Microsoft-Windows-AssignedAccessBroker

Event	Title	Channel	Sample	Rule
30000	Activated above lock app AboveLockAppAUMID using interface InterfaceType with …	Admin	N	N
30002	Could not find any application running above lock	Admin	N	N
30003	Above lock app exited with result code Result.	Admin	N	N
30004	This is a custom event, see details for more information	Admin	N	N
30005	Failed to get Interface with return code HResult.	Admin	N	N
30006	Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock …	Admin	N	N
30007	Interface failed with return code HResult.	Admin	N	N
30008	Abovelock toast operation Operation failed with return code HResult.	Admin	N	N
30009	Set PowerRequestActiveLockScreenInternal request action RequestAction, returns …	Admin	N	N
30010	Close power request handle returns Result.	Admin	N	N
30011	Above lock app is unresponsive	Admin	N	N
30012	Edge downloads path has been redirected	Admin	N	N

Event ID 30000: Activated above lock app AboveLockAppAUMID using interface InterfaceType with return code HResult.

Channel: Admin
Task: ActivateAssignedAccessApplication

Message #

Activated above lock app %1 using interface %2 with return code %3

Fields #

Name	Description
`AboveLockAppAUMID` UnicodeString
`InterfaceType` UnicodeString
`HResult` HexInt32

Event ID 30002: Could not find any application running above lock

Channel: Admin
Task: WaitForAssignedAccessApplicationToDie

Event ID 30003: Above lock app exited with result code Result.

Channel: Admin
Task: WaitForAssignedAccessApplicationToDie

Message #

Above lock app exited with result code %1

Fields #

Name	Description
`Result` Boolean

Event ID 30004: This is a custom event, see details for more information

Channel: Admin
Task: CustomTask

Fields #

Name	Description
`CustomMessage` UnicodeString
`HResult` HexInt32
`Address` Pointer

Event ID 30005: Failed to get Interface with return code HResult.

Channel: Admin
Task: LockFrameworkQueryTask

Message #

Failed to get %1 with return code %2

Fields #

Name	Description
`Interface` UnicodeString
`HResult` HexInt32

Event ID 30006: Detected unlocking event (user pressed Ctrl+Alt+Del), terminating above lock app, and exiting lock app

Channel: Admin
Task: UnlockTask

Event ID 30007: Interface failed with return code HResult.

Channel: Admin
Task: LockAppPidTask

Message #

%1 failed with return code %2

Fields #

Name	Description
`Interface` UnicodeString
`HResult` HexInt32

Event ID 30008: Abovelock toast operation Operation failed with return code HResult.

Channel: Admin
Task: AbovelockToastTask

Message #

Abovelock toast operation %1 failed with return code %2

Fields #

Name Description

Name	Description
`Operation` UnicodeString	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`HResult` HexInt32

Operation UnicodeString

Known values

%%2456: Open key file.
%%2457: Delete key file.
%%2458: Read persisted key from file.
%%2459: Write persisted key to file.
%%2464: Export of persistent cryptographic key.
%%2465: Import of persistent cryptographic key.
%%2480: Open Key.
%%2481: Create Key.
%%2482: Delete Key.
%%2483: Encrypt.
%%2484: Decrypt.
%%2485: Sign hash.
%%2486: Secret agreement.
%%2487: Domain settings.
%%2488: Local settings.
%%2489: Add provider.
%%2490: Remove provider.
%%2491: Add context.
%%2492: Remove context.
%%2493: Add function.
%%2494: Remove function.
%%2495: Add function provider.
%%2496: Remove function provider.
%%2497: Add function property.
%%2498: Remove function property.
%%2499: Machine key.
%%2500: User key.
%%2501: Key Derivation.
%%2502: Claim Creation.
%%2503: Claim Verification.

HResult HexInt32

Event ID 30009: Set PowerRequestActiveLockScreenInternal request action RequestAction, returns code HResult.

Channel: Admin
Task: SetPowerManagerStatusTask

Message #

Set PowerRequestActiveLockScreenInternal request action %1, returns code %2

Fields #

Name	Description
`RequestAction` Boolean
`HResult` HexInt32

Event ID 30010: Close power request handle returns Result.

Channel: Admin
Task: ClosePowerRequestHandleTask

Message #

Close power request handle returns %1

Fields #

Name	Description
`Result` Boolean

Event ID 30011: Above lock app is unresponsive

Channel: Admin
Task: ReportUnresponsiveAssignedAccessApplication

Event ID 30012: Edge downloads path has been redirected

Channel: Admin
Task: AppSpecificSettingsTask

Provenance

ETW provider GUID f2311b48-32be-4902-a22a-7240371dbb2c

Defined in IoTAssignedAccessLockFramework.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB