Microsoft-Client-Licensing-Platform

Event	Title	Channel	Sample	Rule
1	[Service] Inititialize started	Diagnostic	N	N
2	[Service] Initialize complete	Diagnostic	N	N
3	[Service] Shutdown started	Diagnostic	N	N
4	[Service] Shutdown complete	Diagnostic	N	N
7	[ServiceCall] IFS	Diagnostic	N	N
8	[ServiceCall] IFD	Diagnostic	N	N
9	[ServiceCall] IFS	Diagnostic	N	N
10	[ServiceCall] IFD	Diagnostic	N	N
11	[ServiceCall] IFS	Diagnostic	N	N
12	[ServiceCall] IFD	Diagnostic	N	N
13	[ServiceCall] IFS	Diagnostic	N	N
14	[ServiceCall] IFD	Diagnostic	N	N
15	[ServiceCall] IFS	Diagnostic	N	N
16	[ServiceCall] IFD	Diagnostic	N	N
17	[ServiceCall] IFS	Diagnostic	N	N
18	[ServiceCall] IFD	Diagnostic	N	N
19	[ServiceCall] Execute start for id: ID.	Diagnostic	N	N
20	[ServiceCall] Execute done for id: ID.	Diagnostic	N	N
100	ClipSVC service is starting.	Admin	Y	N
101	ClipSVC service is running.	Admin	Y	N
102	ClipSVC service has shutdown.	Admin	Y	N
103	ClipSVC service initialization failed - result code: HRESULT.	Admin	N	N
104	ClipSVC was restarted while there is a pending rearm reboot required.	Admin	Y	N
106	License successfully uninstalled for package PackageName (user UserId), license …	Admin	N	N
107	License successfully uninstalled for file Id Data.	Admin	N	N
110	License install failed for license type: Type.	Admin	Y	N
111	License install failed for license Id Type.	Admin	N	N
112	License install storage failed for license Id Type.	Admin	N	N
113	License refresh failed for license Id Type.	Admin	N	N
114	Unable to remove matching ClipSp data for license Id Type.	Admin	N	N
115	License successfully installed for package PackageName.	Admin	Y	N
116	Application license successfully installed.	Admin	Y	N
117	Lease successfully installed.	Admin	Y	N
118	Device license successfully installed.	Admin	Y	N
119	UnlockToken install succeeded for license Id Type.	Admin	N	N
120	UnlockToken install failed for license Id Type.	Admin	N	N
121	Operation opId failed invoked from Caller failed because a reboot is required …	Admin	N	N
150	Clip service has been rearmed.	Admin	Y	N
151	Failed to launch app Data since no applicable licenses were found.	Admin	N	N
152	The hardware ID in the device license is out of tolerance with the device ID	Admin	N	N
153	The hardware ID in the device license changed but still with in tolerance with …	Admin	N	N
154	The device license was updated with a different device ID	Admin	Y	N
155	The device license was removed	Admin	N	N
156	The required device license could not not be found	Admin	N	N
157	The license with Id LicenseId has been archived successfully.	Admin	Y	N
158	The license with Id Error_code was not able to be archived successfully.	Admin	N	N
159	The lease with Id LicenseId has been archived successfully.	Admin	Y	N
160	The license with Id LicenseId of type Type has been archived successfully.	Admin	Y	N
161	Edition ID Edition with product key PKey attempt to activate return code …	Admin	N	N
170	A license was loaded from EFI and installed.	Admin	N	N
171	A license was loaded from EFI but failed to install.	Admin	N	N
172	ClipUp run from Clip service with arguments 'Arguments'.	Admin	Y	N
173	Product key from MSDM table redeemed.	Admin	N	N
174	Product key from MSDM table installed.	Admin	N	N
175	Internal Troubleshooting started.	Admin	Y	N
176	Internal Troubleshooting ended.	Admin	Y	N
177	Internal WCOS Troubleshooting started.	Admin	N	N
178	Internal WCOS Troubleshooting ended.	Admin	N	N
179	FCLiP Task Operation has been done.	Admin	N	N
180	Windows Subscription: State: State Msg: Msg.	Admin	N	N
181	Windows Subscription: State: State, Result: HRESULT Msg: Msg.	Admin	N	N

