Microsoft-Windows-ApplicationExperienceInfrastructure
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | The application (AppName, from vendor VendorName) has the following problem: … | Application | N | N |
| 2 | The application (AppName, from vendor VendorName) was hard-blocked and raised … | Application | N | N |
| 3 | The application (AppName, from vendor VendorName) was detected containing legacy … | Application | N | N |
Event ID 1: The application (AppName, from vendor VendorName) has the following problem: Summary.
#Event ID 2: The application (AppName, from vendor VendorName) was hard-blocked and raised the following: Summary.
#Event ID 3: The application (AppName, from vendor VendorName) was detected containing legacy redistributable software.
#Provenance
ETW provider GUID 5ec13d8e-4b3f-422e-a7e7-3121a1d90c7a
Defined in apphelp.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB