Message #

%1

Fields #

Message #

%1

Fields #

Message #

%1

Fields #

Description

Api(ApiHandle) API called.

Message #

%2(%1) API called.

Fields #

Description

Api(ApiHandle) API returned successfully.

Message #

%2(%1) API returned successfully.

Fields #

Description

Api(ApiHandle) API failed with an error = Result.

Message #

%2(%1) API failed with an error = %3.

Fields #

Description

Api(ApiHandle) API pending completion.

Message #

%2(%1) API pending completion.

Fields #

Description

Api(ApiHandle) API completed.

Message #

%2(%1) API completed.

Fields #

Description

Api(ApiHandle) API completed with an error = Result.

Message #

%2(%1) API completed with an error = %3.

Fields #

Description

hRequest: WinHttpSetCredentials Details: Target (AuthTargets) Schemes (AuthScheme) UserName (UserName) Password (Password).

Message #

%1: WinHttpSetCredentials Details: Target (%2) Schemes (%3) UserName (%4) Password (%5)

Fields #

Description

Client begins attempts to locate the WPAD configuration file: ConnectionName=ConnectionName, DetectFlags=DetectFlags.

Message #

Client begins attempts to locate the WPAD configuration file: ConnectionName=%2, DetectFlags=%3

Fields #

Description

Begin search for configuration file using DHCP: Interface=Interface.

Message #

Begin search for configuration file using DHCP: Interface=%2

Fields #

Description

WPAD configuration file found using DHCP: Interface=Interface, ConfigurationURL=ConfigurationURL.

Message #

WPAD configuration file found using DHCP: Interface=%2, ConfigurationURL=%4

Fields #

Description

Search for WPAD configuration file using DHCP failed: Interface=Interface, ConfigurationURL=ConfigurationURL, Error=Error.

Message #

Search for WPAD configuration file using DHCP failed: Interface=%2, ConfigurationURL=%4, Error=%5

Fields #

Description

Begin search for configuration file using DNS: DetectFlags=DetectFlags.

Message #

Begin search for configuration file using DNS: DetectFlags=%1

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "805",
    "version": "0",
    "level": "5",
    "task": "539",
    "opcode": "1",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T23:27:43.715349300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{76fd77dd-3e3d-0001-da4f-fe037c280000}"
    },
    "execution": {
      "process_id": "10364",
      "thread_id": "2964"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DetectFlags": "       3"
  },
  "message": ""
}

Description

WPAD configuration file found using DNS: ConfigurationURL=ConfigurationURL, DetectFlags=DetectFlags.

Message #

WPAD configuration file found using DNS: ConfigurationURL=%2, DetectFlags=%3

Fields #

Description

Search for WPAD configuration file using DNS failed: DetectFlags=DetectFlags, Error=Error.

Message #

Search for WPAD configuration file using DNS failed: DetectFlags=%1, Error=%2

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "807",
    "version": "0",
    "level": "2",
    "task": "539",
    "opcode": "11",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T23:27:43.720806000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{76fd77dd-3e3d-0001-da4f-fe037c280000}"
    },
    "execution": {
      "process_id": "10364",
      "thread_id": "2964"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "DetectFlags": "       3",
    "Error": "    1168"
  },
  "message": ""
}

Description

Search for WPAD configruation file failed: Error=Error.

Message #

Search for WPAD configruation file failed: Error=%1

Fields #

Description

Begin downloading the configuration file from the configuration URL: ConfigurationURL=ConfigurationURL.

Message #

Begin downloading the configuration file from the configuration URL: ConfigurationURL=%2

Fields #

Description

Client successfully downloaded the configuration file from the configuration URL: ConfigurationURL=ConfigurationURL.

Message #

Client successfully downloaded the configuration file from the configuration URL: ConfigurationURL=%2

Fields #

Description

Downloading the configuration file from the configuration URL failed: ConfigurationURL=ConfigurationURL, Error=Error.

Message #

Downloading the configuration file from the configuration URL failed: ConfigurationURL=%2, Error=%3

Fields #

Description

The downloaded configuration file could not be used: ConfigurationURL=ConfigurationURL, MIMEType=MIMEType, Error=Error.

Message #

The downloaded configuration file could not be used: ConfigurationURL=%2, MIMEType=%4, Error=%5

Fields #

Description

Searching for Proxy Information for the URL: URL=URL.

Message #

Searching for Proxy Information for the URL: URL=%2

Fields #

Description

Client has successfully retrieved proxy data for accessing a specified resource: URL=URL, ProxyString=ProxyString.

Message #

Client has successfully retrieved proxy data for accessing a specified resource: URL=%2, ProxyString=%4

Fields #

Description

Error locating proxy information for the URL: URL=URL, Error=Error.

Message #

Error locating proxy information for the URL: URL=%2, Error=%3

Fields #

Description

Blocking autoproxy determination started.

Message #

Blocking autoproxy determination started

Description

Blocking autoproxy determination stopped.

Message #

Blocking autoproxy determination stopped

Description

WinHTTP Activity Transfer Event.

Message #

WinHTTP Activity Transfer Event

Description

AutoProxy SWPAD Decision (WPADNetworkDecision) NumConnections (NetworkCount).

Message #

AutoProxy SWPAD Decision (%1) NumConnections (%2)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "819",
    "version": "0",
    "level": "4",
    "task": "545",
    "opcode": "0",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T23:27:43.715279500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{76fd77dd-3e3b-0001-da4f-fe037c280000}"
    },
    "execution": {
      "process_id": "10364",
      "thread_id": "11368"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "WPADNetworkDecision": "0x0",
    "NetworkCount": "0x1"
  },
  "message": ""
}

Description

Autoproxy host IP lookup started.

Message #

Autoproxy host IP lookup started

Description

Autoproxy host IP lookup stopped.

Message #

Autoproxy host IP lookup stopped

Description

Autoproxy SWPAD lookup started.

Message #

Autoproxy SWPAD lookup started

Description

Autoproxy SWPAD lookup stopped.

Message #

Autoproxy SWPAD lookup stopped

Description

Autoproxy Detection with SWPAD ON started.

Message #

Autoproxy Detection with SWPAD ON started

Description

Autoproxy Detection with SWPAD ON stopped.

Message #

Autoproxy Detection with SWPAD ON stopped

Description

Autoproxy Detection with SWPAD UNKNOWN started.

Message #

Autoproxy Detection with SWPAD UNKNOWN started

Description

Autoproxy Detection with SWPAD UNKNOWN stopped.

Message #

Autoproxy Detection with SWPAD UNKNOWN stopped

Description

Autoproxy Script Download Started.

Message #

Autoproxy Script Download Started

Description

Autoproxy Script Download Stopped.

Message #

Autoproxy Script Download Stopped

Description

Autoproxy full scenario started.

Message #

Autoproxy full scenario started

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "834",
    "version": "0",
    "level": "4",
    "task": "587",
    "opcode": "1",
    "keywords": 9223653511831486496,
    "time_created": "2026-03-15T23:26:14.408939000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5d9553b0-0020-0000-9411-bc32b053955d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "UniqueId": "       2"
  },
  "message": ""
}

Description

Autoproxy full scenario stopped.

Message #

Autoproxy full scenario stopped

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "835",
    "version": "0",
    "level": "4",
    "task": "587",
    "opcode": "2",
    "keywords": 9223653511831486496,
    "time_created": "2026-03-15T23:26:14.409443400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5d9553b0-0020-0000-9411-bc32b053955d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "UniqueId": "       2"
  },
  "message": ""
}

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "1051",
    "version": "0",
    "level": "4",
    "task": "572",
    "opcode": "1",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T23:27:43.715355400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{76fd77dd-3e3d-0001-da4f-fe037c280000}"
    },
    "execution": {
      "process_id": "10364",
      "thread_id": "2964"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Flags": "0x1",
    "AddressName": "wpad"
  },
  "message": ""
}

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "1052",
    "version": "0",
    "level": "4",
    "task": "572",
    "opcode": "2",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T23:27:43.720803100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{76fd77dd-3e3d-0001-da4f-fe037c280000}"
    },
    "execution": {
      "process_id": "10364",
      "thread_id": "2964"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "error": "   11001",
    "Flags": "0x1",
    "AddressName": "wpad"
  },
  "message": ""
}

Description

The WinHttp TLS handshake failed with version mismatch error.

Message #

The WinHttp TLS handshake failed with version mismatch error

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service detected an internal data corruption.

Message #

The WinHTTP Web Proxy Auto-Discovery Service detected an internal data corruption.

Description

The WinHTTP Web Proxy Auto-Discovery Service has been idle for IdleTime minutes, it will be shut down.

Message #

The WinHTTP Web Proxy Auto-Discovery Service has been idle for %1 minutes, it will be shut down.

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service encountered a system error from Functionname: (Error Code = Errorcode) Errortext.

Message #

The WinHTTP Web Proxy Auto-Discovery Service encountered a system error from %1: (Error Code = %3) %2

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service failed to allocate a critical resource. The system may be running low on physical memory.

Message #

The WinHTTP Web Proxy Auto-Discovery Service failed to allocate a critical resource. The system may be running low on physical memory.

Message #

The WinHTTP Web Proxy Auto-Discovery Service detected a non- local RPC request (Transport Type = %1); Access Denied. There may have been an rogue attempt to gain access to the service through the network.

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service failed to abort all pending requests in param1 seconds. The system WinHTTP Services may have been under stress and slow to respond to cancel requests.

Message #

The WinHTTP Web Proxy Auto-Discovery Service failed to abort all pending requests in %1 seconds.  The system WinHTTP Services may have been under stress and slow to respond to cancel requests.

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service failed parameter validation of a client request. This may be due to an unexpected error from the system WinHTTP Services.

Message #

The WinHTTP Web Proxy Auto-Discovery Service failed parameter validation of a client request.  This may be due to an unexpected error from the system WinHTTP Services.

Description

The WinHTTP Web Proxy Auto-Discovery Service is shutting down and not accepting client requests.

Message #

The WinHTTP Web Proxy Auto-Discovery Service is shutting down and not accepting client requests.

Description

The WinHTTP Web Proxy Auto-Discovery Service detected an unexpected exception from the system WinHTTP Services. (Exception Code = Exceptioncode).

Message #

The WinHTTP Web Proxy Auto-Discovery Service detected an unexpected exception from the system WinHTTP Services. (Exception Code = %1)

Fields #

Description

The WinHTTP Web Proxy Auto-Discovery Service discarded and is re-attempting a request after a critical power event.

Message #

The WinHTTP Web Proxy Auto-Discovery Service discarded and is re-attempting a request after a critical power event.

Description

The WinHTTP Web Proxy Auto-Discovery Service suspended operation.

Message #

The WinHTTP Web Proxy Auto-Discovery Service suspended operation.

Description

The WinHTTP Web Proxy Auto-Discovery Service resumed operation.

Message #

The WinHTTP Web Proxy Auto-Discovery Service resumed operation.

Message #

%1

Fields #

Description

Canceling EtwQueueActionType Thread Action (Context: Context).

Message #

Canceling %2 Thread Action (Context: %1)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "59995",
    "version": "0",
    "level": "5",
    "task": "110",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:26:14.409411900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5ddbd0e0-0025-0000-9411-bc32e0d0db5d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x1CE5DDCBB20",
    "EtwQueueActionType": "       1"
  },
  "message": ""
}

Description

Queue EtwQueueActionType Thread Action (Context: Context).

Message #

Queue %2 Thread Action (Context: %1)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "59996",
    "version": "0",
    "level": "5",
    "task": "110",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:26:14.406370000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5d9557c0-0013-0000-9411-b828c057955d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x1CE5DE08C00",
    "EtwQueueActionType": "       2"
  },
  "message": ""
}

Description

Stopping EtwQueueActionType Thread Action (Context: Context).

Message #

Stopping %2 Thread Action (Context: %1)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "59997",
    "version": "0",
    "level": "5",
    "task": "110",
    "opcode": "2",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:26:14.406532000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5d9557c0-0013-0000-9411-b828c057955d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x1CE5DE08C00",
    "EtwQueueActionType": "       2"
  },
  "message": ""
}

Description

Starting EtwQueueActionType Thread Action (Context: Context).

Message #

Starting %2 Thread Action (Context: %1)

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-WinHttp",
    "guid": "{7d44233d-3055-4b9c-ba64-0d47ca40a232}",
    "event_source_name": "",
    "event_id": "59998",
    "version": "0",
    "level": "5",
    "task": "110",
    "opcode": "1",
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:26:14.406401200+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{5d9557c0-0013-0000-9411-b828c057955d}"
    },
    "execution": {
      "process_id": "4500",
      "thread_id": "12988"
    },
    "channel": "Microsoft-Windows-WinHttp/Diagnostic",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Context": "0x1CE5DE08C00",
    "EtwQueueActionType": "       2"
  },
  "message": ""
}

Message #

(%1:%2) %4

Fields #