Microsoft-Client-Licensing-Platform

61 events across 2 channels

Event	Title	Channel	Sample
1	[Service] Inititialize started	Diagnostic	N
2	[Service] Initialize complete	Diagnostic	N
3	[Service] Shutdown started	Diagnostic	N
4	[Service] Shutdown complete	Diagnostic	N
7	[ServiceCall] IFS	Diagnostic	N
8	[ServiceCall] IFD	Diagnostic	N
9	[ServiceCall] IFS	Diagnostic	N
10	[ServiceCall] IFD	Diagnostic	N
11	[ServiceCall] IFS	Diagnostic	N
12	[ServiceCall] IFD	Diagnostic	N
13	[ServiceCall] IFS	Diagnostic	N
14	[ServiceCall] IFD	Diagnostic	N
15	[ServiceCall] IFS	Diagnostic	N
16	[ServiceCall] IFD	Diagnostic	N
17	[ServiceCall] IFS	Diagnostic	N
18	[ServiceCall] IFD	Diagnostic	N
19	[ServiceCall] Execute start for id: ID.	Diagnostic	N
20	[ServiceCall] Execute done for id: ID.	Diagnostic	N
100	ClipSVC service is starting.	Admin	Y
101	ClipSVC service is running.	Admin	Y
102	ClipSVC service has shutdown.	Admin	Y
103	ClipSVC service initialization failed - result code: HRESULT.	Admin	N
104	ClipSVC was restarted while there is a pending rearm reboot required.	Admin	Y
106	License successfully uninstalled for package PackageName (user UserId), license …	Admin	N
107	License successfully uninstalled for file Id Data.	Admin	N
110	License install failed for license type: Type.	Admin	Y
111	License install failed for license Id Type.	Admin	N
112	License install storage failed for license Id Type.	Admin	N
113	License refresh failed for license Id Type.	Admin	N
114	Unable to remove matching ClipSp data for license Id Type.	Admin	N
115	License successfully installed for package PackageName.	Admin	Y
116	Application license successfully installed.	Admin	Y
117	Lease successfully installed.	Admin	Y
118	Device license successfully installed.	Admin	Y
119	UnlockToken install succeeded for license Id Type.	Admin	N
120	UnlockToken install failed for license Id Type.	Admin	N
121	Operation opId failed invoked from Caller failed because a reboot is required …	Admin	N
150	Clip service has been rearmed.	Admin	Y
151	Failed to launch app Data since no applicable licenses were found.	Admin	N
152	The hardware ID in the device license is out of tolerance with the device ID	Admin	N
153	The hardware ID in the device license changed but still with in tolerance with …	Admin	N
154	The device license was updated with a different device ID	Admin	Y
155	The device license was removed	Admin	N
156	The required device license could not not be found	Admin	N
157	The license with Id LicenseId has been archived successfully.	Admin	Y
158	The license with Id Error_code was not able to be archived successfully.	Admin	N
159	The lease with Id LicenseId has been archived successfully.	Admin	Y
160	The license with Id LicenseId of type Type has been archived successfully.	Admin	Y
161	Edition ID Edition with product key PKey attempt to activate return code …	Admin	N
170	A license was loaded from EFI and installed.	Admin	N
171	A license was loaded from EFI but failed to install.	Admin	N
172	ClipUp run from Clip service with arguments 'Arguments'.	Admin	Y
173	Product key from MSDM table redeemed.	Admin	N
174	Product key from MSDM table installed.	Admin	N
175	Internal Troubleshooting started.	Admin	N
176	Internal Troubleshooting ended.	Admin	N
177	Internal WCOS Troubleshooting started.	Admin	N
178	Internal WCOS Troubleshooting ended.	Admin	N
179	FCLiP Task Operation has been done.	Admin	N
180	Windows Subscription: State: State Msg: Msg.	Admin	N
181	Windows Subscription: State: State, Result: HRESULT Msg: Msg.	Admin	N

Event ID 1: [Service] Inititialize started

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Init
Opcode: Start

Description

[Service] Inititialize started.

Message #

[Service] Inititialize started

Event ID 2: [Service] Initialize complete

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Init
Opcode: Stop

Description

[Service] Initialize complete.

Message #

[Service] Initialize complete

Event ID 3: [Service] Shutdown started

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Stop
Opcode: Start

Description

[Service] Shutdown started.

Message #

[Service] Shutdown started

Event ID 4: [Service] Shutdown complete

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Stop
Opcode: Stop

Description

[Service] Shutdown complete.

Message #

[Service] Shutdown complete

Event ID 7: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 8: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 9: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 10: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 11: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 12: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 13: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 14: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 15: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 16: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 17: [ServiceCall] IFS

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] IFS.

Message #

[ServiceCall] IFS

Event ID 18: [ServiceCall] IFD

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] IFD.

Message #

[ServiceCall] IFD

Event ID 19: [ServiceCall] Execute start for id: ID.

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Start

Description

[ServiceCall] Execute start for id: ID.

Message #

[ServiceCall] Execute start for id: %1

Fields #

Name	Description
`ID` Int32

Event ID 20: [ServiceCall] Execute done for id: ID.

Provider: Microsoft-Client-Licensing-Platform
Channel: Diagnostic
Task: Service_Call
Opcode: Stop

Description

[ServiceCall] Execute done for id: ID.

Message #

[ServiceCall] Execute done for id: %1

Fields #

Name	Description
`ID` Int32

Event ID 100: ClipSVC service is starting.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

ClipSVC service is starting. Caller: Data.

Message #

ClipSVC service is starting.  Caller: %1

Fields #

Name	Description
`Data` UnicodeString	ClipSVC service is starting. Caller.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:45:50.3366511+00:00",
    "event_record_id": 80,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 6336
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": "<none>"
  },
  "message": "ClipSVC service is starting.  Caller: <none>"
}

Event ID 101: ClipSVC service is running.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

ClipSVC service is running. Version Data.

Message #

ClipSVC service is running.  Version %1

Fields #

Name	Description
`Data` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:45:50.3394489+00:00",
    "event_record_id": 81,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 8156
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": "10.0.20348.143"
  },
  "message": "ClipSVC service is running.  Version 10.0.20348.143"
}

Event ID 102: ClipSVC service has shutdown.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

ClipSVC service has shutdown.

Message #

ClipSVC service has shutdown.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "{B6CC0D55-9ECC-49A8-B929-2B9022426F2A}",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2026-06-13T05:50:50.4244165+00:00",
    "event_record_id": 82,
    "correlation": {},
    "execution": {
      "process_id": 7200,
      "thread_id": 6412
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "ClipSVC service has shutdown."
}

Event ID 103: ClipSVC service initialization failed - result code: HRESULT.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

ClipSVC service initialization failed - result code: HRESULT.

Message #

ClipSVC service initialization failed - result code: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 104: ClipSVC was restarted while there is a pending rearm reboot required.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Warning

Description

ClipSVC was restarted while there is a pending rearm reboot required. Caller: Data.

Message #

ClipSVC was restarted while there is a pending rearm reboot required.  Caller: %1

Fields #

Name	Description
`Data` UnicodeString	ClipSVC was restarted while there is a pending rearm reboot required. Caller.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:55:37.954464+00:00",
    "event_record_id": 258,
    "correlation": {},
    "execution": {
      "process_id": 2244,
      "thread_id": 2312
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "Data",
      "Value": "TriggerStarted"
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 106: License successfully uninstalled for package PackageName (user UserId), license Id LicenseId, file Id AssociateId.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

License successfully uninstalled for package PackageName (user UserId), license Id LicenseId, file Id AssociateId.

Message #

License successfully uninstalled for package %1 (user %2), license Id %3, file Id %4

Fields #

Name	Description
`PackageName` UnicodeString
`UserId` UnicodeString
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Event ID 107: License successfully uninstalled for file Id Data.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

License successfully uninstalled for file Id Data.

Message #

License successfully uninstalled for file Id %1

Fields #

Name	Description
`Data` UnicodeString

Event ID 110: License install failed for license type: Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Error

Description

License install failed for license type: Type.

Message #

License install failed for license type: %1
Result code: %2

Fields #

Name	Description
`Type` Int32	License install failed for license type.
`HRESULT` UInt32	Result code.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.172221+00:00",
    "event_record_id": 338,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Type": "\u0001",
    "HRESULT": 3225380353
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 111: License install failed for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

License install failed for license Id Type.

