Microsoft-Office-Events

91 events across 2 channels

Event	Title	Channel	Sample
1	CallStack event description message: cValue.	OfficeChannel	Y
2	CallStackModule event description message: BaseAddress.	OfficeChannel	Y
3	BudgetCreate event description message: dwTag.	OfficeChannel	Y
4	BudgetUpdate event description message: dwTag.	OfficeChannel	Y
5	BudgetDelete event description message: dwTag.	OfficeChannel	Y
6	CodeMarker event description message: EventData.	OfficeChannel	Y
7	SqmD event description message: dwDatapoint.	OfficeChannel	Y
8	SqmDA event description message: dwDatapoint.	OfficeChannel	Y
9	SqmS event description message: dwDatapoint.	OfficeChannel	Y
10	BudgetSetRate event description message: dwTag.	OfficeChannel	Y
11	PCX Debug	OfficeDebugChannel	Y
12	PCX Infomation	OfficeDebugChannel	Y
13	PCX Warning	OfficeDebugChannel	Y
14	PCX Error	OfficeDebugChannel	Y
15	PCX Call Start	OfficeDebugChannel	Y
16	PCX Call Stop	OfficeDebugChannel	Y
17	PCX Function Start	OfficeDebugChannel	Y
18	PCX Function Stop	OfficeDebugChannel	Y
19	PCX Job Start	OfficeDebugChannel	Y
20	PCX Job Stop	OfficeDebugChannel	Y
21	PCX Create Persona	OfficeDebugChannel	Y
22	PCX Create New Persona	OfficeDebugChannel	Y
23	PCX Create Persona Linked	OfficeDebugChannel	Y
24	PCX PersonInfo	OfficeDebugChannel	Y
25	PCX Person Contact Type	OfficeDebugChannel	Y
26	PCX Resolution Properties	OfficeDebugChannel	Y
27	PCX Person Property Update	OfficeDebugChannel	Y
28	PCX OutLook Contact Property Update	OfficeDebugChannel	Y
29	PCX Contact Card Infomation	OfficeDebugChannel	Y
30	PCX Presence Infomation	OfficeDebugChannel	Y
31	PCX Presence Property Update	OfficeDebugChannel	Y
32	PCX Search Result	OfficeDebugChannel	Y
33	CallStack event description message: cValue.	OfficeDebugChannel	Y
34	CallStackModule event description message: BaseAddress.	OfficeDebugChannel	Y
35	PerfWatson Debug	OfficeDebugChannel	Y
36	Register idle task 'cookie': priority dwID, scheduler wzName, flags priority, …	OfficeDebugChannel	Y
37	Deregister idle task 'cookie'.	OfficeDebugChannel	Y
38	Modify idle task 'cookie': change flags dwID, priority wzName, scheduler …	OfficeDebugChannel	Y
39	Idle execution starting: timer only fTimerOnly, tracking fTracking, resume …	OfficeDebugChannel	Y
40	Idle execution ending	OfficeDebugChannel	Y
41	Idle execution preempted	OfficeDebugChannel	Y
42	Idle task 'cookie' moved to run queue.	OfficeDebugChannel	Y
43	Idle task 'cookie' demoted to wait queue.	OfficeDebugChannel	Y
44	Idle task 'cookie' executing.	OfficeDebugChannel	Y
45	Idle timer message received	OfficeDebugChannel	Y
46	Idle timer scheduled to msecDelay ms for task 'msecsTolerableDelay'.	OfficeDebugChannel	Y
47	PCX Search Result Dedupped	OfficeDebugChannel	Y
48	PCX Search Results Posted	OfficeDebugChannel	Y
49	PCX ContactInfo	OfficeDebugChannel	Y
50	Idle update queued for task 'cookie': type grfUpdateType.	OfficeDebugChannel	Y
51	SecureReader Debug	OfficeDebugChannel	Y
52	Window Message wzMessageName(dwValue) registered.	OfficeDebugChannel	Y
53	PCX Contact Linking	OfficeDebugChannel	Y
54	PCX Contact Linking Pair	OfficeDebugChannel	Y
55	PCX Feed Item Info	OfficeDebugChannel	Y
56	PCX Feed Provider Info	OfficeDebugChannel	Y
57	PCX Feed Sanitized HTML Info	OfficeDebugChannel	Y
58	PCX Contact Sync Friend Info	OfficeDebugChannel	Y
59	PCX Contact Sync Schedule Info	OfficeDebugChannel	Y
60	PerfWatson Debug	OfficeDebugChannel	Y
61	PerfWatson Debug	OfficeDebugChannel	Y
62	Met Infomation	OfficeDebugChannel	Y
63	Met Warning	OfficeDebugChannel	Y
64	Met Error	OfficeDebugChannel	Y
65	Met Call Start	OfficeDebugChannel	Y
66	Met Call Stop	OfficeDebugChannel	Y
67	CallStack event description message: cValue.	OfficeDebugChannel	Y
68	CallStackModule event description message: BaseAddress.	OfficeDebugChannel	Y
69	PCX ContactInfoPropertyUpdate	OfficeDebugChannel	Y
70	MSO Logging	OfficeDebugChannel	Y
71	User requested opening of the New Unified Group dialog	OfficeDebugChannel	Y
72	User dismissed the New Unified Group dialog	OfficeDebugChannel	Y
73	User requested creation of a Unified Group	OfficeDebugChannel	Y
74	Create unified group operation finished	OfficeDebugChannel	Y
75	Started check for group ID availability	OfficeDebugChannel	Y
76	Started check for group ID availability	OfficeDebugChannel	Y
77	User requested opening of the Edit Unified Group dialog	OfficeDebugChannel	Y
78	User dismissed the Edit Unified Group dialog	OfficeDebugChannel	Y
79	User started edit of a Unified Group	OfficeDebugChannel	Y
80	One of the operations involved in updating the group finished	OfficeDebugChannel	Y
81	Edit Unified Group operation finished	OfficeDebugChannel	Y
82	Edit group photo button was clicked	OfficeDebugChannel	Y
83	Group membership finished loading	OfficeDebugChannel	Y
84	Group details finished loading	OfficeDebugChannel	Y
85	User requested opening of the Edit Unified Group dialog	OfficeDebugChannel	Y
86	User dismissed the Edit Unified Group dialog	OfficeDebugChannel	Y
87	User started edit of a Unified Group	OfficeDebugChannel	Y
88	Edit Unified Group operation finished	OfficeDebugChannel	Y
89	Group card actions event, including open card, switch to members tab, and all …	OfficeDebugChannel	Y
90	Group local folder creation finished	OfficeDebugChannel	Y
91	Bulk add members	OfficeDebugChannel	Y

Event ID 1: CallStack event description message: cValue.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: CallStack task
Opcode: CallStack opcode

Description

CallStack event description message: cValue.

Message #

CallStack event description message: %1

Fields #

Name	Description
`cValue` UInt32
`Frame` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "1",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "10",
    "keywords": 9223372036854775809,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cValue": "0",
    "Frame": "0x0"
  },
  "message": ""
}

Event ID 2: CallStackModule event description message: BaseAddress.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: CallStack task
Opcode: CallStackModule opcode

Description

CallStackModule event description message: BaseAddress.

Message #

CallStackModule event description message: %1

Fields #

Name	Description
`BaseAddress` Pointer
`TimeDateStamp` UInt32
`Size` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "2",
    "version": "0",
    "level": "4",
    "task": "1",
    "opcode": "11",
    "keywords": 9223372036854775809,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BaseAddress": "0x0",
    "TimeDateStamp": "0",
    "Size": "0",
    "wzName": ""
  },
  "message": ""
}

Event ID 3: BudgetCreate event description message: dwTag.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: BudgetCreate opcode

Description

BudgetCreate event description message: dwTag.

Message #

BudgetCreate event description message: %1

Fields #

Name	Description
`dwTag` UInt32
`dwID` UInt32
`dwBudgetType` UInt32
`dwFlags` UInt32
`Limit` Int32
`dwInterval` UInt32
`wzData` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "3",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "12",
    "keywords": 9223372036854775810,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwID": "0",
    "dwBudgetType": "0",
    "dwFlags": "0",
    "Limit": "0",
    "dwInterval": "0",
    "wzData": ""
  },
  "message": ""
}

Event ID 4: BudgetUpdate event description message: dwTag.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: BudgetUpdate opcode

Description

BudgetUpdate event description message: dwTag.

Message #

BudgetUpdate event description message: %1

Fields #

Name	Description
`dwTag` UInt32
`dwID` UInt32
`dwBudgetType` UInt32
`Update` Int32
`dwTimeNow` UInt32
`wzData` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "4",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "13",
    "keywords": 9223372036854775810,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwID": "0",
    "dwBudgetType": "0",
    "Update": "0",
    "dwTimeNow": "0",
    "wzData": ""
  },
  "message": ""
}

Event ID 5: BudgetDelete event description message: dwTag.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: BudgetDelete opcode

Description

BudgetDelete event description message: dwTag.

Message #

BudgetDelete event description message: %1

Fields #

Name	Description
`dwTag` UInt32
`dwID` UInt32
`dwBudgetType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "5",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "14",
    "keywords": 9223372036854775810,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwID": "0",
    "dwBudgetType": "0"
  },
  "message": ""
}

Event ID 6: CodeMarker event description message: EventData.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: CodeMarker opcode

Description

CodeMarker event description message: EventData.

Message #

CodeMarker event description message: %1

Fields #

Name	Description
`EventData`
`dwCodeMarker` HexInt32
`dwModuleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "6",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "16",
    "keywords": 9223372036854775812,
    "time_created": "2026-03-14T21:43:16.796962700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "EventData": ""
  },
  "message": ""
}

Event ID 7: SqmD event description message: dwDatapoint.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: SqmDatapoint opcode

Description

SqmD event description message: dwDatapoint.

Message #

SqmD event description message: %1

Fields #

Name	Description
`dwDatapoint` UInt32
`dwTick` UInt32
`dwValue1` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "7",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "17",
    "keywords": 9223372036854775816,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwDatapoint": "0",
    "dwTick": "0",
    "dwValue1": "0"
  },
  "message": ""
}

Event ID 8: SqmDA event description message: dwDatapoint.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: SqmDatapointAvg opcode

Description

SqmDA event description message: dwDatapoint.

Message #

SqmDA event description message: %1

Fields #

Name	Description
`dwDatapoint` UInt32
`dwTick` UInt32
`dwValue1` UInt32
`dwCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "8",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "18",
    "keywords": 9223372036854775816,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwDatapoint": "0",
    "dwTick": "0",
    "dwValue1": "0",
    "dwCount": "0"
  },
  "message": ""
}

Event ID 9: SqmS event description message: dwDatapoint.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: SqmStream opcode

Description

SqmS event description message: dwDatapoint.

Message #

SqmS event description message: %1

Fields #

Name	Description
`dwDatapoint` UInt32
`dwTick` UInt32
`cValue` UInt32
`dwValue` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "9",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "19",
    "keywords": 9223372036854775816,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwDatapoint": "0",
    "dwTick": "0",
    "cValue": "0",
    "dwValue": "0"
  },
  "message": ""
}

Event ID 10: BudgetSetRate event description message: dwTag.

Provider: Microsoft-Office-Events
Channel: OfficeChannel
Level: Informational
Task: Performance task
Opcode: BudgetSetRate opcode

Description

BudgetSetRate event description message: dwTag.

Message #

BudgetSetRate event description message: %1

Fields #

Name	Description
`dwTag` UInt32
`dwID` UInt32
`dwBudgetType` UInt32
`Limit` Int32
`dwInterval` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "10",
    "version": "0",
    "level": "4",
    "task": "2",
    "opcode": "20",
    "keywords": 9223372036854775810,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwID": "0",
    "dwBudgetType": "0",
    "Limit": "0",
    "dwInterval": "0"
  },
  "message": ""
}

Event ID 11: PCX Debug

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX General Opcode

Description

PCX Debug.

Message #

PCX Debug

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "11",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "21",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.413423300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMManager::HrInitializeObjects",
    "dwLine": "    2589",
    "dwHResult": "0",
    "wzMessage": "MAPI mode not set. FInOutlook()=0, FInLync()=0, FOutlookConfigured()=0"
  },
  "message": ""
}

Event ID 12: PCX Infomation

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX General Opcode

Description

PCX Infomation.

Message #

PCX Infomation

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "12",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "21",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.415729000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMManager::SetMsoMode",
    "dwLine": "    4300",
    "dwHResult": "0",
    "wzMessage": "Mso mode set to LDAP"
  },
  "message": ""
}

Event ID 13: PCX Warning

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Warning
Task: PCX task
Opcode: PCX General Opcode

Description

PCX Warning.

Message #

PCX Warning

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "13",
    "version": "0",
    "level": "3",
    "task": "3",
    "opcode": "21",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.417447800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "13428"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "PersonaIdentifiersForContact::HrGetEmsabpUIDFromPersonInfo",
    "dwLine": "     463",
    "dwHResult": "-2147418113",
    "wzMessage": ""
  },
  "message": ""
}

Event ID 14: PCX Error

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Error
Task: PCX task
Opcode: PCX General Opcode

Description

PCX Error.

Message #

PCX Error

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "14",
    "version": "0",
    "level": "2",
    "task": "3",
    "opcode": "21",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T22:50:03.617933900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "13712"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMProviderFactory::HrEnsureDefaultIMProcessRegKey",
    "dwLine": "     913",
    "dwHResult": "-2147467259",
    "wzMessage": "Failed opening reg key (HKCU:SOFTWARE\\IM Providers\\Lync)"
  },
  "message": ""
}

Event ID 15: PCX Call Start

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Start

Description

PCX Call Start.

Message #

PCX Call Start

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`szCall` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "15",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:52:15.030705500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "11984"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMNAbstractionLayer::HrADResolveQuery",
    "dwLine": "    2599",
    "szCall": "pldap->HrExecuteSearch(ssSearchSpec)"
  },
  "message": ""
}

Event ID 16: PCX Call Stop

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Stop

Description

PCX Call Stop.

Message #

PCX Call Stop

Fields #

Name	Description
`szFunction` AnsiString
`dwLine` UInt32
`szCall` AnsiString
`dwHResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "16",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:52:15.030703600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "11984"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMNAbstractionLayer::HrADResolveQuery",
    "dwLine": "    2592",
    "szCall": "pldap->HrOpenSession(const_cast<LPWSTR>(csDomain.c_str()), fGlobalCatalogSearch)",
    "dwHResult": "0"
  },
  "message": ""
}

Event ID 17: PCX Function Start

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Start

Description

PCX Function Start.

Message #

PCX Function Start

Fields #

Name	Description
`szFunction` AnsiString
`szTag` AnsiString
`wzParameter` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "17",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.412760400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMManager::HrInitializeObjects",
    "szTag": "",
    "wzParameter": "",
    "pPointer": "0x7FFD1B4D4ABC"
  },
  "message": ""
}

Event ID 18: PCX Function Stop

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Stop

Description

PCX Function Stop.

Message #

PCX Function Stop

Fields #

Name	Description
`szFunction` AnsiString
`dwHResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "18",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.413057700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CPcxPersonCache::HrCreate",
    "dwHResult": "0"
  },
  "message": ""
}

Event ID 19: PCX Job Start

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Start

Description

PCX Job Start.

Message #

PCX Job Start

Fields #

Name	Description
`szFunction` AnsiString
`wzJob` UnicodeString
`szTag` AnsiString
`wzParameter` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "19",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "1",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.417559300+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMNAbstractionLayer::HrPostJob",
    "wzJob": "CMsoJobDoQueueJobProcessor",
    "szTag": "",
    "wzParameter": "",
    "pPointer": "0x7FFD1B4D4ABC"
  },
  "message": ""
}

Event ID 20: PCX Job Stop

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Stop

Description

PCX Job Stop.

Message #

PCX Job Stop

Fields #

Name	Description
`szFunction` AnsiString
`wzJob` UnicodeString
`dwHResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "20",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "2",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.417580900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoIMNAbstractionLayer::HrPostJob",
    "wzJob": "CMsoJobDoQueueJobProcessor",
    "dwHResult": "0"
  },
  "message": ""
}

Event ID 21: PCX Create Persona

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Persona Opcode

Description

PCX Create Persona.

Message #

PCX Create Persona

Fields #

Name	Description
`wzFriendlyName` UnicodeString
`wzAddressSMTP` UnicodeString
`wzSip` UnicodeString
`wzAlias` UnicodeString
`wzUserInfoId` UnicodeString
`wzPhoneNumber` UnicodeString
`wzFlags` UnicodeString
`wzEntryID` UnicodeString
`wzMuid` UnicodeString
`wzResID` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "21",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "22",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.415982000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFriendlyName": "Lab User",
    "wzAddressSMTP": "labuser@contoso.onmicrosoft.com",
    "wzSip": "labuser@contoso.onmicrosoft.com",
    "wzAlias": "NULL",
    "wzUserInfoId": "NULL",
    "wzPhoneNumber": "NULL",
    "wzFlags": "           fMsoContactByResolutionId  ",
    "wzEntryID": "NULL",
    "wzMuid": "NULL",
    "wzResID": "<resolutionId provider=\"AD\"><localId O365id=\"S::labuser@contoso.onmicrosoft.com::00000000-0000-0000-0000-000000000000\"/></resolutionId>"
  },
  "message": ""
}

Event ID 22: PCX Create New Persona

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Persona Opcode

Description

PCX Create New Persona.

Message #

PCX Create New Persona

Fields #

Name	Description
`wzSigninName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "22",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "22",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzSigninName": ""
  },
  "message": ""
}

Event ID 23: PCX Create Persona Linked

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Persona Opcode

Description

PCX Create Persona Linked.

Message #

PCX Create Persona Linked

Fields #

Name	Description
`wzSigninName` UnicodeString
`wzAltEmail` UnicodeString
`dwStatus` Int32
`dwAvail` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "23",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "22",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzSigninName": "",
    "wzAltEmail": "",
    "dwStatus": "0",
    "dwAvail": "0"
  },
  "message": ""
}

Event ID 24: PCX PersonInfo

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX PersonInfo Opcode

Description

PCX PersonInfo.

Message #

PCX PersonInfo

Fields #

Name	Description
`szFunction` AnsiString
`szMessage` AnsiString
`pPointer` Pointer
`wzName` UnicodeString
`wzSPUserId` UnicodeString
`wzSPServerInfo` UnicodeString
`wzDN` UnicodeString
`wzManager` UnicodeString
`wzEntryId` UnicodeString
`wzMuid` UnicodeString
`wzEmailAddress` UnicodeString
`wzSignInAddress` UnicodeString
`wzAlias` UnicodeString
`wzHashKey` UnicodeString
`wzResID` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "24",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "23",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.417727800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "13428"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoPersonInfo::OnJobStart",
    "szMessage": "Resolve Person Started",
    "pPointer": "0x2F449B41400",
    "wzName": "Lab User",
    "wzSPUserId": "",
    "wzSPServerInfo": "",
    "wzDN": "",
    "wzManager": "",
    "wzEntryId": "",
    "wzMuid": "",
    "wzEmailAddress": "labuser@contoso.onmicrosoft.com",
    "wzSignInAddress": "labuser@contoso.onmicrosoft.com",
    "wzAlias": "",
    "wzHashKey": "PSO:<resolutionId provider=\"AD\"><localId O365id=\"S::labuser@contoso.onmicrosoft.com::00000000-0000-0000-0000-000000000000\"/></resolutionId>",
    "wzResID": "<resolutionId provider=\"AD\"><localId O365id=\"S::labuser@contoso.onmicrosoft.com::00000000-0000-0000-0000-000000000000\"/></resolutionId>"
  },
  "message": ""
}

Event ID 25: PCX Person Contact Type

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX PersonInfo Opcode

Description

PCX Person Contact Type.

Message #

PCX Person Contact Type

Fields #

Name	Description
`szFunction` AnsiString
`szMessage` AnsiString
`wzName` UnicodeString
`pPointer` Pointer
`wzContactType` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "25",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "23",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "szMessage": "",
    "wzName": "",
    "pPointer": "0x0",
    "wzContactType": ""
  },
  "message": ""
}

Event ID 26: PCX Resolution Properties

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX PersonInfo Opcode

Description

PCX Resolution Properties.

Message #

PCX Resolution Properties

Fields #

Name	Description
`szFunction` AnsiString
`szMessage` AnsiString
`wzName` UnicodeString
`pPointer` Pointer
`wzSigninName` UnicodeString
`bSetFromDL` Boolean
`wzSMTPAddress` UnicodeString
`wzFriendlyName` UnicodeString
`wzTitle` UnicodeString
`wzCompanyName` UnicodeString
`wzDepartment` UnicodeString
`wzOfficeLocation` UnicodeString
`wzWorkPhone` UnicodeString
`wzMobilePhone` UnicodeString
`wzHomePhone` UnicodeString
`wzDescription` UnicodeString
`wzEntryID` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "26",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "23",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "szMessage": "",
    "wzName": "",
    "pPointer": "0x0",
    "wzSigninName": "",
    "bSetFromDL": "false",
    "wzSMTPAddress": "",
    "wzFriendlyName": "",
    "wzTitle": "",
    "wzCompanyName": "",
    "wzDepartment": "",
    "wzOfficeLocation": "",
    "wzWorkPhone": "",
    "wzMobilePhone": "",
    "wzHomePhone": "",
    "wzDescription": "",
    "wzEntryID": ""
  },
  "message": ""
}

Event ID 27: PCX Person Property Update

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX PersonInfo Opcode

Description

PCX Person Property Update.

Message #

PCX Person Property Update

Fields #

Name	Description
`szFunction` AnsiString
`wzProperty` UnicodeString
`wzOldValue` UnicodeString
`wzNewValue` UnicodeString
`wzKey` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "27",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "23",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "wzProperty": "",
    "wzOldValue": "",
    "wzNewValue": "",
    "wzKey": "",
    "pPointer": "0x0"
  },
  "message": ""
}

Event ID 28: PCX OutLook Contact Property Update

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX PersonInfo Opcode

Description

PCX OutLook Contact Property Update.

Message #

PCX OutLook Contact Property Update

Fields #

Name	Description
`szFunction` AnsiString
`wzProperty` UnicodeString
`wzOldValue` UnicodeString
`wzNewValue` UnicodeString
`wzKey` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "28",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "23",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "wzProperty": "",
    "wzOldValue": "",
    "wzNewValue": "",
    "wzKey": "",
    "pPointer": "0x0"
  },
  "message": ""
}

Event ID 29: PCX Contact Card Infomation

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX ContactCard Opcode

Description

PCX Contact Card Infomation.

Message #

PCX Contact Card Infomation

Fields #

Name	Description
`szString` AnsiString
`szFunction` AnsiString
`pCardHwnd` Pointer
`pPersona` Pointer
`pPersonInfo` Pointer
`wzSigninName` UnicodeString
`wzContactType` UnicodeString
`wzCardType` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "29",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "26",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szString": "",
    "szFunction": "",
    "pCardHwnd": "0x0",
    "pPersona": "0x0",
    "pPersonInfo": "0x0",
    "wzSigninName": "",
    "wzContactType": "",
    "wzCardType": ""
  },
  "message": ""
}

Event ID 30: PCX Presence Infomation

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Presence Opcode

Description

PCX Presence Infomation.

Message #

PCX Presence Infomation

Fields #

Name	Description
`szFunction` AnsiString
`szMessage` AnsiString
`wzName` UnicodeString
`wzSigninName` UnicodeString
`wzEmail` UnicodeString
`wzWPhone` UnicodeString
`wzMPhone` UnicodeString
`wzHPhone` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "30",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "24",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "szMessage": "",
    "wzName": "",
    "wzSigninName": "",
    "wzEmail": "",
    "wzWPhone": "",
    "wzMPhone": "",
    "wzHPhone": ""
  },
  "message": ""
}

Event ID 31: PCX Presence Property Update

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Presence Opcode

Description

PCX Presence Property Update.

Message #

PCX Presence Property Update

Fields #

Name	Description
`szFunction` AnsiString
`wzProperty` UnicodeString
`wzOldValue` UnicodeString
`wzNewValue` UnicodeString
`wzKey` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "31",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "24",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "wzProperty": "",
    "wzOldValue": "",
    "wzNewValue": "",
    "wzKey": "",
    "pPointer": "0x0"
  },
  "message": ""
}

Event ID 32: PCX Search Result

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Presence Opcode

Description

PCX Search Result.

Message #

PCX Search Result

Fields #

Name	Description
`szFunction` AnsiString
`dwRank` UInt32
`wzSIPAddress` UnicodeString
`wzDataType` UnicodeString
`wzEmailAddress` UnicodeString
`wzDisplayName` UnicodeString
`wzPhoneNumber` UnicodeString
`wzTitle` UnicodeString
`wzEntryId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "32",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "24",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "",
    "dwRank": "0",
    "wzSIPAddress": "",
    "wzDataType": "",
    "wzEmailAddress": "",
    "wzDisplayName": "",
    "wzPhoneNumber": "",
    "wzTitle": "",
    "wzEntryId": ""
  },
  "message": ""
}

Event ID 33: CallStack event description message: cValue.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: CallStack opcode

Description

CallStack event description message: cValue.

Message #

CallStack event description message: %1

Fields #

Name	Description
`cValue` UInt32
`Frame` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "33",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "10",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cValue": "0",
    "Frame": "0x0"
  },
  "message": ""
}

Event ID 34: CallStackModule event description message: BaseAddress.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: CallStackModule opcode

Description

CallStackModule event description message: BaseAddress.

Message #

CallStackModule event description message: %1

Fields #

Name	Description
`BaseAddress` Pointer
`TimeDateStamp` UInt32
`Size` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "34",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "11",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BaseAddress": "0x0",
    "TimeDateStamp": "0",
    "Size": "0",
    "wzName": ""
  },
  "message": ""
}

Event ID 35: PerfWatson Debug

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PerfWatson Task
Opcode: PerfWatson Opcode

Description

PerfWatson Debug.

Message #

PerfWatson Debug

Fields #

Name	Description
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "35",
    "version": "0",
    "level": "4",
    "task": "4",
    "opcode": "27",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzMessage": ""
  },
  "message": ""
}

Event ID 36: Register idle task 'cookie': priority dwID, scheduler wzName, flags priority, release scheduler, tolerable delay grfTaskFlags.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Register idle task

Description

Register idle task 'cookie': priority dwID, scheduler wzName, flags priority, release scheduler, tolerable delay grfTaskFlags.

Message #

Register idle task '%1': priority %2, scheduler %3, flags %4, release %5, tolerable delay %6

Fields #

Name	Description
`cookie` UInt64
`dwID` UInt32
`wzName` UnicodeString
`priority` UInt32
`scheduler` UInt32
`grfTaskFlags` UInt32
`msecRelease` UInt32
`msecDeadline` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "36",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "28",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:18.008779100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "1",
    "dwID": "575545989",
    "wzName": "NULL",
    "priority": "       1",
    "scheduler": "       1",
    "grfTaskFlags": "       0",
    "msecRelease": "       0",
    "msecDeadline": "  300000"
  },
  "message": ""
}

Event ID 37: Deregister idle task 'cookie'.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Deregister idle task

Description

Deregister idle task 'cookie'.

Message #

Deregister idle task '%1'

Fields #

Name	Description
`cookie` UInt64
`dwID` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "37",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "29",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:18.008893600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "6",
    "dwID": "508568842",
    "wzName": "NULL"
  },
  "message": ""
}

Event ID 38: Modify idle task 'cookie': change flags dwID, priority wzName, scheduler grfModifyFlags, flags priority, release scheduler, tolerable delay grfTaskFlags.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Modify idle task

Description

Modify idle task 'cookie': change flags dwID, priority wzName, scheduler grfModifyFlags, flags priority, release scheduler, tolerable delay grfTaskFlags.

Message #

Modify idle task '%1': change flags %2, priority %3, scheduler %4, flags %5, release %6, tolerable delay %7

Fields #

Name	Description
`cookie` Int64
`dwID` UInt32
`wzName` UnicodeString
`grfModifyFlags` UInt32
`priority` UInt32
`scheduler` UInt32
`grfTaskFlags` UInt32
`msecRelease` UInt32
`msecDeadline` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "38",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "30",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:32.468253800+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "6",
    "dwID": "504452934",
    "wzName": "NULL",
    "grfModifyFlags": "      16",
    "priority": "       1",
    "scheduler": "       0",
    "grfTaskFlags": "       5",
    "msecRelease": "   20000",
    "msecDeadline": "   40000"
  },
  "message": ""
}

Event ID 39: Idle execution starting: timer only fTimerOnly, tracking fTracking, resume fResuming.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle execution starting

Description

Idle execution starting: timer only fTimerOnly, tracking fTracking, resume fResuming.

Message #

Idle execution starting: timer only %1, tracking %2, resume %3

Fields #

Name	Description
`fTimerOnly` Boolean
`fTracking` Boolean
`fResuming` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "39",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "31",
    "keywords": 4611686018427389952,
    "time_created": "2026-03-14T21:43:18.008833600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fTimerOnly": "false",
    "fTracking": "false",
    "fResuming": "false"
  },
  "message": ""
}

Event ID 40: Idle execution ending

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle execution ending

Description

Idle execution ending.

Message #

Idle execution ending

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "40",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "32",
    "keywords": 4611686018427389952,
    "time_created": "2026-03-14T21:43:18.010557500+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 41: Idle execution preempted

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle execution preempted

Description

Idle execution preempted.

Message #

Idle execution preempted

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "41",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "33",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:21.727135600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 42: Idle task 'cookie' moved to run queue.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle task moved to run queue

Description

Idle task 'cookie' moved to run queue.

Message #

Idle task '%1' moved to run queue

Fields #

Name	Description
`cookie` UInt64
`dwID` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "42",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "34",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:18.008837600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "1",
    "dwID": "575545989",
    "wzName": "NULL"
  },
  "message": ""
}

Event ID 43: Idle task 'cookie' demoted to wait queue.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle task demoted to wait queue

Description

Idle task 'cookie' demoted to wait queue.

Message #

Idle task '%1' demoted to wait queue

Fields #

Name	Description
`cookie` UInt64
`dwID` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "43",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "35",
    "keywords": 9223372036854775872,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "0",
    "dwID": "0",
    "wzName": ""
  },
  "message": ""
}

Event ID 44: Idle task 'cookie' executing.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle task executing

Description

Idle task 'cookie' executing.

Message #

Idle task '%1' executing

Fields #

Name	Description
`cookie` UInt64
`dwID` UInt32
`wzName` UnicodeString
`msecsRunIntervalAvg` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "44",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "36",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:18.008849400+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "6",
    "dwID": "508568842",
    "wzName": "NULL",
    "msecsRunIntervalAvg": "4294967295"
  },
  "message": ""
}

Event ID 45: Idle timer message received

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle timer message received

Description

Idle timer message received.

Message #

Idle timer message received

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "45",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "37",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:19.888287700+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 46: Idle timer scheduled to msecDelay ms for task 'msecsTolerableDelay'.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle timer scheduled

Description

Idle timer scheduled to msecDelay ms for task 'msecsTolerableDelay'.

Message #

Idle timer scheduled to %1 ms for task '%2'

Fields #

Name	Description
`msecDelay` UInt32
`msecsTolerableDelay` UInt32
`dwID` UInt32
`wzFirstTaskName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "46",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "38",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:18.008800900+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "msecDelay": "       0",
    "msecsTolerableDelay": "     500",
    "dwID": "508568842",
    "wzFirstTaskName": "NULL"
  },
  "message": ""
}

Event ID 47: PCX Search Result Dedupped

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Search Opcode

Description

PCX Search Result Dedupped.

Message #

PCX Search Result Dedupped

Fields #

Name	Description
`wzC1Source` UnicodeString
`wzC1EntryId` UnicodeString
`wzC1PersonId` UnicodeString
`wzC1StampedGalEId` UnicodeString
`wzC1Email1` UnicodeString
`wzC1Email2` UnicodeString
`wzC1Email3` UnicodeString
`wzC1DisplayName` UnicodeString
`wzC2Source` UnicodeString
`wzC2EntryId` UnicodeString
`wzC2PersonId` UnicodeString
`wzC2StampedGalEId` UnicodeString
`wzC2Email1` UnicodeString
`wzC2Email2` UnicodeString
`wzC2Email3` UnicodeString
`wzC2DisplayName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "47",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "25",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzC1Source": "",
    "wzC1EntryId": "",
    "wzC1PersonId": "",
    "wzC1StampedGalEId": "",
    "wzC1Email1": "",
    "wzC1Email2": "",
    "wzC1Email3": "",
    "wzC1DisplayName": "",
    "wzC2Source": "",
    "wzC2EntryId": "",
    "wzC2PersonId": "",
    "wzC2StampedGalEId": "",
    "wzC2Email1": "",
    "wzC2Email2": "",
    "wzC2Email3": "",
    "wzC2DisplayName": ""
  },
  "message": ""
}

Event ID 48: PCX Search Results Posted

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Search Opcode

Description

PCX Search Results Posted.

Message #

PCX Search Results Posted

Fields #

Name	Description
`dwJobSequence` UInt32
`dwJobCount` Int32
`dwHrResult` Int32
`dwResultCount` Int32
`fLastBatch` Boolean
`fMoreResults` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "48",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "25",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwJobSequence": "0",
    "dwJobCount": "0",
    "dwHrResult": "0",
    "dwResultCount": "0",
    "fLastBatch": "false",
    "fMoreResults": "false"
  },
  "message": ""
}

Event ID 49: PCX ContactInfo

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX ContactInfo Opcode

Description

PCX ContactInfo.

Message #

PCX ContactInfo

Fields #

Name	Description
`szFunction` AnsiString
`wzMessage` UnicodeString
`pPointer` Pointer
`wzRootSourceType` UnicodeString
`szSourceType` AnsiString
`wzKey` UnicodeString
`wzName` UnicodeString
`wzEntryID` UnicodeString
`wzUserID` UnicodeString
`wzMuid` UnicodeString
`wzProviderId` UnicodeString
`wzCreationDate` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "49",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "39",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:39.519407000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "13688",
      "thread_id": "13896"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoResIdContactInfo::~CMsoResIdContactInfo",
    "wzMessage": "Destroying CMsoResIdContactInfo Contact",
    "pPointer": "0x1B039954580",
    "wzRootSourceType": "",
    "szSourceType": "ResId Data",
    "wzKey": "<resolutionId provider=\"AD\"><localId O365id=\"S::labuser@contoso.onmicrosoft.com::00000000-0000-0000-0000-000000000000\"/></resolutionId>",
    "wzName": "Lab User",
    "wzEntryID": "",
    "wzUserID": "",
    "wzMuid": "",
    "wzProviderId": "",
    "wzCreationDate": ""
  },
  "message": ""
}

Event ID 50: Idle update queued for task 'cookie': type grfUpdateType.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Idle Task Scheduler
Opcode: Idle update queued

Description

Idle update queued for task 'cookie': type grfUpdateType.

Message #

Idle update queued for task '%1': type %2

Fields #

Name	Description
`cookie` UInt64
`grfUpdateType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "50",
    "version": "0",
    "level": "4",
    "task": "5",
    "opcode": "40",
    "keywords": 4611686018427387968,
    "time_created": "2026-03-14T21:43:17.264196600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "8376",
      "thread_id": "9024"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cookie": "0",
    "grfUpdateType": "       1"
  },
  "message": ""
}

Event ID 51: SecureReader Debug

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Verbose
Task: SecureReader Task
Opcode: SecureReader Opcode

Description

SecureReader Debug.

Message #

SecureReader Debug

Fields #

Name	Description
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "51",
    "version": "0",
    "level": "5",
    "task": "6",
    "opcode": "41",
    "keywords": 9223372036854775936,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzMessage": ""
  },
  "message": ""
}

Event ID 52: Window Message wzMessageName(dwValue) registered.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Synchronization Task
Opcode: Synchronization Opcode

Description

Window Message wzMessageName(dwValue) registered.

Message #

Window Message %1(%2) registered

Fields #

Name	Description
`wzMessageName` UnicodeString
`dwValue` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "52",
    "version": "0",
    "level": "4",
    "task": "7",
    "opcode": "42",
    "keywords": 9223372036854776064,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzMessageName": "",
    "dwValue": "0"
  },
  "message": ""
}

Event ID 53: PCX Contact Linking

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Contact Linking Opcode

Description

PCX Contact Linking.

Message #

PCX Contact Linking

Fields #

Name	Description
`szMessageName` AnsiString
`wzPersonID` UnicodeString
`wzEntryID` UnicodeString
`wzEmail1` UnicodeString
`wzEmail2` UnicodeString
`wzEmail3` UnicodeString
`wzIM` UnicodeString
`wzLastModified` UnicodeString
`fLInked` Boolean
`wzGALEntryID` UnicodeString
`dwGALLinkState` UInt32
`wzLinkRejectHistory` UnicodeString
`wzSMTPAddressCache` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "53",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "43",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szMessageName": "",
    "wzPersonID": "",
    "wzEntryID": "",
    "wzEmail1": "",
    "wzEmail2": "",
    "wzEmail3": "",
    "wzIM": "",
    "wzLastModified": "",
    "fLInked": "false",
    "wzGALEntryID": "",
    "dwGALLinkState": "0",
    "wzLinkRejectHistory": "",
    "wzSMTPAddressCache": ""
  },
  "message": ""
}

Event ID 54: PCX Contact Linking Pair

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Contact Linking Opcode

Description

PCX Contact Linking Pair.

Message #

PCX Contact Linking Pair

Fields #

Name	Description
`szMessageName` AnsiString
`wzEntryID1` UnicodeString
`wzEntryID2` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "54",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "43",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szMessageName": "",
    "wzEntryID1": "",
    "wzEntryID2": ""
  },
  "message": ""
}

Event ID 55: PCX Feed Item Info

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Feeds Opcode

Description

PCX Feed Item Info.

Message #

PCX Feed Item Info

Fields #

Name	Description
`szComment` AnsiString
`szCallingFunction` AnsiString
`wzFeedProviderName` UnicodeString
`wzFeedHTML` UnicodeString
`wzFeedData` UnicodeString
`wzFeedPlainText` UnicodeString
`wzFeedIcon` UnicodeString
`wzTime` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "55",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "44",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szComment": "",
    "szCallingFunction": "",
    "wzFeedProviderName": "",
    "wzFeedHTML": "",
    "wzFeedData": "",
    "wzFeedPlainText": "",
    "wzFeedIcon": "",
    "wzTime": ""
  },
  "message": ""
}

Event ID 56: PCX Feed Provider Info

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Feeds Opcode

Description

PCX Feed Provider Info.

Message #

PCX Feed Provider Info

Fields #

Name	Description
`szComment` AnsiString
`szFunction` AnsiString
`wzProviderXML` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "56",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "44",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szComment": "",
    "szFunction": "",
    "wzProviderXML": ""
  },
  "message": ""
}

Event ID 57: PCX Feed Sanitized HTML Info

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Feeds Opcode

Description

PCX Feed Sanitized HTML Info.

Message #

PCX Feed Sanitized HTML Info

Fields #

Name	Description
`szComment` AnsiString
`szFunction` AnsiString
`wzUnSanitizedHTML` UnicodeString
`wzSanitizedHTML` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "57",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "44",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szComment": "",
    "szFunction": "",
    "wzUnSanitizedHTML": "",
    "wzSanitizedHTML": ""
  },
  "message": ""
}

Event ID 58: PCX Contact Sync Friend Info

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Contact Sync Opcode

Description

PCX Contact Sync Friend Info.

Message #

PCX Contact Sync Friend Info

Fields #

Name	Description
`szComment` AnsiString
`szFunction` AnsiString
`wzFriendInfo` UnicodeString
`wzRetrievalTime` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "58",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "45",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T22:50:14.250216600+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "10708",
      "thread_id": "11476"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szComment": "Contact Sync: Next contact sync check scheduled in minutes",
    "szFunction": "CContactSyncRunTask::Run",
    "wzFriendInfo": "Saturday, March 14, 2026 10:50:14 PM",
    "wzRetrievalTime": "41"
  },
  "message": ""
}

Event ID 59: PCX Contact Sync Schedule Info

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX Contact Sync Opcode

Description

PCX Contact Sync Schedule Info.

Message #

PCX Contact Sync Schedule Info

Fields #

Name	Description
`szComment` AnsiString
`szFunction` AnsiString
`wzCurrentTime` UnicodeString
`wzTimeInMinutesForNextSync` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "59",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "45",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szComment": "",
    "szFunction": "",
    "wzCurrentTime": "",
    "wzTimeInMinutesForNextSync": ""
  },
  "message": ""
}

Event ID 60: PerfWatson Debug

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Verbose
Task: PerfWatson Task
Opcode: PerfWatson Opcode

Description

PerfWatson Debug.

Message #

PerfWatson Debug

Fields #

Name	Description
`dwTag` UInt32
`dwId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "60",
    "version": "0",
    "level": "5",
    "task": "4",
    "opcode": "27",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwId": "0"
  },
  "message": ""
}

Event ID 61: PerfWatson Debug

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Verbose
Task: PerfWatson Task
Opcode: PerfWatson Opcode

Description

PerfWatson Debug.

Message #

PerfWatson Debug

Fields #

Name	Description
`dwTag` UInt32
`dwId` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "61",
    "version": "0",
    "level": "5",
    "task": "4",
    "opcode": "27",
    "keywords": 9223372036854775840,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwTag": "0",
    "dwId": "0"
  },
  "message": ""
}

Event ID 62: Met Infomation

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Met task
Opcode: Met General Opcode

Description

Met Infomation.

Message #

Met Infomation

Fields #

Name	Description
`wzFunction` UnicodeString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "62",
    "version": "0",
    "level": "4",
    "task": "8",
    "opcode": "46",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFunction": "",
    "dwLine": "0",
    "dwHResult": "0",
    "wzMessage": ""
  },
  "message": ""
}

Event ID 63: Met Warning

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Warning
Task: Met task
Opcode: Met General Opcode

Description

Met Warning.

Message #

Met Warning

Fields #

Name	Description
`wzFunction` UnicodeString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "63",
    "version": "0",
    "level": "3",
    "task": "8",
    "opcode": "46",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFunction": "",
    "dwLine": "0",
    "dwHResult": "0",
    "wzMessage": ""
  },
  "message": ""
}

Event ID 64: Met Error

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Error
Task: Met task
Opcode: Met General Opcode

Description

Met Error.

Message #

Met Error

Fields #

Name	Description
`wzFunction` UnicodeString
`dwLine` UInt32
`dwHResult` Int32
`wzMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "64",
    "version": "0",
    "level": "2",
    "task": "8",
    "opcode": "46",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFunction": "",
    "dwLine": "0",
    "dwHResult": "0",
    "wzMessage": ""
  },
  "message": ""
}

Event ID 65: Met Call Start

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Met task
Opcode: Start

Description

Met Call Start.

Message #

Met Call Start

Fields #

Name	Description
`wzFunction` UnicodeString
`dwLine` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "65",
    "version": "0",
    "level": "4",
    "task": "8",
    "opcode": "1",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFunction": "",
    "dwLine": "0"
  },
  "message": ""
}

Event ID 66: Met Call Stop

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Met task
Opcode: Stop

Description

Met Call Stop.

Message #

Met Call Stop

Fields #

Name	Description
`wzFunction` UnicodeString
`dwLine` UInt32
`dwHResult` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "66",
    "version": "0",
    "level": "4",
    "task": "8",
    "opcode": "2",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzFunction": "",
    "dwLine": "0",
    "dwHResult": "0"
  },
  "message": ""
}

Event ID 67: CallStack event description message: cValue.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Met task
Opcode: CallStack opcode

Description

CallStack event description message: cValue.

Message #

CallStack event description message: %1

Fields #

Name	Description
`cValue` UInt32
`Frame` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "67",
    "version": "0",
    "level": "4",
    "task": "8",
    "opcode": "10",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "cValue": "0",
    "Frame": "0x0"
  },
  "message": ""
}

Event ID 68: CallStackModule event description message: BaseAddress.

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: Met task
Opcode: CallStackModule opcode

Description

CallStackModule event description message: BaseAddress.

Message #

CallStackModule event description message: %1

Fields #

Name	Description
`BaseAddress` Pointer
`TimeDateStamp` UInt32
`Size` UInt32
`wzName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "68",
    "version": "0",
    "level": "4",
    "task": "8",
    "opcode": "11",
    "keywords": 9223372036854776320,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BaseAddress": "0x0",
    "TimeDateStamp": "0",
    "Size": "0",
    "wzName": ""
  },
  "message": ""
}

Event ID 69: PCX ContactInfoPropertyUpdate

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX ContactInfoPropertyUpdate Opcode

Description

PCX ContactInfoPropertyUpdate.

Message #

PCX ContactInfoPropertyUpdate

Fields #

Name	Description
`szFunction` AnsiString
`wzProperty` UnicodeString
`wzPrevValue` UnicodeString
`wzNewValue` UnicodeString
`wzUniqueKey` UnicodeString
`pPointer` Pointer

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-e8b2-47eb-8564-23e77e728cf3}",
    "event_source_name": "",
    "event_id": "69",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "47",
    "keywords": 4611686018427387920,
    "time_created": "2026-03-14T21:43:34.417263100+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "7880",
      "thread_id": "12836"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "szFunction": "CMsoContactInfo::HrSetContactProperty",
    "wzProperty": "ResolutionId",
    "wzPrevValue": "Empty Variant",
    "wzNewValue": "<resolutionId provider=\"AD\"><localId O365id=\"S::labuser@contoso.onmicrosoft.com::00000000-0000-0000-0000-000000000000\"/></resolutionId>",
    "wzUniqueKey": "",
    "pPointer": "0x2F449B99A60"
  },
  "message": ""
}

Event ID 70: MSO Logging

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: MSO Logging task
Opcode: MSO Logging Opcode

Description

MSO Logging.

Message #

MSO Logging

Fields #

Name	Description
`wzLogLine` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "70",
    "version": "0",
    "level": "4",
    "task": "9",
    "opcode": "48",
    "keywords": 9223372036854776832,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "wzLogLine": ""
  },
  "message": ""
}

Event ID 71: User requested opening of the New Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User requested opening of the New Unified Group dialog.

Message #

User requested opening of the New Unified Group dialog

Fields #

Name	Description
`dwEntrypoint` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "71",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwEntrypoint": "0"
  },
  "message": ""
}

Event ID 72: User dismissed the New Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User dismissed the New Unified Group dialog.

Message #

User dismissed the New Unified Group dialog

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "72",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 73: User requested creation of a Unified Group

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User requested creation of a Unified Group.

Message #

User requested creation of a Unified Group

Fields #

Name	Description
`dwGroupNameLength` UInt32
`dwGroupIdLength` UInt32
`dwGroupType` UInt32
`fAliasChanged` Boolean
`fAutoSubscribeChecked` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "73",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwGroupNameLength": "0",
    "dwGroupIdLength": "0",
    "dwGroupType": "0",
    "fAliasChanged": "false",
    "fAutoSubscribeChecked": "false"
  },
  "message": ""
}

Event ID 74: Create unified group operation finished

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Create unified group operation finished.

Message #

Create unified group operation finished

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "74",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0"
  },
  "message": ""
}

Event ID 75: Started check for group ID availability

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Started check for group ID availability.

Message #

Started check for group ID availability

Fields #

Name	Description
`dwGroupIdLength` UInt32
`fGroupIdManuallyEdited` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "75",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwGroupIdLength": "0",
    "fGroupIdManuallyEdited": "false"
  },
  "message": ""
}

Event ID 76: Started check for group ID availability

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Started check for group ID availability.

Message #

Started check for group ID availability

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32
`dwAvailbilityResult` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "76",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0",
    "dwAvailbilityResult": "0"
  },
  "message": ""
}

Event ID 77: User requested opening of the Edit Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User requested opening of the Edit Unified Group dialog.

Message #

User requested opening of the Edit Unified Group dialog

Fields #

Name	Description
`dwDialogType` UInt32
`dwEntrypoint` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "77",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwDialogType": "0",
    "dwEntrypoint": "0"
  },
  "message": ""
}

Event ID 78: User dismissed the Edit Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User dismissed the Edit Unified Group dialog.

Message #

User dismissed the Edit Unified Group dialog

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "78",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 79: User started edit of a Unified Group

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User started edit of a Unified Group.

Message #

User started edit of a Unified Group

Fields #

Name	Description
`dwDialogType` UInt32
`dwAddedMembersCount` UInt32
`dwRemovedMembersCount` UInt32
`dwAddedAdminsCount` UInt32
`dwRemovedAdminsCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "79",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwDialogType": "0",
    "dwAddedMembersCount": "0",
    "dwRemovedMembersCount": "0",
    "dwAddedAdminsCount": "0",
    "dwRemovedAdminsCount": "0"
  },
  "message": ""
}

Event ID 80: One of the operations involved in updating the group finished

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

One of the operations involved in updating the group finished.

Message #

One of the operations involved in updating the group finished

Fields #

Name	Description
`operationType` UInt32
`fResult` Boolean
`dwErrorType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "80",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "operationType": "0",
    "fResult": "false",
    "dwErrorType": "0"
  },
  "message": ""
}

Event ID 81: Edit Unified Group operation finished

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Edit Unified Group operation finished.

Message #

Edit Unified Group operation finished

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "81",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0"
  },
  "message": ""
}

Event ID 82: Edit group photo button was clicked

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Edit group photo button was clicked.

Message #

Edit group photo button was clicked

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "82",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 83: Group membership finished loading

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Group membership finished loading.

Message #

Group membership finished loading

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32
`dwMemberCount` UInt32
`dwAdminCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "83",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0",
    "dwMemberCount": "0",
    "dwAdminCount": "0"
  },
  "message": ""
}

Event ID 84: Group details finished loading

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Group details finished loading.

Message #

Group details finished loading

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "84",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0"
  },
  "message": ""
}

Event ID 85: User requested opening of the Edit Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User requested opening of the Edit Unified Group dialog.

Message #

User requested opening of the Edit Unified Group dialog

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "85",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 86: User dismissed the Edit Unified Group dialog

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User dismissed the Edit Unified Group dialog.

Message #

User dismissed the Edit Unified Group dialog

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "86",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 87: User started edit of a Unified Group

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

User started edit of a Unified Group.

Message #

User started edit of a Unified Group

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "87",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 88: Edit Unified Group operation finished

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Edit Unified Group operation finished.

Message #

Edit Unified Group operation finished

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "88",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0"
  },
  "message": ""
}

Event ID 89: Group card actions event, including open card, switch to members tab, and all actions on group cards

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: PCX General Opcode

Description

Group card actions event, including open card, switch to members tab, and all actions on group cards.

Message #

Group card actions event, including open card, switch to members tab, and all actions on group cards

Fields #

Name	Description
`dwActionType` UInt32
`dwEnvironment` UInt32
`dwHResult` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "89",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "21",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "dwActionType": "0",
    "dwEnvironment": "0",
    "dwHResult": "0"
  },
  "message": ""
}

Event ID 90: Group local folder creation finished

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Group local folder creation finished.

Message #

Group local folder creation finished

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "90",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 91: Bulk add members

Provider: Microsoft-Office-Events
Channel: OfficeDebugChannel
Level: Informational
Task: PCX task
Opcode: Info

Description

Bulk add members.

Message #

Bulk add members

Fields #

Name	Description
`fResult` Boolean
`dwErrorType` UInt32
`dwMemberCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Office-Events",
    "guid": "{8736922d-E8B2-47eb-8564-23E77E728CF3}",
    "event_source_name": "",
    "event_id": "91",
    "version": "0",
    "level": "4",
    "task": "3",
    "opcode": "0",
    "keywords": 9223372036854775824,
    "time_created": "2026-03-15T00:00:00.0000000+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{00000000-0000-0000-0000-000000000000}"
    },
    "execution": {
      "process_id": "0",
      "thread_id": "0"
    },
    "channel": "OfficeDebugChannel",
    "computer": "",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "fResult": "false",
    "dwErrorType": "0",
    "dwMemberCount": "0"
  },
  "message": ""
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 8736922d-e8b2-47eb-8564-23e77e728cf3

Defined in Program, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, binary version 16.0.17726.20016, captured 2026-06-02

Downloads

Microsoft-Office-Events registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)