Microsoft-Windows-All-User-Install-Agent
47 events across 4 channels
Event ID 256: The Windows All-User Install Agent could not schedule a package registration for session {Param1} and the user account {Param2}\{Param3}.
#Event ID 257: The Windows All-User Install Agent could not schedule a package registration for session {Param2}.
#Event ID 258: The Windows All-User Install Agent could not schedule a package registration for the user acccount {Param1}\{Param2} due to a security error.
#Event ID 259: The Windows All-User Install Agent could not register the package named {Param1} for the user account {Param2}\{Param3}.
#Event ID 260: The Windows All-User Install Agent successfully registered the package named {Param1} for the user account {Param2}\{Param3}.
#Event ID 261: The Windows All-User Install Agent could not retrieve user information from session {Param2}.
#Event ID 1280: The Windows All-User Install Agent started registering the package named {Param1} for the user account {Param2}\{Param3}.
#Event ID 1281: The Windows All-User Install Agent successfully registered the package named {Param1} for the user account {Param2}\{Param3}.
#Event ID 1282: The Windows All-User Install Agent could not register the package named {Param1} for the user account {Param2}\{Param3}.
#Event ID 1283: The Windows All-User Install Agent retrieved {Param1} packages for the user account {Param2}\{Param3} in {Param4} milliseconds.
#Event ID 1284: The Windows All-User Install Agent registered {Param1} packages for the user account {Param2}\{Param3} in {Param4} milliseconds.
#Event ID 1286: The Windows All-User Install Agent recovery request for the user account {Param1}\{Param2} failed with the following error code: {Param3}.
#Event ID 1287: A profile deletion triggered the Windows All-User Install Agent to uninstall all packages for the user profile Param1.
#Event ID 1288: The Windows All-User Install Agent could not remove PackageMoniker packages during the profile deletion of the user profile UserSid.
#Event ID 1289: The Windows All-User Install Agent detected an invalid user SID {UserSid}.
#Event ID 1290: The Windows All-User Install Agent could not unregister an application.
#Event ID 1291: The Windows All-User Install Agent cannot determine if user SID {UserSid} is a valid user account.
#Event ID 1292: The Windows All-User Install Agent cannot determine if user SID {UserSid} is a valid user account.
#Event ID 1293: The Windows All-User Install Agent detected that the user account {DomainName}\{AccountName} has been assigned a temporary or mandatory profile.
#Event ID 1294: The Windows All-User Install Agent starts package registration for user account {DomainName}\{AccountName} because of recovery action; detail code ...
#Event ID 1295: The Windows All-User Install Agent starts package registration for user account {DomainName}\{AccountName} because of new or updated application; d...
#Event ID 1296: The Windows All-User Install Agent starts package registration for user account {DomainName}\{AccountName} because of user has been assigned a temp...
#Event ID 1297: The Windows All-User Install Agent could not update timestamp for user user account {DomainName}\{AccountName}.
#Event ID 1298: Start the Windows All-User Install Agent to update packages for the user on session {SessId}.
#Event ID 1300: The Windows All-User Install Agent could not delete the registered packages after the profile was deleted for user SID Additional_information.
#Event ID 1301: The Windows All-User Install Agent detected an attempt to delete a temporary or mandatory profile for user SID Param1.
#Event ID 1302: The Windows All-User Install Agent will delete NumberOfPackages packages for user SID UserSid because the profile was deleted.
#Event ID 1303: The Windows All-User Install Agent could not retrieve a list of packages for user SID UserSid.
#Event ID 1304: The Windows All-User Install Agent will delete package Package for user SID UserSid because the profile was deleted.
#Event ID 1305: GetApplicability API failed to determine status of package Package.
#Event ID 1306: GetApplicability API has determined that package Package is either NotInstallable or RequiresReinstall.
#Event ID 1307: Dependent Package Package is already installed, registration will be skipped.
#Event ID 1312: Package registration is not required for user account {Param1}\{Param2}.
#Event ID 1313: The Windows All-User Install Agent is no longer waiting to register a package for user account {Param1}\{Param2}.
#Event ID 1314: The Windows All-User Install Agent is waiting to register a package for user account {Param1}\{Param2}.
#Event ID 1536: The Windows All-User Install Agent could not update the registration status for the package named {AppXPackage} for the user account {UserDomain}\{...
#Event ID 1537: The Windows All-User Install Agent could not to retrieve a list of packages for the user account {UserDomain}\{UserAccount}.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID d2e990da-8504-4702-a5e5-367fc2f823bf
Defined in RDSAppXHelper.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4767, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1150, captured 2026-06-02