Message #

License install failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 112: License install storage failed for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

License install storage failed for license Id Type.

Message #

License install storage failed for license Id %1
Type: %2
Package (if available): %3
User Id(if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 113: License refresh failed for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

License refresh failed for license Id Type.

Message #

License refresh failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 114: Unable to remove matching ClipSp data for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Unable to remove matching ClipSp data for license Id Type.

Message #

Unable to remove matching ClipSp data for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 115: License successfully installed for package PackageName.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

License successfully installed for package PackageName.

Message #

License successfully installed for package %1.
User Id (if available): %2
Type: %3
License Id: %4
Associate Id: %5

Fields #

Name	Description
`PackageName` UnicodeString
`UserId` UnicodeString	User Id (if available).
`Type` Int32
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:33.878784+00:00",
    "event_record_id": 264,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "",
    "UserId": "",
    "Type": "\u0005",
    "LicenseId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8",
    "AssociateId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 116: Application license successfully installed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

Application license successfully installed.

Message #

Application license successfully installed.
Package: %1
User Id (if available): %2
License Id: %3
Associate Id: %4

Fields #

Name	Description
`PackageName` UnicodeString	Package.
`UserId` UnicodeString	User Id (if available).
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.164301+00:00",
    "event_record_id": 335,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "clipchamp.clipchamp_yxz26nhyzhsrt",
    "UserId": "NULL",
    "LicenseId": "ad2bdefa-5e7a-790f-d172-edfe3fd8a9e4",
    "AssociateId": "ad2bdefa-5e7a-790f-d172-edfe3fd8a9e4"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 117: Lease successfully installed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

Lease successfully installed.

Message #

Lease successfully installed.
License Id: %3
Associate Id: %4
Package (if available): %1
UserId (if available): %2

Fields #

Name	Description
`PackageName` UnicodeString	Package (if available).
`UserId` UnicodeString	UserId (if available).
`LicenseId` UnicodeString
`AssociateId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 117,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-11-06T06:22:34.170998+00:00",
    "event_record_id": 337,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 1868
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "Microsoft.GamingApp_8wekyb3d8bbwe",
    "UserId": "NULL",
    "LicenseId": "b0d13c54-788d-a8a1-6380-3468517deff1",
    "AssociateId": "b0d13c54-788d-a8a1-6380-3468517deff1"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 118: Device license successfully installed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

Device license successfully installed.

Message #

Device license successfully installed.
License Id: %1
Associate Id: %2
Device Id: %3

Fields #

Name	Description
`LicenseId` UnicodeString
`AssociateId` UnicodeString
`DeviceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:02:00.371331+00:00",
    "event_record_id": 239,
    "correlation": {},
    "execution": {
      "process_id": 6564,
      "thread_id": 6612
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "LicenseId": "3252b20c-d425-4711-8cc5-b2f53c830b76",
    "AssociateId": "3252b20c-d425-4711-8cc5-b2f53c830b76",
    "DeviceId": "76629F140D001800"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 119: UnlockToken install succeeded for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

UnlockToken install succeeded for license Id Type.

Message #

UnlockToken install succeeded for license Id %1
Type: %2

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32

Event ID 120: UnlockToken install failed for license Id Type.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

UnlockToken install failed for license Id Type.

Message #

UnlockToken install failed for license Id %1
Type: %2
Package (if available): %3
User Id (if available): %4
Result code: %5

Fields #

Name	Description
`LicenseId` UnicodeString
`Type` Int32
`PackageName` UnicodeString
`UserId` UnicodeString
`HRESULT` UInt32

Event ID 121: Operation opId failed invoked from Caller failed because a reboot is required post rearm.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Operation opId failed invoked from Caller failed because a reboot is required post rearm.

Message #

Operation %1 failed invoked from %2 failed because a reboot is required post rearm

Fields #

Name	Description
`opId` UInt32
`Caller` UnicodeString

Event ID 150: Clip service has been rearmed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

Clip service has been rearmed. Result code: Data.

Message #

Clip service has been rearmed.  Result code: %1

Fields #

Name	Description
`HRESULT`

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 150,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:55:37.878222+00:00",
    "event_record_id": 255,
    "correlation": {},
    "execution": {
      "process_id": 2684,
      "thread_id": 1968
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Data": {
      "Name": "HRESULT",
      "Value": 0
    }
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 151: Failed to launch app Data since no applicable licenses were found.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Failed to launch app Data since no applicable licenses were found.

Message #

Failed to launch app %1 since no applicable licenses were found

Fields #

Name	Description
`Data` UnicodeString

Event ID 152: The hardware ID in the device license is out of tolerance with the device ID

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

The hardware ID in the device license is out of tolerance with the device ID.

Message #

The hardware ID in the device license is out of tolerance with the device ID

Event ID 153: The hardware ID in the device license changed but still with in tolerance with the device hardware ID

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

The hardware ID in the device license changed but still with in tolerance with the device hardware ID.

Message #

The hardware ID in the device license changed but still with in tolerance with the device hardware ID

Event ID 154: The device license was updated with a different device ID

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

The device license was updated with a different device ID.

Message #

The device license was updated with a different device ID

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 154,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T22:02:00.368186+00:00",
    "event_record_id": 238,
    "correlation": {},
    "execution": {
      "process_id": 6564,
      "thread_id": 6608
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 155: The device license was removed

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

The device license was removed.

Message #

The device license was removed

Event ID 156: The required device license could not not be found

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

The required device license could not not be found.

Message #

The required device license could not not be found

Event ID 157: The license with Id LicenseId has been archived successfully.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

The license with Id LicenseId has been archived successfully. PFM if available: PackageName.

Message #

The license with Id %2 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	2 has been archived successfully. PFM if available.
`LicenseId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 157,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-26T04:17:18.373826+00:00",
    "event_record_id": 69,
    "correlation": {},
    "execution": {
      "process_id": 1572,
      "thread_id": 1708
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WIN-OQ6R0RVA4NF",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "microsoftwindows.client.webexperience_cw5n1h2txyewy",
    "LicenseId": "be0b63a6-5394-dcb0-7bc2-5187af85ce67"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 158: The license with Id Error_code was not able to be archived successfully.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

The license with Id Error_code was not able to be archived successfully.

Message #

The license with Id %2 was not able to be archived successfully.
Error code: %3
PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString
`LicenseId` UnicodeString
`HRESULT` UInt32

Event ID 159: The lease with Id LicenseId has been archived successfully.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

The lease with Id LicenseId has been archived successfully. PFM if available: PackageName.

Message #

The lease with Id %2 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	2 has been archived successfully. PFM if available.
`LicenseId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 159,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:55:25.745666+00:00",
    "event_record_id": 230,
    "correlation": {},
    "execution": {
      "process_id": 1260,
      "thread_id": 1044
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc",
    "LicenseId": "ff4afb58-6577-9ca4-df1c-6f066e1cf960"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 160: The license with Id LicenseId of type Type has been archived successfully.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

The license with Id LicenseId of type Type has been archived successfully. PFM if available: PackageName.

Message #

The license with Id %2 of type %3 has been archived successfully.  PFM if available: %1

Fields #

Name	Description
`PackageName` UnicodeString	3 has been archived successfully. PFM if available.
`LicenseId` UnicodeString
`Type` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 160,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:22:59.176197+00:00",
    "event_record_id": 74,
    "correlation": {},
    "execution": {
      "process_id": 1852,
      "thread_id": 2020
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageName": "",
    "LicenseId": "61afd6a2-d7c3-8d25-36c2-0c2c47e3aca8",
    "Type": "\u0005"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 161: Edition ID Edition with product key PKey attempt to activate return code HRESULT.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Edition ID Edition with product key PKey attempt to activate return code HRESULT.

Message #

Edition ID %1 with product key %2 attempt to activate return code %3

Fields #

Name	Description
`Edition` Int32
`PKey` UnicodeString
`HRESULT` UInt32

Event ID 170: A license was loaded from EFI and installed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

A license was loaded from EFI and installed. EFI namespace Associate_Id, path Namespace.

Message #

A license was loaded from EFI and installed.  EFI namespace %1, path %2
Associate Id: %3

Fields #

Name	Description
`Namespace` UnicodeString
`VariableName` UnicodeString
`AssociateId` UnicodeString

Event ID 171: A license was loaded from EFI but failed to install.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

A license was loaded from EFI but failed to install. EFI namespace Error_code, path Namespace.

Message #

A license was loaded from EFI but failed to install.  EFI namespace %1, path %2
Error code: %3

Fields #

Name	Description
`Namespace` UnicodeString
`VariableName` UnicodeString
`HRESULT` UInt32

Event ID 172: ClipUp run from Clip service with arguments 'Arguments'.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin
Level: Informational

Description

ClipUp run from Clip service with arguments 'Arguments'. Result: HRESULT.

Message #

ClipUp run from Clip service with arguments '%1'. Result: %2

Fields #

Name	Description
`Arguments` UnicodeString
`HRESULT` UInt32	1'. Result.

Example Event #

{
  "system": {
    "provider": "Microsoft-Client-Licensing-Platform",
    "guid": "B6CC0D55-9ECC-49A8-B929-2B9022426F2A",
    "event_source_name": "",
    "event_id": 172,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693953,
    "time_created": "2023-10-25T21:40:47.121035+00:00",
    "event_record_id": 223,
    "correlation": {},
    "execution": {
      "process_id": 5600,
      "thread_id": 5656
    },
    "channel": "Microsoft-Client-Licensing-Platform/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Arguments": "-p -pfm CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc",
    "HRESULT": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 173: Product key from MSDM table redeemed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Product key from MSDM table redeemed. Result: HRESULT.

Message #

Product key from MSDM table redeemed. Result: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 174: Product key from MSDM table installed.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Product key from MSDM table installed. Result: HRESULT.

Message #

Product key from MSDM table installed. Result: %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 175: Internal Troubleshooting started.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Internal Troubleshooting started. System Time: Data.

Message #

Internal Troubleshooting started. System Time: %1

Fields #

Name	Description
`Data` UnicodeString

Event ID 176: Internal Troubleshooting ended.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Internal Troubleshooting ended. System Time: SystemTime, Diagnosis_Kind: Kind, Result: HRESULT, Stage: Stage.

Message #

Internal Troubleshooting ended. System Time: %1, Diagnosis_Kind: %2, Result: %3, Stage: %4

Fields #

Name	Description
`SystemTime` UnicodeString
`Kind` Int32
`HRESULT` UInt32
`Stage` UnicodeString

Event ID 177: Internal WCOS Troubleshooting started.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Internal WCOS Troubleshooting started. System Time: Data.

Message #

Internal WCOS Troubleshooting started. System Time: %1

Fields #

Name	Description
`Data` UnicodeString

Event ID 178: Internal WCOS Troubleshooting ended.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Internal WCOS Troubleshooting ended. System Time: SystemTime, Result: HRESULT, Stage: Stage.

Message #

Internal WCOS Troubleshooting ended. System Time: %1, Result: %2, Stage: %3

Fields #

Name	Description
`SystemTime` UnicodeString
`HRESULT` UInt32
`Stage` UnicodeString

Event ID 179: FCLiP Task Operation has been done.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

FCLiP Task Operation has been done. Result: HRESULT, Operation: Stage.

Message #

FCLiP Task Operation has been done. Result: %1, Operation: %2

Fields #

Name	Description
`HRESULT` UInt32
`Stage` UnicodeString

Event ID 180: Windows Subscription: State: State Msg: Msg.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Windows Subscription: State: State Msg: Msg.

Message #

Windows Subscription: State: %1 Msg: %2

Fields #

Name	Description
`State` UnicodeString
`Msg` UnicodeString

Event ID 181: Windows Subscription: State: State, Result: HRESULT Msg: Msg.

Provider: Microsoft-Client-Licensing-Platform
Channel: Admin

Description

Windows Subscription: State: State, Result: HRESULT Msg: Msg.

Message #

Windows Subscription: State: %1, Result: %2 Msg: %3

Fields #

Name	Description
`State` UnicodeString
`HRESULT` UInt32
`Msg` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b6cc0d55-9ecc-49a8-b929-2b9022426f2a

Defined in ClipSvc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)