Microsoft-Windows-AppReadiness

174 events across 3 channels

Event	Title	Channel	Sample
10	The Appx operation 'Operation' on 'PackageId' failed for user 'User' - Error.	Admin	Y
11	A exception was caught: Error.	Operational	Y
12	The Appx preview tile generation failed for user 'User': Error.	Admin	N
100	App Readiness service has started.	Admin	Y
101	App Readiness service has stopped.	Admin	Y
102	AppReadiness_Service_ThreadStart	Debug	N
103	AppReadiness_Service_ThreadStop	Operational	Y
104	App Readiness status changed to 'Status' (ExitCode: ExitCode).	Debug	N
105	Checking for service idle.	Operational	Y
106	'Data' has logged on.	Operational	Y
107	'Data' has logged off.	Operational	Y
108	AppReadiness_PackageChangeStart	Operational	Y
109	App Readiness service has been notified of new apps.	Admin	Y
110	App Readiness service has leaked ReferencesLeaked references.	Operational	N
111	App Readiness service failed to DisconnectAll COM Disconnectable Objects.	Admin	N
200	Started processing tasks for 'User'.	Debug	N
201	Finished processing tasks for 'User'.	Debug	N
205	Loaded queue for 'User' with NumPackages items.	Debug	N
206	'TaskId' started for User.	Debug	N
207	'TaskId' finished for User.	Debug	N
209	For 'User' has changed mode from 'From' to 'To'.	Admin	Y
210	App Readiness service has found new tasks for Data.	Admin	Y
211	App Readiness service has completed tasks for Data.	Admin	Y
212	NumPackages pre-installed apps found for SID.	Debug	N
213	'Package' Operation succeeded for Username.	Admin	Y
214	'Package' Operation failed for User.	Admin	Y
215	'Task' failed for Username.	Admin	N
216	Activity for 'User' has been suspended and will resume at ResumeAt.	Admin	Y
217	Activity for 'Data' has resumed.	Operational	Y
218	'Package' Operation failed for User and will be attempted after AttemptAfter.	Admin	Y
219	NumPackages pre-installed apps found for SID.	Operational	N
220	'Task' succeeded for Username.	Admin	Y
221	Task 'Task' created for Username.	Operational	N
222	'TaskId' was removed (Canceled: TaskCanceled) for 'User' due to new opposing …	Operational	N
223	Shutdown for 'User' has started.	Debug	N
224	Shutdown for 'User' has completed.	Debug	N
225	Canceling 'Task' for 'Username' due to shutdown.	Admin	N
226	During shutdown 'User' is waiting for tasks to complete.	Operational	N
227	'TaskId' was selected as the next task for User.	Debug	N
228	'Task' succeeded.	Debug	N
229	'TaskId' was selected as the next task.	Debug	N
230	App Readiness service has completed all tasks for user.	Debug	N
231	FWOpenPolicyStore starts.	Debug	N
232	FWOpenPolicyStore returns Data.	Admin	Y
233	FWClosePolicyStore starts.	Debug	N
234	FWClosePolicyStore returns Data.	Admin	Y
235	OnDemandRegisterAsync starts.	Debug	N
236	OnDemandRegisterAsync returns Data.	Admin	Y
237	OnDemandRegisterWaitForCompletion starts.	Debug	N
238	OnDemandRegisterWaitForCompletion returns Data.	Admin	Y
239	OnDemandRegister returns error ExitCode.	Admin	N
240	Task 'TaskId' is added for User, tasks: TaskCount.	Admin	Y
241	Task 'TaskId' is removed for User, tasks: TaskCount.	Admin	Y
300	Started 'TaskId' for 'User'.	Debug	N
301	Finished 'TaskId' for 'User' lasted Duration seconds.	Debug	N
302	Started group 'GroupId' for 'User'.	Debug	N
303	Finished group 'GroupId' for 'User' lasted Duration seconds.	Debug	N
304	During execution of 'GroupId' for 'User' task 'TaskId' failed.	Debug	N
305	Package 'PackageFamilyName' was removed from 'User' first login group.	Debug	N
306	For 'User' task 'TaskId' was canceled.	Operational	N
307	Finished activation of 'PackageFamilyName' for 'User'.	Operational	N
308	Preview tile creation failed 'User' for Error.	Admin	N
309	Starting registry flush for 'Data'.	Operational	Y
310	Finished registry flush for 'Data'.	Operational	Y
311	Failed to flush registry key 'Key' for 'User'.	Admin	N
312	Successfully created NumPackages preview tiles for User.	Operational	N
313	'Group' is canceling 'Task' for 'User' as a result of cancel.	Operational	N
314	'Group' has selected 'Task' for 'User' for the next task.	Debug	N
315	'PackageFamilyName' was removed from 'User' first login group.	Operational	N
316	Installing 'PackageFamilyName' for 'User' has hit the in-activity timeout.	Admin	N
317	Starting pre-registration of 'PackageId'.	Debug	N
318	Completed pre-registration of 'PackageId'.	Debug	N
319	Pre-registration for 'PackageId' failed.	Admin	Y
320	Failed to flush registry key 'Key'.	Admin	N
321	OnDemandRegisterAsync starts.	Debug	N
322	OnDemandRegisterAsync returns ExitCode.	Admin	Y
323	OnDemandRegisterWaitForCompletion starts.	Debug	N
324	OnDemandRegisterWaitForCompletion returns ExitCode.	Admin	Y
325	OnDemandRegister returns error ExitCode.	Admin	N
326	OnDemandRegisterAsync starts.	Debug	N
327	OnDemandRegisterAsync returns ExitCode.	Admin	N
328	OnDemandRegisterWaitForCompletion starts.	Debug	N
329	OnDemandRegisterWaitForCompletion returns ExitCode.	Admin	N
330	OnDemandRegister returns error ExitCode.	Admin	N
331	Importing package status for user userSid completed with hr=Result.	Admin	N
332	Task 'TaskType' is performed from ARS for OneTimeRegistration on package …	Admin	Y
1001	API Enter for 'User' (Process: ProcessId).	Operational	N
1002	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1003	API Enter for 'User' (Process: ProcessId).	Operational	N
1004	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1005	API Enter for 'User' (Process: ProcessId).	Operational	N
1006	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1009	API Enter for 'User' (Process: ProcessId).	Operational	N
1010	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1013	API Enter for 'User' (Process: ProcessId).	Operational	N
1014	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1015	API Enter for 'User' (Process: ProcessId).	Operational	N
1016	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1017	API Enter for 'User' (Process: ProcessId).	Operational	N
1018	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1019	API Enter for 'User' (Process: ProcessId).	Operational	N
1020	API Exit for 'Result' (Process: User Result: ProcessId).	Operational	N
1021	DisableInAuditMode registry value set to block API calls while in audit mode …	Admin	N
2000	AppReadiness_ScorePackageStart	Debug	N
2001	AppReadiness_ScorePackageStop	Debug	N
2002	AppReadiness_ScorePackage	Debug	N
2003	AppReadiness_ScorePackage2003	Debug	N
2005	AppReadiness_ScorePackage2005	Debug	N
2006	AppReadiness_ScorePackage2006	Debug	N
2007	AppReadiness_ScorePackage2007	Debug	N
2008	AppReadiness_ScorePackage2008	Debug	N
2009	AppReadiness_ScorePackage2009	Debug	N
2010	AppReadiness_ScorePackage2010	Debug	N
2500	AppReadiness_BrokerSessionStart	Debug	N
2501	AppReadiness_BrokerSessionStop	Debug	N
2502	AppReadiness_BrokerSession	Debug	N
2503	AppReadiness_BrokerSession2503	Debug	N
2504	AppReadiness_BrokerSession2504	Operational	N
3000	AppReadiness_PerfTrackStart	Debug	N
3001	AppReadiness_PerfTrackStop	Debug	N
4000	AppReadiness_TriggerTask_Run	Operational	N
4001	AppReadiness_MaintenanceTask_Run	Operational	N
5000	AppReadiness_TimelineStart	Debug	N
5001	AppReadiness_TimelineStop	Debug	N
5002	AppReadiness_TimelineStart5002	Debug	N
5003	AppReadiness_TimelineStop5003	Debug	N
5004	AppReadiness_TimelineStart5004	Debug	N
5005	AppReadiness_TimelineStop5005	Debug	N
5006	AppReadiness_TimelineStart5006	Debug	N
5007	AppReadiness_TimelineStop5007	Debug	N
5008	AppReadiness_TimelineStart5008	Debug	N
5009	AppReadiness_TimelineStop5009	Debug	N
5010	AppReadiness_TimelineStart5010	Debug	N
5011	AppReadiness_TimelineStop5011	Debug	N
5012	AppReadiness_TimelineStart5012	Debug	N
5013	AppReadiness_TimelineStop5013	Debug	N
5014	AppReadiness_TimelineStart5014	Debug	N
5015	AppReadiness_TimelineStop5015	Debug	N
5016	AppReadiness_TimelineStart5016	Debug	N
5017	AppReadiness_TimelineStop5017	Debug	N
5018	AppReadiness_TimelineStart5018	Debug	N
5019	AppReadiness_TimelineStop5019	Debug	N
5020	AppReadiness_TimelineStart5020	Debug	N
5021	AppReadiness_TimelineStop5021	Debug	N
5022	AppReadiness_TimelineStart5022	Debug	N
5023	AppReadiness_TimelineStop5023	Debug	N
5024	AppReadiness_TimelineStart5024	Debug	N
5025	AppReadiness_TimelineStop5025	Debug	N
5026	AppReadiness_TimelineStart5026	Debug	N
5027	AppReadiness_TimelineStop5027	Debug	N
5028	AppReadiness_TimelineStart5028	Debug	N
5029	AppReadiness_TimelineStop5029	Debug	N
5030	AppReadiness_TimelineStart5030	Debug	N
5031	AppReadiness_TimelineStop5031	Debug	N
5032	AppReadiness_TimelineStart5032	Debug	N
5033	AppReadiness_TimelineStop5033	Debug	N
5034	AppReadiness_TimelineStart5034	Debug	N
5035	AppReadiness_TimelineStop5035	Debug	N
5036	AppReadiness_TimelineStart5036	Debug	N
5037	AppReadiness_TimelineStop5037	Debug	N
5038	AppReadiness_TimelineStart5038	Debug	N
5039	AppReadiness_TimelineStop5039	Debug	N
5040	AppReadiness_TimelineStart5040	Debug	N
5041	AppReadiness_TimelineStop5041	Debug	N
5042	AppReadiness_TimelineStart5042	Debug	N
5043	AppReadiness_TimelineStop5043	Debug	N
5044	User : failed determine if tiles are missing.	Admin	N
5045	User : failed to repair missing tiles.	Admin	N
5046	User : missing tiles detected.	Admin	N
5047	User : missing tiles repaired.	Admin	N
5048	AppReadiness_TimelineStart5048	Debug	N
5049	AppReadiness_TimelineStop5049	Debug	N
5050	AppReadiness_TimelineStart5050	Debug	N
5051	AppReadiness_TimelineStop5051	Debug	N

Event ID 10: The Appx operation 'Operation' on 'PackageId' failed for user 'User' - Error.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Error
Task: AppReadiness_Error

Description

The Appx operation 'Operation' on 'PackageId' failed for user 'User' - Error. (Error: Result).

Message #

The Appx operation '%2' on '%3' failed for user '%1' - %5. (Error: %4)

Fields #

Name	Description
`User` UnicodeString
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`PackageId` UnicodeString
`Result` Int32	5. (Error.
`Error` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 10,
    "version": 0,
    "level": 2,
    "task": 6,
    "opcode": 0,
    "keywords": 9223372036854775936,
    "time_created": "2023-11-05T22:29:17.204020+00:00",
    "event_record_id": 445,
    "correlation": {
      "ActivityID": "59A0D65F-1037-0001-E4F0-A0593710DA01"
    },
    "execution": {
      "process_id": 5660,
      "thread_id": 5712
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "Operation": "RegisterPackageAsync",
    "PackageId": "Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe",
    "Result": -2147009274,
    "Error": "Windows cannot install package Microsoft.VCLibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe because it has version 14.0.30704.0. A higher version 14.0.32530.0 of this package is already installed."
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 11: A exception was caught: Error.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Warning
Task: AppReadiness_Error

Description

A exception was caught: Error.

Message #

A exception was caught: %1.

Fields #

Name	Description
`Error` Int32	A exception was caught.
`Expression` AnsiString
`Function` AnsiString
`File` AnsiString
`Line` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 11,
    "version": 0,
    "level": 3,
    "task": 6,
    "opcode": 0,
    "keywords": 4611686018427388032,
    "time_created": "2023-11-05T22:33:30.809965+00:00",
    "event_record_id": 23,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-3975-DBE43710DA01"
    },
    "execution": {
      "process_id": 4952,
      "thread_id": 7936
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Error": "2\u0000\u0007�",
    "Expression": "result",
    "Function": "AppReadiness::Tasks::RegisterPackage::OnExecute",
    "File": "onecoreuap\\shell\\appreadiness\\src\\tasks\\registerpackage.cpp",
    "Line": "\u001a\u0001"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 12: The Appx preview tile generation failed for user 'User': Error.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_Error

Description

The Appx preview tile generation failed for user 'User': Error. (Result: Result).

Message #

The Appx preview tile generation failed for user '%1': %2. (Result: %3)

Fields #

Name	Description
`User` UnicodeString
`Error` UnicodeString
`Result` Int32

Event ID 100: App Readiness service has started.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_Service_Lifetime
Opcode: Start

Description

App Readiness service has started.

Message #

App Readiness service has started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 1,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-28T11:12:58.5538938+00:00",
    "event_record_id": 162,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 5004
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "App Readiness service has started."
}

Event ID 101: App Readiness service has stopped.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_Service_Lifetime
Opcode: Stop

Description

App Readiness service has stopped.

Message #

App Readiness service has stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 2,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-28T18:32:58.4365543+00:00",
    "event_record_id": 279,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "App Readiness service has stopped."
}

Event ID 102: AppReadiness_Service_ThreadStart

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Service_Thread
Opcode: Start

Event ID 103: AppReadiness_Service_ThreadStop

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_Service_Thread
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 4,
    "task": 14,
    "opcode": 2,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-28T18:32:58.4365565+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 104: App Readiness status changed to 'Status' (ExitCode: ExitCode).

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Service

Description

App Readiness status changed to 'Status' (ExitCode: ExitCode).

Message #

App Readiness status changed to '%1' (ExitCode: %2)

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ExitCode` HexInt32

Event ID 105: Checking for service idle.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_Service

Description

Checking for service idle. (Result=IsIdle, Reason=Reason).

Message #

Checking for service idle. (Result=%1, Reason=%2)

Fields #

Name	Description
`IsIdle` Boolean
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-28T18:32:58.4206590+00:00",
    "event_record_id": 13,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "IsIdle": "true",
    "Reason": "None"
  },
  "message": "Checking for service idle. (Result=true, Reason=None)"
}

Event ID 106: 'Data' has logged on.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_Service

Description

'Data' has logged on.

Message #

'%1' has logged on.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-04-18T00:30:42.7870385+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 5112,
      "thread_id": 5116
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-3798294047-1846905762-1150995898-1000"
  },
  "message": "'S-1-5-21-3798294047-1846905762-1150995898-1000' has logged on."
}

Event ID 107: 'Data' has logged off.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_Service

Description

'Data' has logged off.

Message #

'%1' has logged off.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 107,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-04-18T00:33:59.1739681+00:00",
    "event_record_id": 14,
    "correlation": {},
    "execution": {
      "process_id": 5112,
      "thread_id": 5116
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-3798294047-1846905762-1150995898-1000"
  },
  "message": "'S-1-5-21-3798294047-1846905762-1150995898-1000' has logged off."
}

Event ID 108: AppReadiness_PackageChangeStart

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_PackageChange
Opcode: Start

Fields #

Name	Description
`Source`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 1,
    "keywords": 4611686018427387905,
    "time_created": "2026-05-16T01:56:11.3699087+00:00",
    "event_record_id": 20,
    "correlation": {},
    "execution": {
      "process_id": 8240,
      "thread_id": 3188
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Source": "2"
  },
  "message": ""
}

Event ID 109: App Readiness service has been notified of new apps.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_PackageChange
Opcode: Stop

Description

App Readiness service has been notified of new apps. (Source: Source, Error: Result).

Message #

App Readiness service has been notified of new apps. (Source: %1, Error: %2)

Fields #

Name	Description
`Source` UInt32	App Readiness service has been notified of new apps. (Source.
`Result` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 2,
    "keywords": -9223372036854775807,
    "time_created": "2026-05-16T01:56:11.3784143+00:00",
    "event_record_id": 310,
    "correlation": {},
    "execution": {
      "process_id": 8240,
      "thread_id": 3188
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WIN11-25H2-X64",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Source": "2",
    "Result": "0"
  },
  "message": "App Readiness service has been notified of new apps. (Source: DISM, Error: The operation completed successfully.)"
}

Event ID 110: App Readiness service has leaked ReferencesLeaked references.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Service

Description

App Readiness service has leaked ReferencesLeaked references. This could delay the system shutdown by ShutdownDelayMsec milliseconds.

Message #

App Readiness service has leaked %1 references. This could delay the system shutdown by %2 milliseconds.

Fields #

Name	Description
`ReferencesLeaked` UInt32
`ShutdownDelayMsec` UInt32

Event ID 111: App Readiness service failed to DisconnectAll COM Disconnectable Objects.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_Service_Lifetime

Description

App Readiness service failed to DisconnectAll COM Disconnectable Objects. (Result: Result).

Message #

App Readiness service failed to DisconnectAll COM Disconnectable Objects. (Result: %1)

Fields #

Name	Description
`Result` Int32

Event ID 200: Started processing tasks for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

Started processing tasks for 'User'.

Message #

Started processing tasks for '%1'.

Fields #

Name	Description
`User` UnicodeString

Event ID 201: Finished processing tasks for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

Finished processing tasks for 'User'.

Message #

Finished processing tasks for '%1'.

Fields #

Name	Description
`User` UnicodeString

Event ID 205: Loaded queue for 'User' with NumPackages items.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

Loaded queue for 'User' with NumPackages items.

Message #

Loaded queue for '%1' with %2 items.

Fields #

Name	Description
`User` UnicodeString
`NumPackages` UInt32
`PackageInfo` UnicodeString

Event ID 206: 'TaskId' started for User.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

'TaskId' started for User. (Priority: Priority).

Message #

'%2' started for %1. (Priority: %3)

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`Priority` UInt32

Event ID 207: 'TaskId' finished for User.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

'TaskId' finished for User. (Result: Result).

Message #

'%2' finished for %1. (Result: %3)

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`Result` Int32

Event ID 209: For 'User' has changed mode from 'From' to 'To'.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

For 'User' has changed mode from 'From' to 'To'.

Message #

For '%1' has changed mode from '%2' to '%3'

Fields #

Name	Description
`User` UnicodeString
`From` UInt32
`To` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 209,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T18:32:58.4209393+00:00",
    "event_record_id": 278,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1544
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-18",
    "From": "2",
    "To": "3"
  },
  "message": "For 'S-1-5-18' has changed mode from 'AfterLogon' to 'LoggingOff'"
}

Event ID 210: App Readiness service has found new tasks for Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

App Readiness service has found new tasks for Data.

Message #

App Readiness service has found new tasks for %1.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 210,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-29T01:34:22.5031862+00:00",
    "event_record_id": 577,
    "correlation": {
      "ActivityID": "{1E166117-EF0B-0003-0F67-161E0BEFDC01}"
    },
    "execution": {
      "process_id": 6956,
      "thread_id": 7076
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1104"
  },
  "message": "App Readiness service has found new tasks for S-1-5-21-1006758700-2167138679-1475694448-1104."
}

Event ID 211: App Readiness service has completed tasks for Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

App Readiness service has completed tasks for Data.

Message #

App Readiness service has completed tasks for %1.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 211,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T18:29:53.2515346+00:00",
    "event_record_id": 276,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1712
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "App Readiness service has completed tasks for S-1-5-21-1006758700-2167138679-1475694448-1105."
}

Event ID 212: NumPackages pre-installed apps found for SID.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

NumPackages pre-installed apps found for SID.

Message #

%2 pre-installed apps found for %1

Fields #

Name	Description
`SID` UnicodeString
`NumPackages` UInt32
`PackageFamilyName` UnicodeString

Event ID 213: 'Package' Operation succeeded for Username.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

'Package' Operation succeeded for Username. (Elapsed seconds).

Message #

'%2' %3 succeeded for %1. (%4 seconds)

Fields #

Name	Description
`Username` UnicodeString
`Package` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Elapsed` Double

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 213,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T18:29:53.2211084+00:00",
    "event_record_id": 273,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1664
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Username": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Package": "MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy",
    "Operation": "1",
    "Elapsed": "0.2968787"
  },
  "message": "'MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy' install succeeded for S-1-5-21-1006758700-2167138679-1475694448-1105. (0.2968787 seconds)"
}

Event ID 214: 'Package' Operation failed for User.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Error
Task: AppReadiness_User_ProcessTasks

Description

'Package' Operation failed for User. Error: 'Error' (Elapsed seconds).

Message #

'%2' %3 failed for %1. Error: '%4' (%5 seconds)

Fields #

Name	Description
`User` UnicodeString
`Package` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Error` Int32
`Elapsed` Double

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 214,
    "version": 0,
    "level": 2,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775810,
    "time_created": "2023-11-05T22:33:30.819207+00:00",
    "event_record_id": 604,
    "correlation": {},
    "execution": {
      "process_id": 4952,
      "thread_id": 2436
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "Package": "Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe",
    "Operation": 1,
    "Error": -2147024846,
    "Elapsed": "0.2400311"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 215: 'Task' failed for Username.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_User_ProcessTasks

Description

'Task' failed for Username. Error: 'Error' (Elapsed seconds).

Message #

'%2' failed for %1. Error: '%3' (%4 seconds)

Fields #

Name	Description
`Username` UnicodeString
`Task` UnicodeString
`Error` Int32
`Elapsed` Double

Event ID 216: Activity for 'User' has been suspended and will resume at ResumeAt.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

Activity for 'User' has been suspended and will resume at ResumeAt.

Message #

Activity for '%1' has been suspended and will resume at %2.

Fields #

Name	Description
`User` UnicodeString
`ResumeAt` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 216,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T11:13:15.6677745+00:00",
    "event_record_id": 228,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "ResumeAt": "2026-05-28T11:29:15.6650000Z"
  },
  "message": "Activity for 'S-1-5-21-1006758700-2167138679-1475694448-1105' has been suspended and will resume at ‎2026‎-‎05‎-‎28T11:29:15.665000000Z."
}

Event ID 217: Activity for 'Data' has resumed.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

Activity for 'Data' has resumed.

Message #

Activity for '%1' has resumed.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 217,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 4611686018427387906,
    "time_created": "2026-05-28T18:29:15.4990919+00:00",
    "event_record_id": 12,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 6936
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "Activity for 'S-1-5-21-1006758700-2167138679-1475694448-1105' has resumed."
}

Event ID 218: 'Package' Operation failed for User and will be attempted after AttemptAfter.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

'Package' Operation failed for User and will be attempted after AttemptAfter.

Message #

'%2' %3 failed for %1 and will be attempted after %5.

Fields #

Name	Description
`User` UnicodeString
`Package` UnicodeString
`Operation` UInt32	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`Error` Int32
`AttemptAfter` FILETIME

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 218,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 9223372036854775810,
    "time_created": "2023-11-05T22:33:30.819200+00:00",
    "event_record_id": 602,
    "correlation": {},
    "execution": {
      "process_id": 4952,
      "thread_id": 2436
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1992711665-1655669231-58201500-1000",
    "Package": "Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe",
    "Operation": 1,
    "Error": -2147024846,
    "AttemptAfter": "2023-11-05T22:38:30.805815Z"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 219: NumPackages pre-installed apps found for SID.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_User_ProcessTasks

Description

NumPackages pre-installed apps found for SID.

Message #

%2 pre-installed apps found for %1

Fields #

Name	Description
`SID` UnicodeString
`NumPackages` UInt32
`PackageFamilyName` UnicodeString

Event ID 220: 'Task' succeeded for Username.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

'Task' succeeded for Username. (Elapsed seconds).

Message #

'%2' succeeded for %1. (%3 seconds)

Fields #

Name	Description
`Username` UnicodeString
`Task` UnicodeString
`Elapsed` Double

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 220,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T18:29:53.2455762+00:00",
    "event_record_id": 275,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1712
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Username": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "Task": "ART:OemFirstRun",
    "Elapsed": "0"
  },
  "message": "'ART:OemFirstRun' succeeded for S-1-5-21-1006758700-2167138679-1475694448-1105. (0 seconds)"
}

Event ID 221: Task 'Task' created for Username.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_User_ProcessTasks

Description

Task 'Task' created for Username.

Message #

Task '%2' created for %1.

Fields #

Name	Description
`Username` UnicodeString
`Task` UnicodeString

Event ID 222: 'TaskId' was removed (Canceled: TaskCanceled) for 'User' due to new opposing task of type OpposingOperation.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_User_ProcessTasks

Description

'TaskId' was removed (Canceled: TaskCanceled) for 'User' due to new opposing task of type OpposingOperation.

Message #

'%2' was removed (Canceled: %4) for '%1' due to new opposing task of type %3.

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`OpposingOperation` UInt32
`TaskCanceled` Boolean

Event ID 223: Shutdown for 'User' has started.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_Shutdown
Opcode: Start

Description

Shutdown for 'User' has started.

Message #

Shutdown for '%1' has started.

Fields #

Name	Description
`User` UnicodeString

Event ID 224: Shutdown for 'User' has completed.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_Shutdown
Opcode: Stop

Description

Shutdown for 'User' has completed.

Message #

Shutdown for '%1' has completed.

Fields #

Name	Description
`User` UnicodeString

Event ID 225: Canceling 'Task' for 'Username' due to shutdown.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_User_Shutdown

Description

Canceling 'Task' for 'Username' due to shutdown.

Message #

Canceling '%2' for '%1' due to shutdown.

Fields #

Name	Description
`Username` UnicodeString
`Task` UnicodeString

Event ID 226: During shutdown 'User' is waiting for tasks to complete.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_User_Shutdown

Description

During shutdown 'User' is waiting for tasks to complete.

Message #

During shutdown '%1' is waiting for tasks to complete.

Fields #

Name	Description
`User` UnicodeString

Event ID 227: 'TaskId' was selected as the next task for User.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

'TaskId' was selected as the next task for User. (Priority=Priority).

Message #

'%2' was selected as the next task for %1. (Priority=%3)

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`Priority` UInt32

Event ID 228: 'Task' succeeded.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

'Task' succeeded. (Elapsed seconds).

Message #

'%1' succeeded. (%2 seconds)

Fields #

Name	Description
`Task` UnicodeString
`Elapsed` Double

Event ID 229: 'TaskId' was selected as the next task.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

'TaskId' was selected as the next task. (Priority=Priority).

Message #

'%1' was selected as the next task. (Priority=%2)

Fields #

Name	Description
`TaskId` UnicodeString
`Priority` UInt32

Event ID 230: App Readiness service has completed all tasks for user.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks

Description

App Readiness service has completed all tasks for user.

Message #

App Readiness service has completed all tasks for user.

Event ID 231: FWOpenPolicyStore starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

FWOpenPolicyStore starts.

Message #

FWOpenPolicyStore starts.

Event ID 232: FWOpenPolicyStore returns Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

FWOpenPolicyStore returns Data.

Message #

FWOpenPolicyStore returns %1.

Fields #

Name	Description
`ExitCode`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 232,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T11:12:58.7245836+00:00",
    "event_record_id": 164,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 2376
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "FWOpenPolicyStore returns 0x0."
}

Event ID 233: FWClosePolicyStore starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

FWClosePolicyStore starts.

Message #

FWClosePolicyStore starts.

Event ID 234: FWClosePolicyStore returns Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

FWClosePolicyStore returns Data.

Message #

FWClosePolicyStore returns %1.

Fields #

Name	Description
`ExitCode`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": -9223372036854775806,
    "time_created": "2026-05-28T11:13:19.4017028+00:00",
    "event_record_id": 233,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "FWClosePolicyStore returns 0x0."
}

Event ID 235: OnDemandRegisterAsync starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

OnDemandRegisterAsync starts.

Message #

OnDemandRegisterAsync starts.

Event ID 236: OnDemandRegisterAsync returns Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

OnDemandRegisterAsync returns Data.

Message #

OnDemandRegisterAsync returns %1.

Fields #

Name	Description
`ExitCode`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 236,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-29T01:34:15.8633898+00:00",
    "event_record_id": 574,
    "correlation": {
      "ActivityID": "{1E166117-EF0B-0003-0F67-161E0BEFDC01}"
    },
    "execution": {
      "process_id": 6956,
      "thread_id": 7076
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "OnDemandRegisterAsync returns 0x0."
}

Event ID 237: OnDemandRegisterWaitForCompletion starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_User_ProcessTasks
Opcode: Start

Description

OnDemandRegisterWaitForCompletion starts.

Message #

OnDemandRegisterWaitForCompletion starts.

Event ID 238: OnDemandRegisterWaitForCompletion returns Data.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

OnDemandRegisterWaitForCompletion returns Data.

Message #

OnDemandRegisterWaitForCompletion returns %1.

Fields #

Name	Description
`ExitCode`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 238,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-29T01:34:22.4875532+00:00",
    "event_record_id": 575,
    "correlation": {
      "ActivityID": "{1E166117-EF0B-0003-0F67-161E0BEFDC01}"
    },
    "execution": {
      "process_id": 6956,
      "thread_id": 7076
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-W11-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "OnDemandRegisterWaitForCompletion returns 0x0."
}

Event ID 239: OnDemandRegister returns error ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_User_ProcessTasks
Opcode: Stop

Description

OnDemandRegister returns error ExitCode.

Message #

OnDemandRegister returns error %1.

Fields #

Name	Description
`ExitCode` HexInt32

Event ID 240: Task 'TaskId' is added for User, tasks: TaskCount.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

Task 'TaskId' is added for User, tasks: TaskCount.

Message #

Task '%2' is added for %1, tasks: %3

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`TaskCount` UInt32	1, tasks.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 240,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-28T11:13:19.3590464+00:00",
    "event_record_id": 231,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 6660
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "TaskId": "ART:OemFirstRun",
    "TaskCount": "21"
  },
  "message": "Task 'ART:OemFirstRun' is added for S-1-5-21-1006758700-2167138679-1475694448-1105, tasks: 21"
}

Event ID 241: Task 'TaskId' is removed for User, tasks: TaskCount.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_User_ProcessTasks

Description

Task 'TaskId' is removed for User, tasks: TaskCount.

Message #

Task '%2' is removed for %1, tasks: %3

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`TaskCount` UInt32	1, tasks.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 241,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-28T18:29:53.2455726+00:00",
    "event_record_id": 274,
    "correlation": {},
    "execution": {
      "process_id": 1912,
      "thread_id": 1712
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105",
    "TaskId": "ART:OemFirstRun",
    "TaskCount": "0"
  },
  "message": "Task 'ART:OemFirstRun' is removed for S-1-5-21-1006758700-2167138679-1475694448-1105, tasks: 0"
}

Event ID 300: Started 'TaskId' for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

Started 'TaskId' for 'User'.

Message #

Started '%2' for '%1'

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString

Event ID 301: Finished 'TaskId' for 'User' lasted Duration seconds.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

Finished 'TaskId' for 'User' lasted Duration seconds. (Result).

Message #

Finished '%2' for '%1' lasted %4 seconds. (%3)

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString
`Result` Int32
`Duration` Double

Event ID 302: Started group 'GroupId' for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

Started group 'GroupId' for 'User'.

Message #

Started group '%2' for '%1'

Fields #

Name	Description
`User` UnicodeString
`GroupId` UnicodeString

Event ID 303: Finished group 'GroupId' for 'User' lasted Duration seconds.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

Finished group 'GroupId' for 'User' lasted Duration seconds. (Result).

Message #

Finished group '%2' for '%1' lasted %4 seconds. (%3)

Fields #

Name	Description
`User` UnicodeString
`GroupId` UnicodeString
`Result` Int32
`Duration` Double

Event ID 304: During execution of 'GroupId' for 'User' task 'TaskId' failed.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask

Description

During execution of 'GroupId' for 'User' task 'TaskId' failed. (Error: Result).

Message #

During execution of '%2' for '%1' task '%3' failed. (Error: %4)

Fields #

Name	Description
`User` UnicodeString
`GroupId` UnicodeString
`TaskId` UnicodeString
`Result` Int32

Event ID 305: Package 'PackageFamilyName' was removed from 'User' first login group.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask

Description

Package 'PackageFamilyName' was removed from 'User' first login group. (Reason: Reason).

Message #

Package '%2' was removed from '%1' first login group. (Reason: %3)

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Reason` UnicodeString

Event ID 306: For 'User' task 'TaskId' was canceled.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_ExecuteTask

Description

For 'User' task 'TaskId' was canceled.

Message #

For '%1' task '%2' was canceled.

Fields #

Name	Description
`User` UnicodeString
`TaskId` UnicodeString

Event ID 307: Finished activation of 'PackageFamilyName' for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_ExecuteTask

Description

Finished activation of 'PackageFamilyName' for 'User'. (Result: Reason).

Message #

Finished activation of '%2' for '%1'. (Result: %3)

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Reason` UnicodeString

Event ID 308: Preview tile creation failed 'User' for Error.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

Preview tile creation failed 'User' for Error. (Source: PackageFamilyName, Error: Source).

Message #

Preview tile creation failed '%2' for %1. (Source: %3, Error: %4)

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Source` UInt32
`Result` Int32

Event ID 309: Starting registry flush for 'Data'.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

Starting registry flush for 'Data'.

Message #

Starting registry flush for '%1'.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 309,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": 4611686018427387908,
    "time_created": "2026-05-28T11:13:15.6672972+00:00",
    "event_record_id": 9,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "Starting registry flush for 'S-1-5-21-1006758700-2167138679-1475694448-1105'."
}

Event ID 310: Finished registry flush for 'Data'.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Level: Informational
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

Finished registry flush for 'Data'.

Message #

Finished registry flush for '%1'.

Fields #

Name	Description
`User`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 310,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": 4611686018427387908,
    "time_created": "2026-05-28T11:13:15.6673865+00:00",
    "event_record_id": 10,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "User": "S-1-5-21-1006758700-2167138679-1475694448-1105"
  },
  "message": "Finished registry flush for 'S-1-5-21-1006758700-2167138679-1475694448-1105'."
}

Event ID 311: Failed to flush registry key 'Key' for 'User'.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

Failed to flush registry key 'Key' for 'User'. (Error: Result).

Message #

Failed to flush registry key '%2' for '%1'. (Error: %3)

Fields #

Name	Description
`User` UnicodeString
`Key` UnicodeString
`Result` UInt32

Event ID 312: Successfully created NumPackages preview tiles for User.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_ExecuteTask

Description

Successfully created NumPackages preview tiles for User. (Source: Source).

Message #

Successfully created %3 preview tiles for %1. (Source: %2)

Fields #

Name	Description
`User` UnicodeString
`Source` UInt32
`NumPackages` UInt32
`PackageFamilyName` UnicodeString

Event ID 313: 'Group' is canceling 'Task' for 'User' as a result of cancel.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_ExecuteTask

Description

'Group' is canceling 'Task' for 'User' as a result of cancel.

Message #

'%2' is canceling '%3' for '%1' as a result of cancel.

Fields #

Name	Description
`User` UnicodeString
`Group` UnicodeString
`Task` UnicodeString

Event ID 314: 'Group' has selected 'Task' for 'User' for the next task.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask

Description

'Group' has selected 'Task' for 'User' for the next task.

Message #

'%2' has selected '%3' for '%1' for the next task.

Fields #

Name	Description
`User` UnicodeString
`Group` UnicodeString
`Task` UnicodeString

Event ID 315: 'PackageFamilyName' was removed from 'User' first login group.

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_ExecuteTask

Description

'PackageFamilyName' was removed from 'User' first login group. (Reason: Reason).

Message #

'%2' was removed from '%1' first login group. (Reason: %3)

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Reason` UnicodeString

Event ID 316: Installing 'PackageFamilyName' for 'User' has hit the in-activity timeout.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

Installing 'PackageFamilyName' for 'User' has hit the in-activity timeout.

Message #

Installing '%2' for '%1' has hit the in-activity timeout

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 317: Starting pre-registration of 'PackageId'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_PreRegister_Package
Opcode: Start

Description

Starting pre-registration of 'PackageId'.

Message #

Starting pre-registration of '%1'

Fields #

Name	Description
`PackageId` UnicodeString

Event ID 318: Completed pre-registration of 'PackageId'.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_PreRegister_Package
Opcode: Stop

Description

Completed pre-registration of 'PackageId'.

Message #

Completed pre-registration of '%1'

Fields #

Name	Description
`PackageId` UnicodeString

Event ID 319: Pre-registration for 'PackageId' failed.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Error
Task: AppReadiness_PreRegister_Package

Description

Pre-registration for 'PackageId' failed. (Error: Result).

Message #

Pre-registration for '%1' failed. (Error: %2)

Fields #

Name	Description
`PackageId` UnicodeString
`Result` Int32	1' failed. (Error.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "F0BE35F8-237B-4814-86B5-ADE51192E503",
    "event_source_name": "",
    "event_id": 319,
    "version": 0,
    "level": 2,
    "task": 23,
    "opcode": 0,
    "keywords": 9223372036854775812,
    "time_created": "2023-11-05T22:33:30.809891+00:00",
    "event_record_id": 601,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0002-3975-DBE43710DA01"
    },
    "execution": {
      "process_id": 4952,
      "thread_id": 7936
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageId": "Microsoft.MicrosoftEdge.Stable_118.0.2088.61_neutral__8wekyb3d8bbwe",
    "Result": -2147024846
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 320: Failed to flush registry key 'Key'.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

Failed to flush registry key 'Key'. (Error: Result).

Message #

Failed to flush registry key '%1'. (Error: %2)

Fields #

Name	Description
`Key` UnicodeString
`Result` UInt32

Event ID 321: OnDemandRegisterAsync starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

OnDemandRegisterAsync starts.

Message #

OnDemandRegisterAsync starts.

Event ID 322: OnDemandRegisterAsync returns ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegisterAsync returns ExitCode.

Message #

OnDemandRegisterAsync returns %1.

Fields #

Name	Description
`ExitCode` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 322,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-28T11:13:15.0365678+00:00",
    "event_record_id": 226,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "OnDemandRegisterAsync returns 0x0."
}

Event ID 323: OnDemandRegisterWaitForCompletion starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

OnDemandRegisterWaitForCompletion starts.

Message #

OnDemandRegisterWaitForCompletion starts.

Event ID 324: OnDemandRegisterWaitForCompletion returns ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegisterWaitForCompletion returns ExitCode.

Message #

OnDemandRegisterWaitForCompletion returns %1.

Fields #

Name	Description
`ExitCode` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "guid": "{F0BE35F8-237B-4814-86B5-ADE51192E503}",
    "event_source_name": "",
    "event_id": 324,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 2,
    "keywords": -9223372036854775804,
    "time_created": "2026-05-28T11:13:15.6670957+00:00",
    "event_record_id": 227,
    "correlation": {
      "ActivityID": "{AFDF3271-EE92-0003-AA39-DFAF92EEDC01}"
    },
    "execution": {
      "process_id": 1912,
      "thread_id": 3896
    },
    "channel": "Microsoft-Windows-AppReadiness/Admin",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ExitCode": "0x0"
  },
  "message": "OnDemandRegisterWaitForCompletion returns 0x0."
}

Event ID 325: OnDemandRegister returns error ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegister returns error ExitCode.

Message #

OnDemandRegister returns error %1.

Fields #

Name	Description
`ExitCode` HexInt32

Event ID 326: OnDemandRegisterAsync starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

OnDemandRegisterAsync starts.

Message #

OnDemandRegisterAsync starts.

Event ID 327: OnDemandRegisterAsync returns ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegisterAsync returns ExitCode.

Message #

OnDemandRegisterAsync returns %1.

Fields #

Name	Description
`ExitCode` HexInt32

Event ID 328: OnDemandRegisterWaitForCompletion starts.

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ExecuteTask
Opcode: Start

Description

OnDemandRegisterWaitForCompletion starts.

Message #

OnDemandRegisterWaitForCompletion starts.

Event ID 329: OnDemandRegisterWaitForCompletion returns ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegisterWaitForCompletion returns ExitCode.

Message #

OnDemandRegisterWaitForCompletion returns %1.

Fields #

Name	Description
`ExitCode` HexInt32

Event ID 330: OnDemandRegister returns error ExitCode.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask
Opcode: Stop

Description

OnDemandRegister returns error ExitCode.

Message #

OnDemandRegister returns error %1.

Fields #

Name	Description
`ExitCode` HexInt32

Event ID 331: Importing package status for user userSid completed with hr=Result.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin

Description

Importing package status for user userSid completed with hr=Result. numImported values were imported. numFailed values failed to be imported.

Message #

Importing package status for user %1 completed with hr=%2. %3 values were imported. %4 values failed to be imported.

Fields #

Name	Description
`userSid` UnicodeString
`Result` Int32
`numImported` UInt32
`numFailed` UInt32

Event ID 332: Task 'TaskType' is performed from ARS for OneTimeRegistration on package PackageFullName.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Level: Informational

Description

Task 'TaskType' is performed from ARS for OneTimeRegistration on package PackageFullName.

Message #

Task '%2' is performed from ARS for OneTimeRegistration on package %1

Fields #

Name	Description
`PackageFullName` UnicodeString
`TaskType` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-AppReadiness",
    "event_id": 332,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:30:47.7810539+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-AppReadiness"
  },
  "event_data": {
    "TaskType": "windows.preInstalledConfigTask",
    "PackageFullName": "MicrosoftWindows.Client.OOBE_1000.26100.15.0_x64__cw5n1h2txyewy"
  }
}

Event ID 1001: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_Install
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1002: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_Install
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1003: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_Remove
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1004: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_Remove
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1005: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_GetTask
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1006: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_GetTask
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1009: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_ProcessTasks
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1010: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_ProcessTasks
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1013: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_HandlePackageChange
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1014: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_HandlePackageChange
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1015: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_CreateTask
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1016: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_CreateTask
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1017: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_EnterLogonPhase
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1018: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_EnterLogonPhase
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1019: API Enter for 'User' (Process: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_ResolveStoreCategories
Opcode: Start

Description

API Enter for 'User' (Process: ProcessId).

Message #

API Enter for '%1' (Process: %2)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32

Event ID 1020: API Exit for 'Result' (Process: User Result: ProcessId).

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_Api_ResolveStoreCategories
Opcode: Stop

Description

API Exit for 'Result' (Process: User Result: ProcessId).

Message #

API Exit for '%1' (Process: %2 Result: %3)

Fields #

Name	Description
`User` UnicodeString
`ProcessId` UInt32
`Result` Int32	1' (Process.

Event ID 1021: DisableInAuditMode registry value set to block API calls while in audit mode (audit mode: IsAuditMode).

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_Api_DisableInAuditMode

Description

DisableInAuditMode registry value set to block API calls while in audit mode (audit mode: IsAuditMode).

Message #

DisableInAuditMode registry value set to block API calls while in audit mode (audit mode: %1).

Fields #

Name	Description
`IsAuditMode` Boolean

Event ID 2000: AppReadiness_ScorePackageStart

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage
Opcode: Start

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString

Event ID 2001: AppReadiness_ScorePackageStop

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage
Opcode: Stop

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2002: AppReadiness_ScorePackage

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2003: AppReadiness_ScorePackage2003

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2005: AppReadiness_ScorePackage2005

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2006: AppReadiness_ScorePackage2006

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2007: AppReadiness_ScorePackage2007

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2008: AppReadiness_ScorePackage2008

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2009: AppReadiness_ScorePackage2009

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2010: AppReadiness_ScorePackage2010

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_ScorePackage

Fields #

Name	Description
`User` UnicodeString
`PackageFamilyName` UnicodeString
`Score` UInt32

Event ID 2500: AppReadiness_BrokerSessionStart

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_BrokerSession
Opcode: Start

Fields #

Name	Description
`User` UnicodeString

Event ID 2501: AppReadiness_BrokerSessionStop

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_BrokerSession
Opcode: Stop

Fields #

Name	Description
`User` UnicodeString
`Result` UInt32

Event ID 2502: AppReadiness_BrokerSession

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_BrokerSession

Fields #

Name	Description
`User` UnicodeString
`Package` UnicodeString
`Result` UInt32

Event ID 2503: AppReadiness_BrokerSession2503

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_BrokerSession

Fields #

Name	Description
`User` UnicodeString
`Package` UnicodeString
`Result` UInt32

Event ID 2504: AppReadiness_BrokerSession2504

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_BrokerSession

Fields #

Name	Description
`User` UnicodeString
`Result` UInt32

Event ID 3000: AppReadiness_PerfTrackStart

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_PerfTrack
Opcode: Start

Fields #

Name	Description
`TaskId` UnicodeString

Event ID 3001: AppReadiness_PerfTrackStop

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_PerfTrack
Opcode: Stop

Fields #

Name	Description
`TaskId` UnicodeString

Event ID 4000: AppReadiness_TriggerTask_Run

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_TriggerTask_Run

Fields #

Name	Description
`User` UnicodeString
`Result` Int32

Event ID 4001: AppReadiness_MaintenanceTask_Run

Provider: Microsoft-Windows-AppReadiness
Channel: Operational
Task: AppReadiness_MaintenanceTask_Run

Fields #

Name	Description
`User` UnicodeString
`Result` Int32

Event ID 5000: AppReadiness_TimelineStart

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5001: AppReadiness_TimelineStop

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5002: AppReadiness_TimelineStart5002

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5003: AppReadiness_TimelineStop5003

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5004: AppReadiness_TimelineStart5004

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5005: AppReadiness_TimelineStop5005

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5006: AppReadiness_TimelineStart5006

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5007: AppReadiness_TimelineStop5007

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5008: AppReadiness_TimelineStart5008

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5009: AppReadiness_TimelineStop5009

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5010: AppReadiness_TimelineStart5010

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5011: AppReadiness_TimelineStop5011

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5012: AppReadiness_TimelineStart5012

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5013: AppReadiness_TimelineStop5013

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5014: AppReadiness_TimelineStart5014

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5015: AppReadiness_TimelineStop5015

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5016: AppReadiness_TimelineStart5016

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5017: AppReadiness_TimelineStop5017

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5018: AppReadiness_TimelineStart5018

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5019: AppReadiness_TimelineStop5019

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5020: AppReadiness_TimelineStart5020

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5021: AppReadiness_TimelineStop5021

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5022: AppReadiness_TimelineStart5022

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5023: AppReadiness_TimelineStop5023

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5024: AppReadiness_TimelineStart5024

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5025: AppReadiness_TimelineStop5025

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5026: AppReadiness_TimelineStart5026

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5027: AppReadiness_TimelineStop5027

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5028: AppReadiness_TimelineStart5028

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5029: AppReadiness_TimelineStop5029

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5030: AppReadiness_TimelineStart5030

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5031: AppReadiness_TimelineStop5031

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5032: AppReadiness_TimelineStart5032

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5033: AppReadiness_TimelineStop5033

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5034: AppReadiness_TimelineStart5034

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5035: AppReadiness_TimelineStop5035

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5036: AppReadiness_TimelineStart5036

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5037: AppReadiness_TimelineStop5037

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5038: AppReadiness_TimelineStart5038

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5039: AppReadiness_TimelineStop5039

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5040: AppReadiness_TimelineStart5040

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5041: AppReadiness_TimelineStop5041

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5042: AppReadiness_TimelineStart5042

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5043: AppReadiness_TimelineStop5043

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5044: User : failed determine if tiles are missing.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

User : failed determine if tiles are missing. error=Result.

Message #

%1 : failed determine if tiles are missing. error=%2

Fields #

Name	Description
`User` UnicodeString
`Result` Int32

Event ID 5045: User : failed to repair missing tiles.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

User : failed to repair missing tiles. error=Result.

Message #

%1 : failed to repair missing tiles. error=%2

Fields #

Name	Description
`User` UnicodeString
`Result` Int32

Event ID 5046: User : missing tiles detected.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

User : missing tiles detected.

Message #

%1 : missing tiles detected.

Fields #

Name	Description
`User` UnicodeString

Event ID 5047: User : missing tiles repaired.

Provider: Microsoft-Windows-AppReadiness
Channel: Admin
Task: AppReadiness_ExecuteTask

Description

User : missing tiles repaired.

Message #

%1 : missing tiles repaired.

Fields #

Name	Description
`User` UnicodeString

Event ID 5048: AppReadiness_TimelineStart5048

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5049: AppReadiness_TimelineStop5049

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5050: AppReadiness_TimelineStart5050

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Start

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Event ID 5051: AppReadiness_TimelineStop5051

Provider: Microsoft-Windows-AppReadiness
Channel: Debug
Task: AppReadiness_Timeline
Opcode: Stop

Fields #

Name	Description
`UserId` UnicodeString
`PackageFamilyName` UnicodeString
`ActivityId` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f0be35f8-237b-4814-86b5-ade51192e503

Defined in AppReadiness.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)