Event ID 1: [Service] Inititialize started

Channel: Diagnostic
Task: Service_Init
Opcode: Start

Event ID 2: [Service] Initialize complete

Channel: Diagnostic
Task: Service_Init
Opcode: Stop

Event ID 3: [Service] Shutdown started

Channel: Diagnostic
Task: Service_Stop
Opcode: Start

Event ID 4: [Service] Shutdown complete

Channel: Diagnostic
Task: Service_Stop
Opcode: Stop

Event ID 7: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 8: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 9: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 10: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 11: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 12: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 13: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 14: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 15: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 16: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 17: [ServiceCall] IFS

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Event ID 18: [ServiceCall] IFD

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Event ID 19: [ServiceCall] Execute start for id: ID.

Channel: Diagnostic
Task: Service_Call
Opcode: Start

Message #

[ServiceCall] Execute start for id: %1

Fields #

Name	Description
`ID` Int32

Event ID 20: [ServiceCall] Execute done for id: ID.

Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Message #

[ServiceCall] Execute done for id: %1

Fields #

Name	Description
`ID` Int32

Event ID 100: ClipSVC service is starting.

Channel: Admin
Level: Informational

Description

ClipSVC service is starting. Caller: Data.

Message #

ClipSVC service is starting.  Caller: %1

Fields #

Name	Description
`Data` UnicodeString	ClipSVC service is starting. Caller.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:45:50.3366511+00:00",
    "event_record_id": 80,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 6336
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": "<none>"
  },
  "message": "ClipSVC service is starting.  Caller: <none>"
}

Event ID 101: ClipSVC service is running.

Channel: Admin
Level: Informational

Description

ClipSVC service is running. Version Data.

Message #

ClipSVC service is running.  Version %1

Fields #

Name	Description
`Data` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:45:50.3394489+00:00",
    "event_record_id": 81,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 8156
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": "10.0.20348.143"
  },
  "message": "ClipSVC service is running.  Version 10.0.20348.143"
}

Event ID 102: ClipSVC service has shutdown.

Channel: Admin
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:50:50.4244165+00:00",
    "event_record_id": 82,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 6412
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "ClipSVC service has shutdown."
}

Event ID 103: ClipSVC service initialization failed - result code: HRESULT.

Channel: Admin

Message #

ClipSVC service initialization failed - result code: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 104: ClipSVC was restarted while there is a pending rearm reboot required.

Channel: Admin
Level: Warning

Description

ClipSVC was restarted while there is a pending rearm reboot required. Caller: Data.

Message #

ClipSVC was restarted while there is a pending rearm reboot required.  Caller: %1

Fields #

Name	Description
`Data` UnicodeString	ClipSVC was restarted while there is a pending rearm reboot required. Caller.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:55:37.954464+00:00",
    "event_record_id": 258,
    "correlation": {},
    "execution": {
      "process_id": 2244,
      "thread_id": 2312
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "Data",
      "Value": "TriggerStarted"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 106: License successfully uninstalled for package PackageName (user UserId), license Id LicenseId, file Id AssociateId.

Channel: Admin

Message #

License successfully uninstalled for package %1 (user %2), license Id %3, file Id %4

Fields #

Name	Description
`PackageName` UnicodeString
`UserId` UnicodeString
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Event ID 107: License successfully uninstalled for file Id Data.

Channel: Admin

Message #

License successfully uninstalled for file Id %1

Fields #

Name	Description
`Data` UnicodeString

Event ID 110: License install failed for license type: Type.

Channel: Admin
Level: Error

Message #

License install failed for license type: %1
Result code: %2

Fields #

Name	Description
`Type` Int32	License install failed for license type.
`HRESULT` UInt32	Result code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.172221+00:00",
    "event_record_id": 338,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Type": "\u0001",
    "HRESULT": 3225380353
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 111: License install failed for license Id Type.

Channel: Admin

Message #

License install failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 112: License install storage failed for license Id Type.

Channel: Admin

Message #

License install storage failed for license Id %1
Type: %2
Package (if available): %3
User Id(if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 113: License refresh failed for license Id Type.

Channel: Admin

Message #

License refresh failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 114: Unable to remove matching ClipSp data for license Id Type.

Channel: Admin

Message #

Unable to remove matching ClipSp data for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 115: License successfully installed for package PackageName.

Channel: Admin
Level: Informational

Message #

License successfully installed for package %1.
User Id (if available): %2
Type: %3
License Id: %4
Associate Id: %5

Fields #

Name	Description
`PackageName` UnicodeString
`UserId` UnicodeString	User Id (if available).
`Type` Int32
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:33.878784+00:00",
    "event_record_id": 264,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "",
    "UserId": "",
    "Type": "\u0005",
    "LicenseId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8",
    "AssociateId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 116: Application license successfully installed.

Channel: Admin
Level: Informational

Message #

Application license successfully installed.
Package: %1
User Id (if available): %2
License Id: %3
Associate Id: %4

Fields #

Name	Description
`PackageName` UnicodeString	Package.
`UserId` UnicodeString	User Id (if available).
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.164301+00:00",
    "event_record_id": 335,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "clipchamp.clipchamp_yxz26nhyzhsrt",
    "UserId": "NULL",
    "LicenseId": "ad2bdefa-5e7a-790f-d172-edfe3fd8a9e4",
    "AssociateId": "ad2bdefa-5e7a-790f-d172-edfe3fd8a9e4"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 117: Lease successfully installed.

Channel: Admin
Level: Informational

Message #

Lease successfully installed.
License Id: %3
Associate Id: %4
Package (if available): %1
UserId (if available): %2

Fields #

Name	Description
`PackageName` UnicodeString	Package (if available).
`UserId` UnicodeString	UserId (if available).
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.170998+00:00",
    "event_record_id": 337,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "Microsoft.GamingApp_8wekyb3d8bbwe",
    "UserId": "NULL",
    "LicenseId": "b0d13c54-788d-a8a1-6380-3468517deff1",
    "AssociateId": "b0d13c54-788d-a8a1-6380-3468517deff1"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 118: Device license successfully installed.

Channel: Admin
Level: Informational

Message #

Device license successfully installed.
License Id: %1
Associate Id: %2
Device Id: %3

Fields #

Name	Description
`LicenseId` UnicodeString
`AssociateId` UnicodeString
`DeviceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:02:00.371331+00:00",
    "event_record_id": 239,
    "correlation": {},
    "execution": {
      "process_id": 6564,
      "thread_id": 6612
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "LicenseId": "3252b20c-d425-4711-8cc5-b2f53c830b76",
    "AssociateId": "3252b20c-d425-4711-8cc5-b2f53c830b76",
    "DeviceId": "76629F140D001800"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 119: UnlockToken install succeeded for license Id Type.

Channel: Admin

Message #

UnlockToken install succeeded for license Id %1
Type: %2

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32

Event ID 120: UnlockToken install failed for license Id Type.

Channel: Admin

Message #

UnlockToken install failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 121: Operation opId failed invoked from Caller failed because a reboot is required post rearm.

Channel: Admin

Message #

Operation %1 failed invoked from %2 failed because a reboot is required post rearm

Fields #

Name	Description
`opId` UInt32
`Caller` UnicodeString

Event ID 150: Clip service has been rearmed.

Channel: Admin
Level: Informational

Description

Clip service has been rearmed. Result code: Data.

Message #

Clip service has been rearmed.  Result code: %1

Fields #

Name	Description
`HRESULT`

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 150,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:55:37.878222+00:00",
    "event_record_id": 255,
    "correlation": {},
    "execution": {
      "process_id": 2684,
      "thread_id": 1968
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "HRESULT",
      "Value": 0
    }
  },
  "message": ""
}

Example keys not documented in the fields table: Data

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 151: Failed to launch app Data since no applicable licenses were found.

Channel: Admin

Message #

Failed to launch app %1 since no applicable licenses were found

Fields #

Name	Description
`Data` UnicodeString

Event ID 152: The hardware ID in the device license is out of tolerance with the device ID

Channel: Admin

Event ID 153: The hardware ID in the device license changed but still with in tolerance with the device hardware ID

Channel: Admin

Event ID 154: The device license was updated with a different device ID

Channel: Admin
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 154,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:02:00.368186+00:00",
    "event_record_id": 238,
    "correlation": {},
    "execution": {
      "process_id": 6564,
      "thread_id": 6608
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 155: The device license was removed

Channel: Admin

Event ID 156: The required device license could not not be found

Channel: Admin

Event ID 157: The license with Id LicenseId has been archived successfully.

Channel: Admin
Level: Informational

Description

The license with Id LicenseId has been archived successfully. PFM if available: PackageName.

Message #

The license with Id %2 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	2 has been archived successfully. PFM if available.
`LicenseId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 157,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-26T04:17:18.373826+00:00",
    "event_record_id": 69,
    "correlation": {},
    "execution": {
      "process_id": 1572,
      "thread_id": 1708
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "microsoftwindows.client.webexperience_cw5n1h2txyewy",
    "LicenseId": "be0b63a6-5394-dcb0-7bc2-5187af85ce67"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 158: The license with Id Error_code was not able to be archived successfully.

Channel: Admin

Message #

The license with Id %2 was not able to be archived successfully.
Error code: %3
PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString
`LicenseId` UnicodeString
`HRESULT` UInt32

Event ID 159: The lease with Id LicenseId has been archived successfully.

Channel: Admin
Level: Informational

Description

The lease with Id LicenseId has been archived successfully. PFM if available: PackageName.

Message #

The lease with Id %2 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	2 has been archived successfully. PFM if available.
`LicenseId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 159,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:55:25.745666+00:00",
    "event_record_id": 230,
    "correlation": {},
    "execution": {
      "process_id": 1260,
      "thread_id": 1044
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc",
    "LicenseId": "ff4afb58-6577-9ca4-df1c-6f066e1cf960"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 160: The license with Id LicenseId of type Type has been archived successfully.

Channel: Admin
Level: Informational

Description

The license with Id LicenseId of type Type has been archived successfully. PFM if available: PackageName.

Message #

The license with Id %2 of type %3 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	3 has been archived successfully. PFM if available.
`LicenseId` UnicodeString
`Type` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 160,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:22:59.176197+00:00",
    "event_record_id": 74,
    "correlation": {},
    "execution": {
      "process_id": 1852,
      "thread_id": 2020
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "",
    "LicenseId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8",
    "Type": "\u0005"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 161: Edition ID Edition with product key PKey attempt to activate return code HRESULT.

Channel: Admin

Message #

Edition ID %1 with product key %2 attempt to activate return code %3

Fields #

Name	Description
`Edition` Int32
`PKey` UnicodeString
`HRESULT` UInt32

Event ID 170: A license was loaded from EFI and installed.

Channel: Admin

Description

A license was loaded from EFI and installed. EFI namespace Associate_Id, path Namespace.

Message #

A license was loaded from EFI and installed.  EFI namespace %1, path %2
Associate Id: %3

Fields #

Name	Description
`Namespace` UnicodeString
`VariableName` UnicodeString
`AssociateId` UnicodeString

Event ID 171: A license was loaded from EFI but failed to install.

Channel: Admin

Description

A license was loaded from EFI but failed to install. EFI namespace Error_code, path Namespace.

Message #

A license was loaded from EFI but failed to install.  EFI namespace %1, path %2
Error code: %3

Fields #

Name	Description
`Namespace` UnicodeString
`VariableName` UnicodeString
`HRESULT` UInt32

Event ID 172: ClipUp run from Clip service with arguments 'Arguments'.

Channel: Admin
Level: Informational

Description

ClipUp run from Clip service with arguments 'Arguments'. Result: HRESULT.

Message #

ClipUp run from Clip service with arguments '%1'. Result: %2

Fields #

Name	Description
`Arguments` UnicodeString
`HRESULT` UInt32	1'. Result.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 172,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:40:47.121035+00:00",
    "event_record_id": 223,
    "correlation": {},
    "execution": {
      "process_id": 5600,
      "thread_id": 5656
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Arguments": "-p -pfm CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc",
    "HRESULT": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 173: Product key from MSDM table redeemed.

Channel: Admin

Description

Product key from MSDM table redeemed. Result: HRESULT.

Message #

Product key from MSDM table redeemed. Result: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 174: Product key from MSDM table installed.

Channel: Admin

Description

Product key from MSDM table installed. Result: HRESULT.

Message #

Product key from MSDM table installed. Result: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 175: Internal Troubleshooting started.

Channel: Admin
Level: Informational

Description

Internal Troubleshooting started. System Time: Data.

Message #

Internal Troubleshooting started. System Time: %1

Fields #

Name	Description
`Data` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "b6cc0d55-9ecc-49a8-b929-2b9022426f2a",
    "event_source_name": "",
    "event_id": 175,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-07-04T03:38:46.0478648+00:00",
    "event_record_id": 861,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 14864,
      "thread_id": 14768
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": "2026-07-04T03:38:46Z"
  },
  "message": "Internal Troubleshooting started. System Time: 2026-07-04T03:38:46Z"
}

Event ID 176: Internal Troubleshooting ended.

Channel: Admin
Level: Informational

Description

Internal Troubleshooting ended. System Time: SystemTime, Diagnosis_Kind: Kind, Result: HRESULT, Stage: Stage.

Message #

Internal Troubleshooting ended. System Time: %1, Diagnosis_Kind: %2, Result: %3, Stage: %4

Fields #

Name	Description
`SystemTime` UnicodeString
`Kind` Int32
`HRESULT` UInt32
`Stage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "b6cc0d55-9ecc-49a8-b929-2b9022426f2a",
    "event_source_name": "",
    "event_id": 176,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-07-04T03:38:49.4639156+00:00",
    "event_record_id": 862,
    "correlation": {
      "ActivityID": "",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 14864,
      "thread_id": 14768
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "SystemTime": "2026-07-04T03:38:49Z",
    "Kind": "2",
    "HRESULT": "0",
    "Stage": "Invoke_Troubleshooter"
  },
  "message": "Internal Troubleshooting ended. System Time: 2026-07-04T03:38:49Z, Diagnosis_Kind: 2, Result: 0x0, Stage: Invoke_Troubleshooter"
}

Event ID 177: Internal WCOS Troubleshooting started.

Channel: Admin

Description

Internal WCOS Troubleshooting started. System Time: Data.

Message #

Internal WCOS Troubleshooting started. System Time: %1

Fields #

Name	Description
`Data` UnicodeString

Event ID 178: Internal WCOS Troubleshooting ended.

Channel: Admin

Description

Internal WCOS Troubleshooting ended. System Time: SystemTime, Result: HRESULT, Stage: Stage.

Message #

Internal WCOS Troubleshooting ended. System Time: %1, Result: %2, Stage: %3

Fields #

Name	Description
`SystemTime` UnicodeString
`HRESULT` UInt32
`Stage` UnicodeString

Event ID 179: FCLiP Task Operation has been done.

Channel: Admin

Description

FCLiP Task Operation has been done. Result: HRESULT, Operation: Stage.

Message #

FCLiP Task Operation has been done. Result: %1, Operation: %2

Fields #

Name	Description
`HRESULT` UInt32
`Stage` UnicodeString

Event ID 180: Windows Subscription: State: State Msg: Msg.

Channel: Admin

Message #

Windows Subscription: State: %1 Msg: %2

Fields #

Name	Description
`State` UnicodeString
`Msg` UnicodeString

Event ID 181: Windows Subscription: State: State, Result: HRESULT Msg: Msg.

Channel: Admin

Message #

Windows Subscription: State: %1, Result: %2 Msg: %3

Fields #

Name	Description
`State` UnicodeString
`HRESULT` UInt32
`Msg` UnicodeString

Provenance

ETW provider GUID b6cc0d55-9ecc-49a8-b929-2b9022426f2a

Defined in ClipSvc.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB