Microsoft-Windows-AsynchronousCausality
63 events across 1 channel
Event ID 4112: Event fired when an asynchronous operation is created.
#Description
Event fired when an asynchronous operation is created.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
OperationName UnicodeString | |
RelatedId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 4112,
"version": 1,
"level": 1,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000901",
"time_created": "2026-06-02T05:18:54.447+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
},
"execution": {
"process_id": 14404,
"thread_id": 5356
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"OperationId": 2070815322032,
"OperationName": "Windows.Foundation.AsyncOperationCompletedHandler`1<Windows.Internal.Security.WebAuthentication.UserHostIdentity>",
"PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
"RelatedId": 1
},
"message": ""
}
Event ID 4113: Event fired when an asynchronous operation is created.
#Description
Event fired when an asynchronous operation is created.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
OperationName UnicodeString | |
RelatedId UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "4113",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854778369,
"time_created": "2026-03-15T04:33:35.817157300+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{210931ca-a6a8-4616-8759-b99b1b76542e}"
},
"execution": {
"process_id": "5820",
"thread_id": "12172"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
"OperationId": "4294967297",
"OperationName": "Task: <Init>b__0_0",
"RelatedId": "0"
},
"message": ""
}
Event ID 4114: Event fired when an asynchronous operation is created.
#Event ID 4144: Event fired when an asynchronous operation is created.
#Event ID 4145: Event fired when an asynchronous operation is created.
#Event ID 4146: Event fired when an asynchronous operation is created.
#Event ID 4176: Event fired when an asynchronous operation is created.
#Event ID 4177: Event fired when an asynchronous operation is created.
#Event ID 4178: Event fired when an asynchronous operation is created.
#Event ID 8208: Event fired when an asynchronous operation is completed.
#Description
Event fired when an asynchronous operation is completed.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
CompletionStatus UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 8208,
"version": 1,
"level": 1,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000101",
"time_created": "2026-06-02T05:18:54.648+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
},
"execution": {
"process_id": 14404,
"thread_id": 5356
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"CompletionStatus": 1,
"OperationId": 2070815322032,
"PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}"
},
"message": ""
}
Event ID 8209: Event fired when an asynchronous operation is completed.
#Description
Event fired when an asynchronous operation is completed.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
CompletionStatus UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "8209",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854776321,
"time_created": "2026-03-15T04:33:36.031909300+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
},
"execution": {
"process_id": "5820",
"thread_id": "8500"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
"OperationId": "4294967297",
"CompletionStatus": "1"
},
"message": ""
}
Event ID 8210: Event fired when an asynchronous operation is completed.
#Event ID 8240: Event fired when an asynchronous operation is completed.
#Event ID 8241: Event fired when an asynchronous operation is completed.
#Event ID 8242: Event fired when an asynchronous operation is completed.
#Event ID 8272: Event fired when an asynchronous operation is completed.
#Event ID 8273: Event fired when an asynchronous operation is completed.
#Event ID 8274: Event fired when an asynchronous operation is completed.
#Event ID 12304: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12305: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12306: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12336: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12337: Event fired relating a synchronous work items to an asynchronous operation.
#Description
Event fired relating a synchronous work items to an asynchronous operation.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
Relation UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 12337,
"version": 1,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000204",
"time_created": "2026-06-02T05:18:56.002+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{AC9D7E53-4EF9-4D5D-8A6F-E34D92913C3D}"
},
"execution": {
"process_id": 12356,
"thread_id": 14396
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"OperationId": 4294967507,
"PlatformId": "{4B0171A6-F3D0-41A0-9B33-02550652B995}",
"Relation": 0
},
"message": ""
}
Event ID 12338: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12368: Event fired relating a synchronous work items to an asynchronous operation.
#Description
Event fired relating a synchronous work items to an asynchronous operation.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
Relation UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 12368,
"version": 1,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000104",
"time_created": "2026-06-02T05:18:54.648+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
},
"execution": {
"process_id": 14404,
"thread_id": 5356
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"OperationId": 2070815322032,
"PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
"Relation": 0
},
"message": ""
}
Event ID 12369: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 12370: Event fired relating a synchronous work items to an asynchronous operation.
#Event ID 16400: Event fired when a synchronous work item starts.
