Microsoft-Windows-AppModel-State
108 events across 3 channels
Event ID 1: Error while deleting file: Error_while_deleting_file.
#Event ID 2: Error while deleting directory: Error_while_deleting_directory.
#Event ID 4: ApiSet Function: ErrorString returned with Error Code: Error.
#Event ID 5: Low-level data store access error.
#Event ID 6: Cleanup of temporary state has been skipped due to low disk usage.
#Description
Cleanup of temporary state has been skipped due to low disk usage.
Message #
Event ID 7: Cleanup of temporary state has completed.
#Description
Cleanup of temporary state has completed.
Message #
Event ID 8: Cleanup of temporary state was unable to enumerate the user profiles.
#Event ID 9: Cleanup of temporary state has aborted unexpectedly.
#Description
Cleanup of temporary state has aborted unexpectedly.
Message #
Event ID 10: Failure to load the application settings for package ErrorString.
#Event ID 11: Failure to read an application setting for package ErrorString.
#Event ID 12: Failure to write an application setting for package ErrorString.
#Event ID 13: Failure to instantiate storage folder FolderString for package PackageString with Error Code: Error.
#Event ID 14: Need to update state locations of package PackageString for user UserSid because the schema is not found.
#Event ID 15: Need to update state locations of package PackageString for user UserSid because the package is not found.
#Event ID 16: Need to update state locations of package PackageString for user UserSid because the package full name has changed.
#Event ID 17: Need to update state locations of package PackageString for user UserSid because the schema version has changed.
#Event ID 18: Succeeded to fix state locations for package InformationalString.
#Event ID 19: Failure to fix state locations for package ErrorString.
#Event ID 20: Triggered repair because operation Operation against package PackageFamily hit error OperationError.
#Description
Triggered repair because operation Operation against package PackageFamily hit error OperationError.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PackageFamily UnicodeString | |
OperationError Int32 |
Event ID 21: Repair for operation Operation against package PackageFamily with error OperationError returned Error Code: RepairTriggerError.
#Description
Repair for operation Operation against package PackageFamily with error OperationError returned Error Code: RepairTriggerError.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PackageFamily UnicodeString | |
OperationError Int32 | |
RepairTriggerError Int32 |
Event ID 22: Folder path FolderPath failed access check: Error Code: Error.
#Event ID 23: Triggered repair of state locations because operation Operation against package PackageFamily hit error OperationError.
#Description
Triggered repair of state locations because operation Operation against package PackageFamily hit error OperationError.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PackageFamily UnicodeString | |
OperationError Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AppModel-State",
"guid": "{bff15e13-81bf-45ee-8b16-7cfead00da86}",
"event_source_name": "",
"event_id": 23,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-04-18 00:27:42.386351+00:00",
"event_record_id": 22,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 6800,
"thread_id": 6816
},
"channel": "Application",
"computer": "WIN11-25H2-X64",
"security": {
"user_id": "S-1-5-21-3798294047-1846905762-1150995898-1001"
}
},
"event_data": {
"Operation": "InitializeDataChangedSignaler",
"PackageFamily": "Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy",
"OperationError": "-2147024894"
},
"message": "Triggered repair of state locations because operation InitializeDataChangedSignaler against package Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy hit error -2147024894."
}
Event ID 24: Repair of state locations for operation Operation against package PackageFamily with error OperationError returned Error Code: RepairTriggerError.
#Description
Repair of state locations for operation Operation against package PackageFamily with error OperationError returned Error Code: RepairTriggerError.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PackageFamily UnicodeString | |
OperationError Int32 | |
RepairTriggerError Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AppModel-State",
"guid": "{bff15e13-81bf-45ee-8b16-7cfead00da86}",
"event_source_name": "",
"event_id": 24,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-04-18 00:27:42.493576+00:00",
"event_record_id": 23,
"correlation": {
"ActivityID": "",
"RelatedActivityID": ""
},
"execution": {
"process_id": 6800,
"thread_id": 6816
},
"channel": "Application",
"computer": "WIN11-25H2-X64",
"security": {
"user_id": "S-1-5-21-3798294047-1846905762-1150995898-1001"
}
},
"event_data": {
"Operation": "InitializeDataChangedSignaler",
"PackageFamily": "Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy",
"OperationError": "-2147024894",
"RepairTriggerError": "0"
},
"message": "Repair of state locations for operation InitializeDataChangedSignaler against package Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy with error -2147024894 returned Error Code: 0"
}
Event ID 50: AppModel.Task.State.WriteSettingStart
#Event ID 51: AppModel.Task.State.WriteSettingStop
#Event ID 60: AppModel.Task.State.ReadSettingStart
#Event ID 61: AppModel.Task.State.ReadSettingStop
#Event ID 70: AppModel.Task.State.DeleteSettingStart
#Event ID 71: AppModel.Task.State.DeleteSettingStop
#Event ID 80: AppModel.Task.State.WriteSettingInAtomStart
#Event ID 81: AppModel.Task.State.WriteSettingInAtomStop
#Event ID 90: AppModel.Task.State.ReadSettingInAtomStart
#Event ID 91: AppModel.Task.State.ReadSettingInAtomStop
#Event ID 100: AppModel.Task.State.DeleteSettingInAtomStart
#Event ID 101: AppModel.Task.State.DeleteSettingInAtomStop
#Event ID 110: AppModel.Task.State.CommitAtomStart
#Event ID 111: AppModel.Task.State.CommitAtomStop
#Event ID 120: AppModel.Task.State.LoadAppHiveStart
#Event ID 121: AppModel.Task.State.LoadAppHiveStop
#Event ID 150: AppModel.Task.StateWinRT.AppDataFactory_ActivationStart
#Event ID 151: AppModel.Task.StateWinRT.AppDataFactory_ActivationStop
#Event ID 160: AppModel.Task.StateWinRT.ApplicationDataServer_LifespanStart
#Event ID 161: AppModel.Task.StateWinRT.ApplicationDataServer_LifespanStop
#Event ID 170: AppModel.Task.StateWinRT.ApplicationDataServer_GetVersionStart
#Event ID 171: AppModel.Task.StateWinRT.ApplicationDataServer_GetVersionStop
#Event ID 180: AppModel.Task.StateWinRT.ApplicationDataServer_SetVersionStart
#Event ID 181: AppModel.Task.StateWinRT.ApplicationDataServer_SetVersionStop
#Event ID 190: AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuotaStart
#Event ID 191: AppModel.Task.StateWinRT.ApplicationDataServer_RoamingStorageQuotaStop
#Event ID 210: AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServerStart
#Event ID 211: AppModel.Task.StateWinRT.ApplicationDataServer_ActivateContainerServerStop
#Event ID 220: AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServerStart
#Event ID 221: AppModel.Task.StateWinRT.ApplicationDataServer_ActivateFileItemServerStop
#Event ID 230: AppModel.Task.StateWinRT.ApplicationDataContainerServer_LifespanStart
#Event ID 231: AppModel.Task.StateWinRT.ApplicationDataContainerServer_LifespanStop
#Event ID 240: AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValuesStart
#Event ID 241: AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetValuesStop
#Event ID 250: AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainersStart
#Event ID 251: AppModel.Task.StateWinRT.ApplicationDataContainerServer_GetContainersStop
#Event ID 260: AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainerStart
#Event ID 261: AppModel.Task.StateWinRT.ApplicationDataContainerServer_CreateContainerStop
#Event ID 270: AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainerStart
#Event ID 271: AppModel.Task.StateWinRT.ApplicationDataContainerServer_DeleteContainerStop
#Event ID 280: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_LifespanStart
#Event ID 281: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_LifespanStop
#Event ID 290: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_LookupStart
#Event ID 291: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_LookupStop
#Event ID 300: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_SizeStart
#Event ID 301: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_SizeStop
#Event ID 310: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKeyStart
#Event ID 311: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_HasKeyStop
#Event ID 320: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetViewStart
#Event ID 321: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_GetViewStop
#Event ID 330: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_InsertStart
#Event ID 331: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_InsertStop
#Event ID 340: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_RemoveStart
#Event ID 341: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_RemoveStop
#Event ID 350: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_ClearStart
#Event ID 351: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_ClearStop
#Event ID 360: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_FirstStart
#Event ID 361: AppModel.Task.StateWinRT.ApplicationDataContainerSettingsServer_FirstStop
#Event ID 370: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_LifespanStart
#Event ID 371: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_LifespanStop
#Event ID 380: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_LookupStart
#Event ID 381: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_LookupStop
#Event ID 390: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_SizeStart
#Event ID 391: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_SizeStop
#Event ID 400: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKeyStart
#Event ID 401: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_HasKeyStop
#Event ID 410: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetViewStart
#Event ID 411: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_GetViewStop
#Event ID 420: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_InsertStart
#Event ID 421: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_InsertStop
#Event ID 430: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_RemoveStart
#Event ID 431: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_RemoveStop
#Event ID 440: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_ClearStart
#Event ID 441: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_ClearStop
#Event ID 450: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstStart
#Event ID 451: AppModel.Task.StateWinRT.ApplicationDataCompositeValueServer_FirstStop
#Event ID 460: AppModel.Task.StateWinRT.RoamingRpcSignalStart
#Event ID 461: AppModel.Task.StateWinRT.RoamingRpcSignalStop
#Event ID 470: AppModel.Task.StateWinRT.DataChangedEventDispatchStart
#Event ID 471: AppModel.Task.StateWinRT.DataChangedEventDispatchStop
#Event ID 480: AppModel.Task.StateWinRT.TempCleanupStart
#Event ID 481: AppModel.Task.StateWinRT.TempCleanupStop
#Event ID 490: AppModel.Task.StateWinRT.ApplicationDataServer_ForUserStart
#Event ID 491: AppModel.Task.StateWinRT.ApplicationDataServer_ForUserStop
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID bff15e13-81bf-45ee-8b16-7cfead00da86
Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02