTDELETEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_SOFTDELETE
Opcode
Stop

Event ID 4604: CONVERSATION_MSGPROPSETStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_MSGPROPSET
Opcode
Start

Event ID 4605: CONVERSATION_MSGPROPSETStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_MSGPROPSET
Opcode
Stop

Event ID 4606: CONVERSATION_MSGPROPDELETEStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_MSGPROPDELETE
Opcode
Start

Event ID 4607: CONVERSATION_MSGPROPDELETEStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_MSGPROPDELETE
Opcode
Stop

Event ID 4608: CONVERSATION_DELETEMESSAGESStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_DELETEMESSAGES
Opcode
Start

Event ID 4609: CONVERSATION_DELETEMESSAGESStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATION_DELETEMESSAGES
Opcode
Stop

Event ID 4610: CONVERSATIONID_SETStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATIONID_SET
Opcode
Start

Event ID 4611: CONVERSATIONID_SETStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATIONID_SET
Opcode
Stop

Event ID 4612: CONVERSATIONID_CREATEHASHStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATIONID_CREATEHASH
Opcode
Start

Event ID 4613: CONVERSATIONID_CREATEHASHStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
CONVERSATIONID_CREATEHASH
Opcode
Stop

Event ID 4700: SHARECONTENTStart

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SHARECONTENT
Opcode
Start

Event ID 4701: SHARECONTENTStop

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational
Task
SHARECONTENT
Opcode
Stop

Event ID 4800: MAPI Context is being deleted

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

MAPI Context is being deleted.

Message #

MAPI Context is being deleted

Event ID 4801: MAPI Event is lost

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

MAPI Event is lost.

Message #

MAPI Event is lost

Event ID 4802: MAPI Event data error

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

MAPI Event data error.

Message #

MAPI Event data error

Event ID 4803: Unknown prop tag seen in ConvertDatabasePropertyTagsToMapiTags: Prop_Hex_UInt32.

#
Provider
Microsoft-Windows-UserDataAccess-CEMAPI
Channel
Operational

Description

Unknown prop tag seen in ConvertDatabasePropertyTagsToMapiTags: Prop_Hex_UInt32.

Message #

Unknown prop tag seen in ConvertDatabasePropertyTagsToMapiTags: %1

Fields #

NameDescription
Prop_Hex_UInt32 UInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 83a9277a-d2fc-4b34-bf81-8ceb4407824f

Defined in cemapi.dll, which carries the event manifest.

Observed on:

  • WS2022-20348.4893 · schema read from the registered manifest · captured 2026-06-02
  • Win11-26200.6584 · schema read from the registered manifest · captured 2026-06-02

Downloads

Credits

  • Microsoft - authored the ETW manifests and PDBs the schema comes from
  • jdu2600 - the event-schema TSV format this catalog adopted
  • nasbench - the tool that dumps registered providers and manifests