#Description
Event fired when a synchronous work item starts.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
WorkItemType UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 16400,
"version": 1,
"level": 1,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000102",
"time_created": "2026-06-02T05:18:54.648+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
},
"execution": {
"process_id": 14404,
"thread_id": 5356
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {
"OperationId": 2070815322032,
"PlatformId": "{C54C95D9-5B6E-41E9-A28D-2DD68F94B500}",
"WorkItemType": 0
},
"message": ""
}
Event ID 16401: Event fired when a synchronous work item starts.
#Description
Event fired when a synchronous work item starts.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
WorkItemType UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "16401",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854776322,
"time_created": "2026-03-15T04:33:37.049123200+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{90556757-5b90-44b0-97d0-2daf7e5a760e}"
},
"execution": {
"process_id": "5820",
"thread_id": "2804"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
"OperationId": "4294967306",
"WorkItemType": "0"
},
"message": ""
}
Event ID 16402: Event fired when a synchronous work item starts.
#Event ID 16432: Event fired when a synchronous work item starts.
#Event ID 16433: Event fired when a synchronous work item starts.
#Event ID 16434: Event fired when a synchronous work item starts.
#Event ID 16464: Event fired when a synchronous work item starts.
#Event ID 16465: Event fired when a synchronous work item starts.
#Event ID 16466: Event fired when a synchronous work item starts.
#Event ID 16656: Event fired when a synchronous work item starts.
#Event ID 16657: Event fired when a synchronous work item starts.
#Description
Event fired when a synchronous work item starts.
Message #
Fields #
| Name | Description |
|---|---|
PlatformId GUID | |
OperationId UInt64 | |
WorkItemType UInt8 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "16657",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854776336,
"time_created": "2026-03-15T04:33:35.818197800+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
},
"execution": {
"process_id": "5820",
"thread_id": "8500"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"PlatformId": "{4b0171a6-f3d0-41a0-9b33-02550652b995}",
"OperationId": "4294967297",
"WorkItemType": "2"
},
"message": ""
}
Event ID 16658: Event fired when a synchronous work item starts.
#Event ID 16688: Event fired when a synchronous work item starts.
#Event ID 16689: Event fired when a synchronous work item starts.
#Event ID 16690: Event fired when a synchronous work item starts.
#Event ID 16720: Event fired when a synchronous work item starts.
#Event ID 16721: Event fired when a synchronous work item starts.
#Event ID 16722: Event fired when a synchronous work item starts.
#Event ID 20496: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}",
"event_source_name": "",
"event_id": 20496,
"version": 1,
"level": 1,
"task": 0,
"opcode": 0,
"keywords": "0x0000000000000102",
"time_created": "2026-06-02T05:18:54.648+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{1D5E31DB-30E2-4C9E-A8B8-ADD03FC063BA}"
},
"execution": {
"process_id": 14404,
"thread_id": 5356
},
"channel": "ETW Trace",
"computer": "JD-DC01-2022",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 20497: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "20497",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854776322,
"time_created": "2026-03-15T04:33:37.049158900+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{90556757-5b90-44b0-97d0-2daf7e5a760e}"
},
"execution": {
"process_id": "5820",
"thread_id": "2804"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 20498: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20528: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20529: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20530: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20560: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20561: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20562: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20752: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20753: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-AsynchronousCausality",
"guid": "{19a4c69a-28eb-4d4b-8d94-5f19055a1b5c}",
"event_source_name": "",
"event_id": "20753",
"version": "1",
"level": "1",
"task": "0",
"opcode": "0",
"keywords": 9223372036854776336,
"time_created": "2026-03-15T04:33:36.031900500+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{4d4d0280-ef8f-4702-be81-37791e0104ea}"
},
"execution": {
"process_id": "5820",
"thread_id": "8500"
},
"channel": "Microsoft-Windows-AsynchronousCausality/Causality",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 20754: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20784: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20785: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20786: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20816: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20817: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Event ID 20818: Event fired when a synchronous work item completes.
#Description
Event fired when a synchronous work item completes.
Message #
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID {19A4C69A-28EB-4D4B-8D94-5F19055A1B5C}
Defined in combase.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.2849, captured 2026-06-02
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02