detection.wiki

Microsoft-Client-License-Flexible-Platform

EventTitleChannelSampleRule
100FClip exited at stage stage with result HRESULT.AdminNN
101FClip invocation of SPP exited at stage stage with result HRESULT.AdminNN
102Task has been scheduled with interval of interval seconds with result HRESULT.AdminNN
103User notification completed with codes HRESULT and HR2: Number of sessions …AdminNN

Event ID 100: FClip exited at stage stage with result HRESULT.

#
Channel
Admin

Message #

FClip exited at stage %1 with result %2

Fields #

NameDescription
stage UnicodeString
HRESULT UInt32

Event ID 101: FClip invocation of SPP exited at stage stage with result HRESULT.

#
Channel
Admin

Message #

FClip invocation of SPP exited at stage %1 with result %2

Fields #

NameDescription
stage UnicodeString
HRESULT UInt32

Event ID 102: Task has been scheduled with interval of interval seconds with result HRESULT.

#
Channel
Admin

Message #

Task has been scheduled with interval of %1 seconds with result %2

Fields #

NameDescription
interval UInt32
HRESULT UInt32

Event ID 103: User notification completed with codes HRESULT and HR2: Number of sessions SessionCount.

#
Channel
Admin

Message #

User notification completed with codes %1 and %2: Number of sessions %3

Fields #

NameDescription
HRESULT UInt32
HR2 UInt32
SessionCount UInt32

Provenance

ETW provider GUID 6e0df32c-7f11-54f7-e8ee-5ad4032727ce

Defined in fclip.exe, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB