detection.wiki

Microsoft-Windows-WinREAgent

5 events across 1 channel

Event IDTitleChannel
4500Starting Windows Recovery Environment servicing.System
4501Servicing succeeded.System
4502Windows Recovery Environment servicing failed.System
4503Windows Recovery Environment servicing cancelled.System
4504Changes to Windows Recovery Environment have been rolled back.System

Event ID 4500 — Starting Windows Recovery Environment servicing.

Provider
Microsoft-Windows-WinREAgent
Channel
System

Description

Starting Windows Recovery Environment servicing.

Message #

Starting Windows Recovery Environment servicing.

Event ID 4501 — Servicing succeeded.

Provider
Microsoft-Windows-WinREAgent
Channel
System

Description

Servicing succeeded. The Windows Recovery Environment version is now: Version.

Message #

Servicing succeeded. The Windows Recovery Environment version is now: %1

Fields #

NameDescription
Version UnicodeString—

Event ID 4502 — Windows Recovery Environment servicing failed.

Provider
Microsoft-Windows-WinREAgent
Channel
System

Description

Windows Recovery Environment servicing failed.

Message #

Windows Recovery Environment servicing failed.

Fields #

NameDescription
ErrorPhase Int32—
Errorcode Int32—

Event ID 4503 — Windows Recovery Environment servicing cancelled.

Provider
Microsoft-Windows-WinREAgent
Channel
System

Description

Windows Recovery Environment servicing cancelled.

Message #

Windows Recovery Environment servicing cancelled.

Event ID 4504 — Changes to Windows Recovery Environment have been rolled back.

Provider
Microsoft-Windows-WinREAgent
Channel
System

Description

Changes to Windows Recovery Environment have been rolled back.

Message #

Changes to Windows Recovery Environment have been rolled back.