Microsoft-Windows-Backup

Event	Title	Channel	Sample	Rule
1	The backup operation has started.	Microsoft-Windows-Backup	Y	N
2	The backup catalog is corrupted.	Microsoft-Windows-Backup	N	N
3	The backup catalog on the selected disk 'TargetDeviceName' is corrupted so that …	Microsoft-Windows-Backup	N	N
4	The backup operation has finished successfully.	Microsoft-Windows-Backup	N	N
5	The backup operation that started at 'BackupTime' has failed with following …	Microsoft-Windows-Backup	N	N
6	The backup operation has failed because another backup or recovery operation is …	Microsoft-Windows-Backup	N	N
7	The backup operation that started at 'BackupTime' has completed with errors.	Microsoft-Windows-Backup	Y	N
8	The backup operation was canceled.	Microsoft-Windows-Backup	N	N
9	The backup operation that started at 'BackupStartTime' has failed because the …	Microsoft-Windows-Backup	N	N
10	There is no backup available on the storage location.	Microsoft-Windows-Backup	N	N
11	The backup of volume 'VolumeFriendlyName' on the backup storage location is …	Microsoft-Windows-Backup	N	N
12	The backup has some corrupted application metadata and cannot be used to perform …	Microsoft-Windows-Backup	N	N
13	The backup operation has completed with warning(s) - Volume 'VolumeFriendlyName' …	Microsoft-Windows-Backup	N	N
14	The backup operation has completed.	Microsoft-Windows-Backup	Y	N
15	The scheduled backup configuration conflicts with current Group Policy settings, …	Microsoft-Windows-Backup	N	N
16	The backup operation has failed because recovery planning is in progress through …	Microsoft-Windows-Backup	N	N
17	The backup operation that started at 'BackupTime' has failed because the Windows …	Microsoft-Windows-Backup	N	N
18	The scheduled backup operation that started at 'BackupTime' has failed because …	Microsoft-Windows-Backup	N	N
19	The backup operation attempted at 'NumOfVolumes' has failed to start, error code …	Microsoft-Windows-Backup	Y	N
20	The backup operation that started at 'BackupTime' has failed because another …	Microsoft-Windows-Backup	N	N
21	The scheduled backup configuration conflicts with current Group Policy settings, …	Microsoft-Windows-Backup	N	N
22	The backup operation that started at 'BackupTime' has failed because recovery …	Microsoft-Windows-Backup	N	N
23	The backup operation that started at 'BackupTime' has encountered errors.	Microsoft-Windows-Backup	N	N
24	Backup started a fresh backup for volume 'VolumeGUID' ('VolumeFriendlyName') : …	Microsoft-Windows-Backup	N	N
25	Backup failed for volume 'VolumeGUID' ('VolumeFriendlyName'): [Reason: …	Microsoft-Windows-Backup	N	N
49	The backup operation has failed because no backup storage location could be …	Microsoft-Windows-Backup	N	N
50	The backup operation has failed because the required space was not available on …	Microsoft-Windows-Backup	N	N
51	The backup storage location is running low on free space.	Microsoft-Windows-Backup	N	N
52	The backup operation has failed because the remote shared folder that you are …	Microsoft-Windows-Backup	N	N
53	Windows Server Backup is waiting for a DVD to be inserted into the drive.	Microsoft-Windows-Backup	N	N
96	A scheduled backup has been configured for this computer.	Microsoft-Windows-Backup	N	N
97	The scheduled backup for this computer has been modified.	Microsoft-Windows-Backup	N	N
98	The scheduled backup was canceled.	Microsoft-Windows-Backup	N	N
99	A scheduled backup has been configured for this computer.	Microsoft-Windows-Backup	N	N
100	The scheduled backup was canceled.	Microsoft-Windows-Backup	Y	N
144	A new volume 'VolumeFriendlyName' was detected that is not in the list of …	Microsoft-Windows-Backup	N	N
146	A volume 'VolumeFriendlyName' in the list of volumes to include in the backup is …	Microsoft-Windows-Backup	N	N
160	The system catalog has been recovered from the backup storage location …	Microsoft-Windows-Backup	N	N
161	The system catalog has been deleted.	Microsoft-Windows-Backup	Y	N
192	The recovery operation has started.	Microsoft-Windows-Backup	N	N
193	The operation to recover volume(s) has completed.	Microsoft-Windows-Backup	N	N
194	The operation to recover volume(s) that started at 'NumOfVolumes' has …	Microsoft-Windows-Backup	N	N
195	The volume recovery operation has completed with errors.	Microsoft-Windows-Backup	N	N
196	The volume recovery operation has failed with errors.	Microsoft-Windows-Backup	N	N
197	The operation to recover volume(s) that started at 'NumOfVolumes' was canceled.	Microsoft-Windows-Backup	N	N
198	The operation to recover volume 'VolumeFriendlyName' has failed or was canceled.	Microsoft-Windows-Backup	N	N
199	The operation to recover 'VolumeFriendlyName' has failed because the volume that …	Microsoft-Windows-Backup	N	N
208	The operation to recover file(s) has completed.	Microsoft-Windows-Backup	N	N
209	The recovery operation of file(s) that started at 'RestoreTime' completed …	Microsoft-Windows-Backup	N	N
210	The file recovery operation completed with errors.	Microsoft-Windows-Backup	N	N
211	The file recovery operation failed with errors.	Microsoft-Windows-Backup	N	N
212	The recovery operation of file(s) that started at 'RestoreTime' was canceled.	Microsoft-Windows-Backup	N	N
213	The backup set of volume 'VolumeToMount' on the backup storage location has been …	Microsoft-Windows-Backup	N	N
214	The operation to recover file(s) started at 'RestoreTime' has completed …	Microsoft-Windows-Backup	N	N
215	The file recovery operation has completed with errors.	Microsoft-Windows-Backup	N	N
216	The file recovery operation has failed with errors.	Microsoft-Windows-Backup	N	N
217	The operation to recover file(s) that started at 'RestoreTime' was canceled.	Microsoft-Windows-Backup	N	N
224	The operation to recover component(s) has completed.	Microsoft-Windows-Backup	N	N
225	The operation to recover component(s) that started at 'RestoreTime' has …	Microsoft-Windows-Backup	N	N
226	The operation to recover component(s) has completed with errors.	Microsoft-Windows-Backup	N	N
227	The operation to recover component(s) has failed with errors.	Microsoft-Windows-Backup	N	N
228	The operation to recover component(s) that started at 'RestoreTime' was …	Microsoft-Windows-Backup	N	N
240	The system state recovery operation started at 'RestoreTime'.	Microsoft-Windows-Backup	N	N
241	The system state recovery operation has completed.	Microsoft-Windows-Backup	N	N
242	The system state recovery operation that started at 'RestoreTime' has completed …	Microsoft-Windows-Backup	N	N
243	The system state recovery operation that started at 'RestoreTime' has failed …	Microsoft-Windows-Backup	N	N
244	The system state recovery operation that started at 'RestoreTime' has failed …	Microsoft-Windows-Backup	N	N
245	The system state recovery operation that started at 'RestoreTime' was canceled.	Microsoft-Windows-Backup	N	N
514	The backup catalog is corrupted.	Application	N	N
517	The backup operation that started at 'BackupTime' has failed with following …	Application	N	N
518	The backup operation that started at 'BackupTime' has failed because another …	Application	N	N
519	The backup operation that started at 'BackupTime' has failed to back up …	Application	N	N
521	The backup operation that started at 'BackupTime' has failed because the Volume …	Application	N	N
522	There is no backup available on the storage location 'BackupTargetFriendlyName'.	Application	N	N
523	The system catalog has been recovered from the backup storage location …	Application	N	N
524	The system catalog has been deleted.	Application	Y	Y
525	The backup operation that completed with warning(s) - Volume …	Application	N	N
526	The scheduled backup configuration conflicts with current Group Policy settings, …	Application	N	N
527	The backup operation that started at 'BackupTime' has failed because recovery …	Application	N	N
528	The scheduled backup configuration conflicts with current Group Policy settings, …	Application	N	N
544	The backup operation that started at 'BackupTime' has failed because the Windows …	Application	N	N
545	The scheduled backup operation that started at 'BackupTime' has failed because …	Application	N	N
546	The backup operation attempted at 'BackupTime' has failed to start, error code …	Application	N	N
547	The backup operation that started at 'BackupTime' has encountered errors for the …	Application	N	N
561	The backup operation that started at 'BackupTime' has failed because no backup …	Application	N	N
564	The backup operation that started at 'BackupTime' has failed because the remote …	Application	N	N
565	The consistency check for the component 'ComponentName'\'LogicalPath' has …	Application	N	N
608	A scheduled backup has been configured to create a backup of 'BackupTargetList' …	Application	N	N
609	The scheduled backup has been modified to create a backup of 'BackupTargetList' …	Application	N	N
610	The scheduled backup was canceled.	Application	N	N
611	A scheduled backup has been configured for this computer.	Application	N	N
612	The scheduled backup was canceled.	Application	N	N
656	A new volume was detected that is not in the list of volumes to include in the …	Application	N	N
658	A volume 'BackupTargetFriendlyName' in the list of volumes to include in the …	Application	N	N
704	The operation to recover 'RestoreTargetNameList' was attempted at 'RestoreTime'.	Application	N	N
706	The operation to recover 'RestoreTargetNameList' has successfully completed at …	Application	N	N
707	The operation to recover 'RestoreTargetNameList' has completed with errors at …	Application	N	N
708	The operation to recover 'RestoreTargetNameList' has failed with errors at …	Application	N	N
709	The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.	Application	N	N
710	The operation to recover volume 'RestoreTargetNameList' has failed or was …	Application	N	N
711	The operation to recover 'RestoreTargetNameList' has failed at 'RestoreTime' …	Application	N	N
721	The operation to recover 'RestoreTargetNameList' has completed successfully at …	Application	N	N
722	The operation to recover 'RestoreTargetNameList' has completed with errors at …	Application	N	N
723	The operation to recover 'RestoreTargetNameList' has failed with errors at …	Application	N	N
724	The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.	Application	N	N
737	The operation to recover component(s) 'RestoreTargetNameList' has completed …	Application	N	N
738	The operation to recover component(s) 'RestoreTargetNameList' has completed with …	Application	N	N
739	The operation to recover component(s) 'RestoreTargetNameList' has failed with …	Application	N	N
740	The operation to recover component(s) 'RestoreTargetNameList' was canceled at …	Application	N	N
753	The Block Level Backup Engine service has successfully started.	Application	Y	N
754	The Block Level Backup Engine service has stopped.	Application	Y	N
755	Installing the handler for the Block Level Backup Engine service has failed with …	Application	N	N
756	The Block Level Backup Engine service received an unknown request with code …	Application	N	N
769	The system state recovery operation started at 'RestoreTime'.	Application	N	N
770	The system state recovery operation has completed.	Application	N	N
771	The system state recovery operation that started at 'RestoreTime' has completed …	Application	N	N
772	The system state recovery operation that started at 'RestoreTime' was canceled.	Application	N	N
773	The system state recovery operation that started at 'RestoreTime' has completed …	Application	N	N
774	The system state recovery operation that started at 'RestoreTime' has failed …	Application	N	N
1025	The operation to recover Hyper-V component(s) has completed.	Microsoft-Windows-Backup	N	N
1026	The operation to recover Hyper-V component(s) that started at 'RestoreTime' has …	Microsoft-Windows-Backup	N	N
1027	The operation to recover Hyper-V component(s) has completed with errors.	Microsoft-Windows-Backup	N	N
1028	The operation to recover Hyper-V component(s) has failed with errors.	Microsoft-Windows-Backup	N	N
1029	The operation to recover Hyper-V component(s) that started at 'RestoreTime' was …	Microsoft-Windows-Backup	N	N
1040	The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has …	Application	N	N
1041	The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has …	Application	N	N
1042	The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has failed …	Application	N	N
1043	The operation to recover Hyper-V component(s) 'RestoreTargetNameList' was …	Application	N	N
1044	New Online backup provider registered.	Application	N	N
1045	Online backup provider deregistered.	Application	N	N
1281	Online backup has reported a status change.	Microsoft-Windows-Backup	N	N
1282	New Online backup provider registered.	Microsoft-Windows-Backup	N	N
1283	Online backup provider deregistered.	Microsoft-Windows-Backup	N	N

Event ID 1: The backup operation has started.

Channel: Microsoft-Windows-Backup
Level: Informational
Opcode: Start

Fields #

Name	Description
`BackupTemplateID` GUID
`SystemStateBackup` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 1,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T02:25:15.861066+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 9652,
      "thread_id": 13792
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BackupTemplateID": "FBE8E14B-4B52-419D-A050-F4BBC12A1D8C",
    "SystemStateBackup": false
  },
  "message": ""
}

Event ID 2: The backup catalog is corrupted.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the WBADMIN RESTORE CATALOG command.

Message #

The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the WBADMIN RESTORE CATALOG command.

Event ID 3: The backup catalog on the selected disk 'TargetDeviceName' is corrupted so that you will not be able to perform a recovery operation from this location.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup catalog on the selected disk 'TargetDeviceName' is corrupted so that you will not be able to perform a recovery operation from this location. Please choose a different backup storage location.

Message #

The backup catalog on the selected disk '%1' is corrupted so that you will not be able to perform a recovery operation from this location. Please choose a different backup storage location.

Fields #

Name	Description
`TargetDeviceName` UnicodeString

Event ID 4: The backup operation has finished successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Event ID 5: The backup operation that started at 'BackupTime' has failed with following error code 'HRESULT'.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed with following error code 'HRESULT'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%6' has failed with following error code '%2'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Event ID 6: The backup operation has failed because another backup or recovery operation is in progress.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Message #

The backup operation has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Event ID 7: The backup operation that started at 'BackupTime' has completed with errors.

Channel: Microsoft-Windows-Backup
Level: Warning
Opcode: Info

Description

The backup operation that started at 'BackupTime' has completed with errors. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%6' has completed with errors. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 7,
    "version": 3,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T02:25:46.868654+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 9652,
      "thread_id": 13792
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BackupTemplateID": "FBE8E14B-4B52-419D-A050-F4BBC12A1D8C",
    "HRESULT": "0x0",
    "DetailedHRESULT": "0x0",
    "ErrorMessage": "%%0",
    "BackupState": 14,
    "BackupTime": "2026-05-30T02:25:15.870270Z",
    "BackupTarget": "E:",
    "NumOfVolumes": 1,
    "VolumesInfo": "<VolumeInfo><VolumeInfoItem Name=\"C:\" OriginalAccessPath=\"C:\" State=\"12\" HResult=\"-2139618978\" DetailedHResult=\"0\" PreviousState=\"9\" IsCritical=\"1\" IsIncremental=\"0\" BlockLevel=\"0\" HasFiles=\"1\" HasSystemState=\"0\" IsCompacted=\"0\" IsPruned=\"0\" IsRecreateVhd=\"0\" FullBackupReason=\"2\" DataTransferred=\"37\" NumUnreadableBytes=\"0\" TotalSize=\"37\" TotalNoOfFiles=\"4\" Flags=\"1606\" BackupTypeDetermined=\"1\" SSBTotalNoOfFiles=\"0\" SSBTotalSizeOnDisk=\"0\" /></VolumeInfo>",
    "SourceSnapStartTime": "2026-05-30T02:25:15.854586Z",
    "SourceSnapEndTime": "2026-05-30T02:25:29.896418Z",
    "PrepareBackupStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:37.463Z\" /></TimesList>",
    "PrepareBackupEndTime": "<TimesList><Time Time=\"2026-05-30T02:25:38.139Z\" /></TimesList>",
    "BackupWriteStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:38.139Z\" /></TimesList>",
    "BackupWriteEndTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "TargetSnapStartTime": "2026-05-30T02:25:41.046745Z",
    "TargetSnapEndTime": "2026-05-30T02:25:41.173007Z",
    "DVDFormatStartTime": "<TimesList></TimesList>",
    "DVDFormatEndTime": "<TimesList></TimesList>",
    "MediaVerifyStartTime": "<TimesList></TimesList>",
    "MediaVerifyEndTime": "<TimesList></TimesList>",
    "BackupPreviousState": 11,
    "ComponentStatus": "<ComponentStatus></ComponentStatus>",
    "ComponentInfo": "<ComponentInfo></ComponentInfo>",
    "SSBEnumerateStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBEnumerateEndTime": "1601-01-01T00:00:00.000000Z",
    "SSBVhdCreationStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBVhdCreationEndTime": "1601-01-01T00:00:00.000000Z",
    "SSBBackupStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBBackupEndTime": "1601-01-01T00:00:00.000000Z",
    "SystemStateBackup": "<SystemState IsPresent=\"0\" HResult=\"0\" DetailedHResult=\"0\" />",
    "BMR": "<BMR IsPresent=\"0\" HResult=\"0\" DetailedHResult=\"0\" />",
    "VssFullBackup": false,
    "UserInputBMR": false,
    "UserInputSSB": false,
    "BackupSuccessLogPath": "C:\\Windows\\Logs\\WindowsServerBackup\\Backup-30-05-2026_02-25-15.log",
    "BackupFailureLogPath": "C:\\Windows\\Logs\\WindowsServerBackup\\Backup_Error-30-05-2026_02-25-15.log",
    "EnumerateBackupStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:36.441Z\" /></TimesList>",
    "EnumerateBackupEndTime": "<TimesList><Time Time=\"2026-05-30T02:25:37.463Z\" /></TimesList>",
    "PruneBackupStartTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "PruneBackupEndTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "BackupFlags": "0x1",
    "ComponentInfoSummary": "<ComponentInfoSummary ComponentInfoArrayPresent=\"1\" TotalComponents=\"0\" SucceededComponents=\"0\" />"
  },
  "message": ""
}

Event ID 8: The backup operation was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Event ID 9: The backup operation that started at 'BackupStartTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being ...

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation that started at 'BackupStartTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code 'HRESULT'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%1' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code '%2'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupStartTime` FILETIME
`BackupSetId` GUID
`HRESULT` HexInt32

Event ID 10: There is no backup available on the storage location.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

There is no backup available on the storage location. Please confirm that the storage location is not corrupted, and then create a new backup that you can use to perform a recovery from the storage location.

Message #

There is no backup available on the storage location. Please confirm that the storage location is not corrupted, and then create a new backup that you can use to perform a recovery from the storage location.

Event ID 11: The backup of volume 'VolumeFriendlyName' on the backup storage location is corrupted.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup of volume 'VolumeFriendlyName' on the backup storage location is corrupted. Run CHKDSK /R to determine if the storage location itself is corrupted. If needed, replace the disk or change the storage location, and then create a new backup that can be used to perform a recovery.

Message #

The backup of volume '%2' on the backup storage location is corrupted. Run CHKDSK /R to determine if the storage location itself is corrupted. If needed, replace the disk or change the storage location, and then create a new backup that can be used to perform a recovery.

Fields #

Name	Description
`BackupSetId` GUID
`VolumeFriendlyName` UnicodeString

Event ID 12: The backup has some corrupted application metadata and cannot be used to perform a recovery.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup has some corrupted application metadata and cannot be used to perform a recovery. Run CHKDSK /R to determine if the storage location itself is corrupted. If needed, replace the disk or change the storage location, and then create a new backup that can be used to perform a recovery.

Message #

The backup has some corrupted application metadata and cannot be used to perform a recovery. Run CHKDSK /R to determine if the storage location itself is corrupted. If needed, replace the disk or change the storage location, and then create a new backup that can be used to perform a recovery.

Fields #

Name	Description
`BackupSetId` GUID

Event ID 13: The backup operation has completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters. This may be an indication of problems with your hardware. BackupSourceNumUnreadableBytes bytes have not been backed up because they could not be read. Please run the CHKDSK /R command on 'VolumeFriendlyName' and then rerun the backup operation.

Message #

The backup operation has completed with warning(s) - Volume '%2' has developed new bad clusters. This may be an indication of problems with your hardware. %3 bytes have not been backed up because they could not be read. Please run the CHKDSK /R command on '%2' and then rerun the backup operation.

Fields #

Name	Description
`VolumeGuid` GUID
`VolumeFriendlyName` UnicodeString
`BackupSourceNumUnreadableBytes` Int64

Event ID 14: The backup operation has completed.

Channel: Microsoft-Windows-Backup
Level: Informational
Opcode: Stop

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 14,
    "version": 3,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T02:25:46.868747+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 9652,
      "thread_id": 13792
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BackupTemplateID": "FBE8E14B-4B52-419D-A050-F4BBC12A1D8C",
    "HRESULT": "0x0",
    "DetailedHRESULT": "0x0",
    "ErrorMessage": "%%0",
    "BackupState": 14,
    "BackupTime": "2026-05-30T02:25:15.870270Z",
    "BackupTarget": "E:",
    "NumOfVolumes": 1,
    "VolumesInfo": "<VolumeInfo><VolumeInfoItem Name=\"C:\" OriginalAccessPath=\"C:\" State=\"12\" HResult=\"-2139618978\" DetailedHResult=\"0\" PreviousState=\"9\" IsCritical=\"1\" IsIncremental=\"0\" BlockLevel=\"0\" HasFiles=\"1\" HasSystemState=\"0\" IsCompacted=\"0\" IsPruned=\"0\" IsRecreateVhd=\"0\" FullBackupReason=\"2\" DataTransferred=\"37\" NumUnreadableBytes=\"0\" TotalSize=\"37\" TotalNoOfFiles=\"4\" Flags=\"1606\" BackupTypeDetermined=\"1\" SSBTotalNoOfFiles=\"0\" SSBTotalSizeOnDisk=\"0\" /></VolumeInfo>",
    "SourceSnapStartTime": "2026-05-30T02:25:15.854586Z",
    "SourceSnapEndTime": "2026-05-30T02:25:29.896418Z",
    "PrepareBackupStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:37.463Z\" /></TimesList>",
    "PrepareBackupEndTime": "<TimesList><Time Time=\"2026-05-30T02:25:38.139Z\" /></TimesList>",
    "BackupWriteStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:38.139Z\" /></TimesList>",
    "BackupWriteEndTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "TargetSnapStartTime": "2026-05-30T02:25:41.046745Z",
    "TargetSnapEndTime": "2026-05-30T02:25:41.173007Z",
    "DVDFormatStartTime": "<TimesList></TimesList>",
    "DVDFormatEndTime": "<TimesList></TimesList>",
    "MediaVerifyStartTime": "<TimesList></TimesList>",
    "MediaVerifyEndTime": "<TimesList></TimesList>",
    "BackupPreviousState": 11,
    "ComponentStatus": "<ComponentStatus></ComponentStatus>",
    "ComponentInfo": "<ComponentInfo></ComponentInfo>",
    "SSBEnumerateStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBEnumerateEndTime": "1601-01-01T00:00:00.000000Z",
    "SSBVhdCreationStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBVhdCreationEndTime": "1601-01-01T00:00:00.000000Z",
    "SSBBackupStartTime": "1601-01-01T00:00:00.000000Z",
    "SSBBackupEndTime": "1601-01-01T00:00:00.000000Z",
    "SystemStateBackup": "<SystemState IsPresent=\"0\" HResult=\"0\" DetailedHResult=\"0\" />",
    "BMR": "<BMR IsPresent=\"0\" HResult=\"0\" DetailedHResult=\"0\" />",
    "VssFullBackup": false,
    "UserInputBMR": false,
    "UserInputSSB": false,
    "BackupSuccessLogPath": "C:\\Windows\\Logs\\WindowsServerBackup\\Backup-30-05-2026_02-25-15.log",
    "BackupFailureLogPath": "C:\\Windows\\Logs\\WindowsServerBackup\\Backup_Error-30-05-2026_02-25-15.log",
    "EnumerateBackupStartTime": "<TimesList><Time Time=\"2026-05-30T02:25:36.441Z\" /></TimesList>",
    "EnumerateBackupEndTime": "<TimesList><Time Time=\"2026-05-30T02:25:37.463Z\" /></TimesList>",
    "PruneBackupStartTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "PruneBackupEndTime": "<TimesList><Time Time=\"1601-01-01T00:00:00.000Z\" /></TimesList>",
    "BackupFlags": "0x1",
    "ComponentInfoSummary": "<ComponentInfoSummary ComponentInfoArrayPresent=\"1\" TotalComponents=\"0\" SucceededComponents=\"0\" />"
  },
  "message": ""
}

Event ID 15: The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT'.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT'. The scheduled backup operation has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Message #

The scheduled backup configuration conflicts with current Group Policy settings, error - '%1'. The scheduled backup operation has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 16: The backup operation has failed because recovery planning is in progress through some other client.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has failed because recovery planning is in progress through some other client. If multiple instances of recoveries are running on the local computer or on a computer connected to the local computer, close these multiple instances and then rerun the backup operation.

Message #

The backup operation has failed because recovery planning is in progress through some other client. If multiple instances of recoveries are running on the local computer or on a computer connected to the local computer, close these multiple instances and then rerun the backup operation.

Event ID 17: The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'HRESULT'.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'HRESULT'. Please confirm that the service is installed and enabled, and then rerun the backup operation.

Message #

The backup operation that started at '%1' has failed because the Windows Server Backup engine could not be contacted, error code '%2'. Please confirm that the service is installed and enabled, and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME
`HRESULT` HexInt32

Event ID 18: The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found. Please reconfigure the scheduled backup.

Message #

The scheduled backup operation that started at '%1' has failed because the schedule settings were not found. Please reconfigure the scheduled backup.

Fields #

Name	Description
`BackupTime` FILETIME
`TemplateId` GUID

Event ID 19: The backup operation attempted at 'NumOfVolumes' has failed to start, error code 'VolumeNames'.

Channel: Microsoft-Windows-Backup
Level: Error
Opcode: Info

Description

The backup operation attempted at 'NumOfVolumes' has failed to start, error code 'VolumeNames'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation attempted at '%4' has failed to start, error code '%5'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`HRESULT` HexInt32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumeNames` UnicodeString
`ErrorMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 19,
    "version": 3,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T14:12:25.886397+00:00",
    "event_record_id": 5,
    "correlation": {},
    "execution": {
      "process_id": 8600,
      "thread_id": 8932
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "HRESULT": "0x8079005f",
    "BackupTime": "2026-05-30T14:12:25.876565Z",
    "BackupTarget": "C:\\Windows\\Temp\\genevt_wsb_dst",
    "NumOfVolumes": 1,
    "VolumeNames": "C:\\Windows\\Temp\\genevt_wsb_src ",
    "ErrorMessage": "%%2155413599"
  },
  "message": ""
}

Event ID 20: The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Message #

The backup operation that started at '%2' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Fields #

Name	Description
`HRESULT` HexInt32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumeNames` UnicodeString
`ErrorMessage` UnicodeString

Event ID 21: The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT'.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The scheduled backup configuration conflicts with current Group Policy settings, error - 'HRESULT' ('ErrorMessage'). The scheduled backup operation started at 'BackupTime' has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Message #

The scheduled backup configuration conflicts with current Group Policy settings, error - '%1'. The scheduled backup operation started at '%2' has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Fields #

Name	Description
`HRESULT` HexInt32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumeNames` UnicodeString
`ErrorMessage` UnicodeString

Event ID 22: The backup operation that started at 'BackupTime' has failed because recovery planning is in progress through some other client.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because recovery planning is in progress through some other client. If multiple instances of the Recovery Wizard are running on the local computer or on a computer connected to the local computer, close these multiple instances and then rerun the backup operation.

Message #

The backup operation that started at '%2' has failed because recovery planning is in progress through some other client. If multiple instances of the Recovery Wizard are running on the local computer or on a computer connected to the local computer, close these multiple instances and then rerun the backup operation.

Fields #

Name	Description
`HRESULT` HexInt32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumeNames` UnicodeString
`ErrorMessage` UnicodeString

Event ID 23: The backup operation that started at 'BackupTime' has encountered errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The backup operation that started at '%6' has encountered errors.

Fields #

Name	Description
`BackupTemplateID` GUID
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupState` Int32
`BackupTime` FILETIME
`BackupTarget` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`SourceSnapStartTime` FILETIME
`SourceSnapEndTime` FILETIME
`PrepareBackupStartTime` UnicodeString
`PrepareBackupEndTime` UnicodeString
`BackupWriteStartTime` UnicodeString
`BackupWriteEndTime` UnicodeString
`TargetSnapStartTime` FILETIME
`TargetSnapEndTime` FILETIME
`DVDFormatStartTime` UnicodeString
`DVDFormatEndTime` UnicodeString
`MediaVerifyStartTime` UnicodeString
`MediaVerifyEndTime` UnicodeString
`BackupPreviousState` Int32
`ComponentStatus` UnicodeString
`ComponentInfo` UnicodeString
`SSBEnumerateStartTime` FILETIME
`SSBEnumerateEndTime` FILETIME
`SSBVhdCreationStartTime` FILETIME
`SSBVhdCreationEndTime` FILETIME
`SSBBackupStartTime` FILETIME
`SSBBackupEndTime` FILETIME
`SystemStateBackup` UnicodeString
`BMR` UnicodeString
`VssFullBackup` Boolean
`UserInputBMR` Boolean
`UserInputSSB` Boolean
`BackupSuccessLogPath` UnicodeString
`BackupFailureLogPath` UnicodeString
`EnumerateBackupStartTime` UnicodeString
`EnumerateBackupEndTime` UnicodeString
`PruneBackupStartTime` UnicodeString
`PruneBackupEndTime` UnicodeString
`BackupFlags` HexInt32
`ComponentInfoSummary` UnicodeString

Event ID 24: Backup started a fresh backup for volume 'VolumeGUID' ('VolumeFriendlyName') : [Reason: 'VhdDeleteReason'].

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

Backup started a fresh backup for volume 'VolumeGUID' ('VolumeFriendlyName') : [Reason: 'VhdDeleteReason']. This may cause loss of older backup versions when backup completes.

Message #

Backup started a fresh backup for volume '%1' ('%2') : [Reason: '%3']. This may cause loss of older backup versions when backup completes.

Fields #

Name	Description
`VolumeGUID` GUID
`VolumeFriendlyName` UnicodeString
`VhdDeleteReason` UnicodeString

Event ID 25: Backup failed for volume 'VolumeGUID' ('VolumeFriendlyName'): [Reason: 'VhdDeleteReason'].

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

Backup failed for volume 'VolumeGUID' ('VolumeFriendlyName'): [Reason: 'VhdDeleteReason']. Please delete the target file 'VhdPath' and retry backup.

Message #

Backup failed for volume '%1' ('%2'): [Reason: '%3'].  Please delete the target file '%4' and retry backup.

Fields #

Name	Description
`VolumeGUID` GUID
`VolumeFriendlyName` UnicodeString
`VhdDeleteReason` UnicodeString
`VhdPath` UnicodeString

Event ID 49: The backup operation has failed because no backup storage location could be found.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has failed because no backup storage location could be found. Please confirm that the backup storage location is attached and online, and then rerun the backup operation.

Message #

The backup operation has failed because no backup storage location could be found. Please confirm that the backup storage location is attached and online, and then rerun the backup operation.

Event ID 50: The backup operation has failed because the required space was not available on the backup storage location.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has failed because the required space was not available on the backup storage location. Free up space on the storage location or change the storage location to one with enough space to run the backup.

Message #

The backup operation has failed because the required space was not available on the backup storage location. Free up space on the storage location or change the storage location to one with enough space to run the backup.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 51: The backup storage location is running low on free space.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup storage location is running low on free space. Future backup operations that store backups on this location may fail because of not enough space.

Message #

The backup storage location is running low on free space. Future backup operations that store backups on this location may fail because of not enough space.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 52: The backup operation has failed because the remote shared folder that you are using for a backup storage location is not writeable.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The backup operation has failed because the remote shared folder that you are using for a backup storage location is not writeable. Please check permissions for this location, and then rerun the backup operation.

Message #

The backup operation has failed because the remote shared folder that you are using for a backup storage location is not writeable. Please check permissions for this location, and then rerun the backup operation.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 53: Windows Server Backup is waiting for a DVD to be inserted into the drive.

Channel: Microsoft-Windows-Backup
Opcode: Info

Event ID 96: A scheduled backup has been configured for this computer.

Channel: Microsoft-Windows-Backup
Opcode: Info

Event ID 97: The scheduled backup for this computer has been modified.

Channel: Microsoft-Windows-Backup
Opcode: Info

Event ID 98: The scheduled backup was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Message #

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Event ID 99: A scheduled backup has been configured for this computer.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`UserName` UnicodeString
`TemplateGuid` GUID
`ScheduleTimesList` UnicodeString

Event ID 100: The scheduled backup was canceled.

Channel: Microsoft-Windows-Backup
Level: Informational
Opcode: Info

Description

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Message #

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1db28f2e-8f80-4027-8c5a-a11f7f10f62d",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T14:12:26.0335969+00:00",
    "event_record_id": 7,
    "correlation": {
      "ActivityID": "5eefaa82-9ceb-4afd-a085-5748719dc15b",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 6452,
      "thread_id": 11072
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation."
}

Event ID 144: A new volume 'VolumeFriendlyName' was detected that is not in the list of volumes to include in the backup.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

A new volume 'VolumeFriendlyName' was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.

Message #

A new volume '%1' was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 146: A volume 'VolumeFriendlyName' in the list of volumes to include in the backup is missing.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

A volume 'VolumeFriendlyName' in the list of volumes to include in the backup is missing. This could be because the volume is dismounted, reformatted, or the disk is detached. Please correct the issue or remove the volume from the list to back up, and then rerun the backup operation.

Message #

A volume '%1' in the list of volumes to include in the backup is missing. This could be because the volume is dismounted, reformatted, or the disk is detached. Please correct the issue or remove the volume from the list to back up, and then rerun the backup operation.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 160: The system catalog has been recovered from the backup storage location 'BackupTarget'.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The system catalog has been recovered from the backup storage location '%1'.

Fields #

Name	Description
`BackupTarget` UnicodeString
`MachineName` UnicodeString

Event ID 161: The system catalog has been deleted.

Channel: Microsoft-Windows-Backup
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1db28f2e-8f80-4027-8c5a-a11f7f10f62d",
    "event_source_name": "",
    "event_id": 161,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-30T14:12:26.0228403+00:00",
    "event_record_id": 6,
    "correlation": {
      "ActivityID": "5eefaa82-9ceb-4afd-a085-5748719dc15b",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 6452,
      "thread_id": 11072
    },
    "channel": "Microsoft-Windows-Backup",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The system catalog has been deleted."
}

Event ID 192: The recovery operation has started.

Channel: Microsoft-Windows-Backup
Opcode: Start

Fields #

Name	Description
`BackupSetId` GUID

Event ID 193: The operation to recover volume(s) has completed.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupTargetFriendlyName` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`PrepareRestoreTime` UInt32
`RestoreTime` FILETIME
`WriteRestoreTime` UInt32

Event ID 194: The operation to recover volume(s) that started at 'NumOfVolumes' has successfully completed.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover volume(s) that started at '%9' has successfully completed.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupTargetFriendlyName` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`PrepareRestoreTime` UInt32
`RestoreTime` FILETIME
`WriteRestoreTime` UInt32

Event ID 195: The volume recovery operation has completed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupTargetFriendlyName` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`PrepareRestoreTime` UInt32
`RestoreTime` FILETIME
`WriteRestoreTime` UInt32

Event ID 196: The volume recovery operation has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupTargetFriendlyName` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`PrepareRestoreTime` UInt32
`RestoreTime` FILETIME
`WriteRestoreTime` UInt32

Event ID 197: The operation to recover volume(s) that started at 'NumOfVolumes' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover volume(s) that started at '%9' was canceled.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`ErrorMessage` UnicodeString
`BackupTargetFriendlyName` UnicodeString
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`PrepareRestoreTime` UInt32
`RestoreTime` FILETIME
`WriteRestoreTime` UInt32

Event ID 198: The operation to recover volume 'VolumeFriendlyName' has failed or was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The operation to recover volume 'VolumeFriendlyName' has failed or was canceled. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.

Message #

The operation to recover volume '%1' has failed or was canceled. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 199: The operation to recover 'VolumeFriendlyName' has failed because the volume that you are recovering to is too small.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The operation to recover 'VolumeFriendlyName' has failed because the volume that you are recovering to is too small. Please try recovering to a larger volume.

Message #

The operation to recover '%1' has failed because the volume that you are recovering to is too small. Please try recovering to a larger volume.

Fields #

Name	Description
`VolumeFriendlyName` UnicodeString
`VolumeAccessPath` UnicodeString

Event ID 208: The operation to recover file(s) has completed.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32
`BackupLocation` UnicodeString
`TotalDataTransferred` UInt64

Event ID 209: The recovery operation of file(s) that started at 'RestoreTime' completed successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The recovery operation of file(s) that started at '%9' completed successfully.

Fields #

Name	Description
`BackupSetId` GUID
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` UInt32
`DetailedHRESULT` UInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32

Event ID 210: The file recovery operation completed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The file recovery operation completed with errors. One or more files may not have been recovered correctly.

Message #

The file recovery operation completed with errors. One or more files may not have been recovered correctly.

Fields #

Name	Description
`BackupSetId` GUID
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` UInt32
`DetailedHRESULT` UInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32

Event ID 211: The file recovery operation failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupSetId` GUID
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` UInt32
`DetailedHRESULT` UInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32

Event ID 212: The recovery operation of file(s) that started at 'RestoreTime' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The recovery operation of file(s) that started at '%9' was canceled.

Fields #

Name	Description
`BackupSetId` GUID
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` UInt32
`DetailedHRESULT` UInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32

Event ID 213: The backup set of volume 'VolumeToMount' on the backup storage location has been loaded.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Message #

The backup set of volume '%2' on the backup storage location has been loaded.

Fields #

Name	Description
`BackupSetId` GUID
`VolumeToMount` GUID
`NeedNetworkShare` Boolean
`HRESULT` HexInt32
`TimeTakenToMount` UInt32

Event ID 214: The operation to recover file(s) started at 'RestoreTime' has completed successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The operation to recover file(s) started at 'RestoreTime' has completed successfully. Log of files successfully recovered 'FileSuccessLogPath'.

Message #

The operation to recover file(s) started at '%10' has completed successfully. Log of files successfully recovered '%11'.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32
`BackupLocation` UnicodeString
`TotalDataTransferred` UInt64

Event ID 215: The file recovery operation has completed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The file recovery operation has completed with errors. One or more files may not have been recovered correctly. Log of files successfully recovered ''. Log of files not successfully recovered ''.

Message #

The file recovery operation has completed with errors. One or more files may not have been recovered correctly. Log of files successfully recovered '%11'. Log of files not successfully recovered '%12'.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32
`BackupLocation` UnicodeString
`TotalDataTransferred` UInt64

Event ID 216: The file recovery operation has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The file recovery operation has failed with errors. Log of files not successfully recovered 'FileFailureLogPath'.

Message #

The file recovery operation has failed with errors. Log of files not successfully recovered '%12'.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32
`BackupLocation` UnicodeString
`TotalDataTransferred` UInt64

Event ID 217: The operation to recover file(s) that started at 'RestoreTime' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover file(s) that started at '%10' was canceled.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`FileRestoreTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`NumOfFiles` UInt32
`FilesInfo` UnicodeString
`RestoreTime` FILETIME
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`MountVhdTime` UInt32
`PreparePassTime` UInt32
`WriteFilesTime` UInt32
`BackupLocation` UnicodeString
`TotalDataTransferred` UInt64

Event ID 224: The operation to recover component(s) has completed.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 225: The operation to recover component(s) that started at 'RestoreTime' has completed successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover component(s) that started at '%10' has completed successfully.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 226: The operation to recover component(s) has completed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The operation to recover component(s) has completed with errors. One or more components may not have been recovered correctly.

Message #

The operation to recover component(s) has completed with errors. One or more components may not have been recovered correctly.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 227: The operation to recover component(s) has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 228: The operation to recover component(s) that started at 'RestoreTime' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover component(s) that started at '%10' was canceled.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 240: The system state recovery operation started at 'RestoreTime'.

Channel: Microsoft-Windows-Backup
Opcode: Start

Message #

The system state recovery operation started at '%1'.

Fields #

Name	Description
`RestoreTime` FILETIME
`BackupSetID` GUID
`BackupSetTime` FILETIME
`RestoreType` Int32
`AlternateRestoreTarget` UnicodeString

Event ID 241: The system state recovery operation has completed.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Fields #

Name	Description
`RestoreTime` FILETIME
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreType` UInt32
`SysvolRestoreType` UInt32
`BackupSetID` GUID
`BackupSetTime` FILETIME
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`NumOfWriters` UInt32
`WritersInfo` UnicodeString
`NoOfFilesProcessed` UInt64
`NoOfFilesFailed` UInt64
`NoOfBytesProcessed` UInt64
`TotalNumOfBytes` UInt64
`EnumerateStartTime` FILETIME
`EnumerateEndTime` FILETIME
`RestoreStartTime` FILETIME
`RestoreEndTime` FILETIME
`DeleteStartTime` FILETIME
`DeleteEndTime` FILETIME
`RestoreSuccessLogPath` UnicodeString
`RestoreFailureLogPath` UnicodeString
`RestoreCLIOutputLogPath` UnicodeString
`TargetAccessPath` UnicodeString
`AlternateRecoveryPath` UnicodeString
`ErrorMessage` UnicodeString

Event ID 242: The system state recovery operation that started at 'RestoreTime' has completed successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The system state recovery operation that started at 'RestoreTime' has completed successfully. Log of the files successfully recovered: 'RestoreSuccessLogPath'.

Message #

The system state recovery operation that started at '%1' has completed successfully. Log of the files successfully recovered: '%22'.

Fields #

Name	Description
`RestoreTime` FILETIME
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreType` UInt32
`SysvolRestoreType` UInt32
`BackupSetID` GUID
`BackupSetTime` FILETIME
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`NumOfWriters` UInt32
`WritersInfo` UnicodeString
`NoOfFilesProcessed` UInt64
`NoOfFilesFailed` UInt64
`NoOfBytesProcessed` UInt64
`TotalNumOfBytes` UInt64
`EnumerateStartTime` FILETIME
`EnumerateEndTime` FILETIME
`RestoreStartTime` FILETIME
`RestoreEndTime` FILETIME
`DeleteStartTime` FILETIME
`DeleteEndTime` FILETIME
`RestoreSuccessLogPath` UnicodeString
`RestoreFailureLogPath` UnicodeString
`RestoreCLIOutputLogPath` UnicodeString
`TargetAccessPath` UnicodeString
`AlternateRecoveryPath` UnicodeString
`ErrorMessage` UnicodeString

Event ID 243: The system state recovery operation that started at 'RestoreTime' has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The system state recovery operation that started at 'RestoreTime' has failed with errors. Log of files successfully recovered 'RestoreSuccessLogPath'. Log of files not successfully recovered 'RestoreFailureLogPath'.

Message #

The system state recovery operation that started at '%1' has failed with errors. Log of files successfully recovered '%22'. Log of files not successfully recovered '%23'.

Fields #

Name	Description
`RestoreTime` FILETIME
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreType` UInt32
`SysvolRestoreType` UInt32
`BackupSetID` GUID
`BackupSetTime` FILETIME
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`NumOfWriters` UInt32
`WritersInfo` UnicodeString
`NoOfFilesProcessed` UInt64
`NoOfFilesFailed` UInt64
`NoOfBytesProcessed` UInt64
`TotalNumOfBytes` UInt64
`EnumerateStartTime` FILETIME
`EnumerateEndTime` FILETIME
`RestoreStartTime` FILETIME
`RestoreEndTime` FILETIME
`DeleteStartTime` FILETIME
`DeleteEndTime` FILETIME
`RestoreSuccessLogPath` UnicodeString
`RestoreFailureLogPath` UnicodeString
`RestoreCLIOutputLogPath` UnicodeString
`TargetAccessPath` UnicodeString
`AlternateRecoveryPath` UnicodeString
`ErrorMessage` UnicodeString

Event ID 244: The system state recovery operation that started at 'RestoreTime' has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

Message #

The system state recovery operation that started at '%1' has failed with errors. Log of files successfully recovered '%22'. Log of files not successfully recovered '%23'.

Fields #

Name	Description
`RestoreTime` FILETIME
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreType` UInt32
`SysvolRestoreType` UInt32
`BackupSetID` GUID
`BackupSetTime` FILETIME
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`NumOfWriters` UInt32
`WritersInfo` UnicodeString
`NoOfFilesProcessed` UInt64
`NoOfFilesFailed` UInt64
`NoOfBytesProcessed` UInt64
`TotalNumOfBytes` UInt64
`EnumerateStartTime` FILETIME
`EnumerateEndTime` FILETIME
`RestoreStartTime` FILETIME
`RestoreEndTime` FILETIME
`DeleteStartTime` FILETIME
`DeleteEndTime` FILETIME
`RestoreSuccessLogPath` UnicodeString
`RestoreFailureLogPath` UnicodeString
`RestoreCLIOutputLogPath` UnicodeString
`TargetAccessPath` UnicodeString
`AlternateRecoveryPath` UnicodeString
`ErrorMessage` UnicodeString

Event ID 245: The system state recovery operation that started at 'RestoreTime' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The system state recovery operation that started at '%1' was canceled.

Fields #

Name	Description
`RestoreTime` FILETIME
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreType` UInt32
`SysvolRestoreType` UInt32
`BackupSetID` GUID
`BackupSetTime` FILETIME
`NumOfVolumes` UInt32
`VolumesInfo` UnicodeString
`NumOfWriters` UInt32
`WritersInfo` UnicodeString
`NoOfFilesProcessed` UInt64
`NoOfFilesFailed` UInt64
`NoOfBytesProcessed` UInt64
`TotalNumOfBytes` UInt64
`EnumerateStartTime` FILETIME
`EnumerateEndTime` FILETIME
`RestoreStartTime` FILETIME
`RestoreEndTime` FILETIME
`DeleteStartTime` FILETIME
`DeleteEndTime` FILETIME
`RestoreSuccessLogPath` UnicodeString
`RestoreFailureLogPath` UnicodeString
`RestoreCLIOutputLogPath` UnicodeString
`TargetAccessPath` UnicodeString
`AlternateRecoveryPath` UnicodeString
`ErrorMessage` UnicodeString

Event ID 514: The backup catalog is corrupted.

Channel: Application
Opcode: Info

Description

The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the 'WBADMIN RESTORE CATALOG' command.

Message #

The backup catalog is corrupted. Please recover the catalog from a backup using the Windows Server Backup snap-in or the 'WBADMIN RESTORE CATALOG' command.

Event ID 517: The backup operation that started at 'BackupTime' has failed with following error code 'ErrorCode' (ErrorMessage).

Channel: Application
Opcode: Info

Description

The backup operation that started at '' has failed with following error code '' (). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%1' has failed with following error code '%2' (%3). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 518: The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress.

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Message #

The backup operation that started at '%1' has failed because another backup or recovery operation is in progress. Please stop the conflicting operation, and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 519: The backup operation that started at 'BackupTime' has failed to back up volume(s) 'FailedVolumeNames'.

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed to back up volume(s) 'FailedVolumeNames'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%1' has failed to back up volume(s) '%2'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTime` FILETIME
`FailedVolumeNames` UnicodeString
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 521: The backup operation that started at 'BackupTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being ...

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code 'ErrorCode'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation that started at '%1' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code '%2'. Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 522: There is no backup available on the storage location 'BackupTargetFriendlyName'.

Channel: Application
Opcode: Info

Description

There is no backup available on the storage location 'BackupTargetFriendlyName'. Please confirm that the storage location is not corrupted, and then create a new backup that you can use to perform a recovery from the storage location.

Message #

There is no backup available on the storage location '%1'. Please confirm that the storage location is not corrupted, and then create a new backup that you can use to perform a recovery from the storage location.

Fields #

Name	Description
`BackupTargetFriendlyName` UnicodeString

Event ID 523: The system catalog has been recovered from the backup storage location 'BackupTarget'.

Channel: Application
Opcode: Info

Message #

The system catalog has been recovered from the backup storage location '%1'.

Fields #

Name	Description
`BackupTarget` UnicodeString
`MachineName` UnicodeString

Event ID 524: The system catalog has been deleted.

Channel: Application
Level: Informational
Opcode: Info

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "{1DB28F2E-8F80-4027-8C5A-A11F7F10F62D}",
    "event_source_name": "",
    "event_id": 524,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-05-30T14:12:26.0228503+00:00",
    "event_record_id": 267449,
    "correlation": {
      "ActivityID": "{5EEFAA82-9CEB-4AFD-A085-5748719DC15B}"
    },
    "execution": {
      "process_id": 6452,
      "thread_id": 11072
    },
    "channel": "Application",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The system catalog has been deleted."
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

Backup Catalog Deleted source medium: Detects backup catalog deletionsT1070, T1070.004

Event ID 525: The backup operation that completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters.

Channel: Application
Opcode: Info

Description

The backup operation that completed with warning(s) - Volume 'VolumeFriendlyName' has developed new bad clusters. This may be an indication of problems with your hardware. BackupSourceNumUnreadableBytes bytes have not been backed up because they could not be read. Please run the CHKDSK /R command on 'VolumeFriendlyName' and then rerun the backup operation.

Message #

The backup operation that completed with warning(s) - Volume '%2' has developed new bad clusters. This may be an indication of problems with your hardware. %3 bytes have not been backed up because they could not be read. Please run the CHKDSK /R command on '%2' and then rerun the backup operation.

Fields #

Name	Description
`VolumeGuid` GUID
`VolumeFriendlyName` UnicodeString
`BackupSourceNumUnreadableBytes` Int64

Event ID 526: The scheduled backup configuration conflicts with current Group Policy settings, error - 'ErrorCode'.

Channel: Application
Opcode: Info

Description

The scheduled backup configuration conflicts with current Group Policy settings, error - 'ErrorCode'. The scheduled backup operation has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Message #

The scheduled backup configuration conflicts with current Group Policy settings, error - '%1'. The scheduled backup operation has failed due to the conflict. Please update the settings for Group Policy or the scheduled backup.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 527: The backup operation that started at 'BackupTime' has failed because recovery planning is in progress through some other client.

Channel: Application
Opcode: Info

Description

Message #

The backup operation that started at '%1' has failed because recovery planning is in progress through some other client. If multiple instances of the Recovery Wizard are running on the local computer or on a computer connected to the local computer, close these multiple instances and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 528: The scheduled backup configuration conflicts with current Group Policy settings, error - 'ErrorCode'.

Channel: Application
Opcode: Info

Description

The scheduled backup configuration conflicts with current Group Policy settings, error - 'BackupTime' ('ErrorCode'). The scheduled backup operation that started at 'ErrorCode' failed due to the conflict. Please update the settings for Group Policy or for the scheduled backup.

Message #

The scheduled backup configuration conflicts with current Group Policy settings, error - '%2'. The scheduled backup operation that started at '%1' failed due to the conflict. Please update the settings for Group Policy or for the scheduled backup.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 544: The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'ErrorCode'.

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because the Windows Server Backup engine could not be contacted, error code 'ErrorCode'. Please confirm that the service is installed and enabled, and then rerun the backup operation.

Message #

The backup operation that started at '%1' has failed because the Windows Server Backup engine could not be contacted, error code '%2'. Please confirm that the service is installed and enabled, and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 545: The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found.

Channel: Application
Opcode: Info

Description

The scheduled backup operation that started at 'BackupTime' has failed because the schedule settings were not found. Please reconfigure the scheduled backup.

Message #

The scheduled backup operation that started at '%1' has failed because the schedule settings were not found. Please reconfigure the scheduled backup.

Fields #

Name	Description
`BackupTime` FILETIME

Event ID 546: The backup operation attempted at 'BackupTime' has failed to start, error code 'ErrorCode' (ErrorMessage).

Channel: Application
Opcode: Info

Description

The backup operation attempted at 'BackupTime' has failed to start, error code 'ErrorCode' (ErrorMessage). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Message #

The backup operation attempted at '%1' has failed to start, error code '%2' (%3). Please review the event details for a solution, and then rerun the backup operation once the issue is resolved.

Fields #

Name	Description
`BackupTime` FILETIME
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 547: The backup operation that started at 'BackupTime' has encountered errors for the volume(s) 'FailedVolumeNames'.

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has encountered errors for the volume(s) 'FailedVolumeNames'. Log of files not successfully backed up 'BackupFailureLogPath'.

Message #

The backup operation that started at '%1' has encountered errors for the volume(s) '%2'. Log of files not successfully backed up '%3'.

Fields #

Name	Description
`BackupTime` FILETIME
`FailedVolumeNames` UnicodeString
`BackupFailureLogPath` UnicodeString

Event ID 561: The backup operation that started at 'BackupTime' has failed because no backup storage location could be found.

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because no backup storage location could be found. Please confirm that the backup storage location is attached and online, and then rerun the backup operation.

Message #

The backup operation that started at '%1' has failed because no backup storage location could be found. Please confirm that the backup storage location is attached and online, and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME

Event ID 564: The backup operation that started at 'BackupTime' has failed because the remote shared folder 'BackupTargetFriendlyName' that you are using for a backup storage location is not ...

Channel: Application
Opcode: Info

Description

The backup operation that started at 'BackupTime' has failed because the remote shared folder 'BackupTargetFriendlyName' that you are using for a backup storage location is not writeable. Please make sure user 'BackupUserName' has write permissions for this location, and then rerun the backup operation.

Message #

The backup operation that started at '%1' has failed because the remote shared folder '%2' that you are using for a backup storage location is not writeable. Please make sure user '%3' has write permissions for this location, and then rerun the backup operation.

Fields #

Name	Description
`BackupTime` FILETIME
`BackupTargetFriendlyName` UnicodeString
`BackupUserName` UnicodeString

Event ID 565: The consistency check for the component 'ComponentName'\'LogicalPath' has failed.

Channel: Application
Opcode: Info

Description

The consistency check for the component ''\'' has failed. The application '' will not be available in the backup created at ''. Review the event details for information about consistency check issues.

Message #

The consistency check for the component '%1'\'%2' has failed. The application '%3' will not be available in the backup created at '%4'. Review the event details for information about consistency check issues.

Fields #

Name	Description
`ComponentName` UnicodeString
`LogicalPath` UnicodeString
`ApplicationId` UnicodeString
`BackupTime` FILETIME
`WriterId` GUID
`ErrorCode` UInt32

Event ID 608: A scheduled backup has been configured to create a backup of 'BackupTargetList' daily at 'BackupTime'.

Channel: Application
Opcode: Info

Message #

A scheduled backup has been configured to create a backup of '%1' daily at '%2'.

Fields #

Name	Description
`BackupTargetList` UnicodeString
`BackupTime` FILETIME

Event ID 609: The scheduled backup has been modified to create a backup of 'BackupTargetList' daily at 'BackupTime'.

Channel: Application
Opcode: Info

Message #

The scheduled backup has been modified to create a backup of '%1' daily at '%2'.

Fields #

Name	Description
`BackupTargetList` UnicodeString
`BackupTime` FILETIME

Event ID 610: The scheduled backup was canceled.

Channel: Application
Opcode: Info

Description

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Message #

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Event ID 611: A scheduled backup has been configured for this computer.

Channel: Application
Opcode: Info

Event ID 612: The scheduled backup was canceled.

Channel: Application
Opcode: Info

Description

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Message #

The scheduled backup was canceled. To create a new backup, you must reconfigure scheduled backups or run a one-time backup operation.

Event ID 656: A new volume was detected that is not in the list of volumes to include in the backup.

Channel: Application
Opcode: Info

Description

A new volume was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.

Message #

A new volume was detected that is not in the list of volumes to include in the backup. Please add it to the scheduled backup configuration if you want to protect this volume.

Event ID 658: A volume 'BackupTargetFriendlyName' in the list of volumes to include in the backup is missing.

Channel: Application
Opcode: Info

Description

A volume 'BackupTargetFriendlyName' in the list of volumes to include in the backup is missing. This could be because the volume is dismounted, reformatted, or the disk is detached. Please correct the issue or remove the volume from the list to back up, and then rerun the backup operation.

Message #

A volume '%1' in the list of volumes to include in the backup is missing. This could be because the volume is dismounted, reformatted, or the disk is detached. Please correct the issue or remove the volume from the list to back up, and then rerun the backup operation.

Fields #

Name	Description
`BackupTargetFriendlyName` UnicodeString

Event ID 704: The operation to recover 'RestoreTargetNameList' was attempted at 'RestoreTime'.

Channel: Application
Opcode: Start

Message #

The operation to recover '%1' was attempted at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 706: The operation to recover 'RestoreTargetNameList' has successfully completed at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover '%1' has successfully completed at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 707: The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover '' has completed with errors at ''. Error reported ''(). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover '%1' has completed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 708: The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover '%1' has failed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 709: The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover '%1' was canceled at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 710: The operation to recover volume 'RestoreTargetNameList' has failed or was canceled at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover volume 'RestoreTargetNameList' has failed or was canceled at 'RestoreTime'. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.

Message #

The operation to recover volume '%1' has failed or was canceled at '%2'. The volume may now be corrupted and may need to be reformatted. Run CHKDSK /R on the volume to look for corrupted sectors.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 711: The operation to recover 'RestoreTargetNameList' has failed at 'RestoreTime' because the volume that you are recovering to is too small.

Channel: Application
Opcode: Info

Description

The operation to recover 'RestoreTargetNameList' has failed at 'RestoreTime' because the volume that you are recovering to is too small. Please try recovering to a larger volume.

Message #

The operation to recover '%1' has failed at '%2' because the volume that you are recovering to is too small. Please try recovering to a larger volume.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 721: The operation to recover 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover '%1' has completed successfully at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 722: The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover 'RestoreTargetNameList' has completed with errors at 'RestoreTime'. Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover '%1' has completed with errors at '%2'. Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 723: The operation to recover 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

Message #

The operation to recover '%1' has failed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 724: The operation to recover 'RestoreTargetNameList' was canceled at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover '%1' was canceled at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 737: The operation to recover component(s) 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover component(s) '%1' has completed successfully at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 738: The operation to recover component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover component(s) '%1' has completed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 739: The operation to recover component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover component(s) '%1' has failed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 740: The operation to recover component(s) 'RestoreTargetNameList' was canceled at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover component(s) '%1' was canceled at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 753: The Block Level Backup Engine service has successfully started.

Channel: Application
Level: Informational
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 753,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:45:13.856958+00:00",
    "event_record_id": 3732,
    "correlation": {},
    "execution": {
      "process_id": 10020,
      "thread_id": 2748
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 754: The Block Level Backup Engine service has stopped.

Channel: Application
Level: Informational
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Backup",
    "guid": "1DB28F2E-8F80-4027-8C5A-A11F7F10F62D",
    "event_source_name": "",
    "event_id": 754,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-13T20:55:13.877483+00:00",
    "event_record_id": 3745,
    "correlation": {},
    "execution": {
      "process_id": 10020,
      "thread_id": 2748
    },
    "channel": "Application",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 755: Installing the handler for the Block Level Backup Engine service has failed with error code 'HandleInstallErrorCode'.

Channel: Application
Opcode: Info

Message #

Installing the handler for the Block Level Backup Engine service has failed with error code '%1'.

Fields #

Name	Description
`HandleInstallErrorCode` UInt32

Event ID 756: The Block Level Backup Engine service received an unknown request with code 'UnknownRequestCode'.

Channel: Application
Opcode: Info

Message #

The Block Level Backup Engine service received an unknown request with code '%1'.

Fields #

Name	Description
`UnknownRequestCode` UInt32

Event ID 769: The system state recovery operation started at 'RestoreTime'.

Channel: Application
Opcode: Start

Message #

The system state recovery operation started at '%1'.

Fields #

Name	Description
`RestoreTime` FILETIME

Event ID 770: The system state recovery operation has completed.

Channel: Application
Opcode: Stop

Fields #

Name	Description
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 771: The system state recovery operation that started at 'RestoreTime' has completed successfully.

Channel: Application
Opcode: Info

Message #

The system state recovery operation that started at '%1' has completed successfully.

Fields #

Name	Description
`RestoreTime` FILETIME

Event ID 772: The system state recovery operation that started at 'RestoreTime' was canceled.

Channel: Application
Opcode: Info

Message #

The system state recovery operation that started at '%1' was canceled.

Fields #

Name	Description
`RestoreTime` FILETIME

Event ID 773: The system state recovery operation that started at 'RestoreTime' has completed with errors.

Channel: Application
Opcode: Stop

Description

The system state recovery operation that started at 'RestoreTime' has completed with errors. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The system state recovery operation that started at '%1' has completed with errors. Error reported '%2'(%3). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 774: The system state recovery operation that started at 'RestoreTime' has failed with errors.

Channel: Application
Opcode: Stop

Description

The system state recovery operation that started at 'RestoreTime' has failed with errors. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The system state recovery operation that started at '%1' has failed with errors. Error reported '%2'(%3). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 1025: The operation to recover Hyper-V component(s) has completed.

Channel: Microsoft-Windows-Backup
Opcode: Stop

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 1026: The operation to recover Hyper-V component(s) that started at 'RestoreTime' has completed successfully.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover Hyper-V component(s) that started at '%10' has completed successfully.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 1027: The operation to recover Hyper-V component(s) has completed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Description

The operation to recover Hyper-V component(s) has completed with errors. One or more components may not have been recovered correctly.

Message #

The operation to recover Hyper-V component(s) has completed with errors. One or more components may not have been recovered correctly.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 1028: The operation to recover Hyper-V component(s) has failed with errors.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 1029: The operation to recover Hyper-V component(s) that started at 'RestoreTime' was canceled.

Channel: Microsoft-Windows-Backup
Opcode: Info

Message #

The operation to recover Hyper-V component(s) that started at '%10' was canceled.

Fields #

Name	Description
`BackupSetId` GUID
`BackupSetTime` FILETIME
`RestoreEventId` GUID
`RecoveryFromSSB` Boolean
`BackupTargetPath` UnicodeString
`AppRestoreAlternateTargetPath` UnicodeString
`RestoreState` Int32
`HRESULT` HexInt32
`DetailedHRESULT` HexInt32
`RestoreTime` FILETIME
`NumOfComponents` UInt32
`FileSuccessLogPath` UnicodeString
`FileFailureLogPath` UnicodeString
`AppsInfo` UnicodeString
`AlternateLocationRecovery` Boolean
`RecreatePath` Boolean
`ComponentInfoSummary` UnicodeString

Event ID 1040: The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has completed successfully at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover Hyper-V component(s) '%1' has completed successfully at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 1041: The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has completed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover Hyper-V component(s) '%1' has completed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 1042: The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'.

Channel: Application
Opcode: Info

Description

The operation to recover Hyper-V component(s) 'RestoreTargetNameList' has failed with errors at 'RestoreTime'. Error reported 'ErrorCode'(ErrorMessage). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Message #

The operation to recover Hyper-V component(s) '%1' has failed with errors at '%2'. Error reported '%3'(%4). Please review the event details for solutions, and then rerun the recovery operation once the issue is resolved.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME
`ErrorCode` HexInt32
`ErrorMessage` UnicodeString

Event ID 1043: The operation to recover Hyper-V component(s) 'RestoreTargetNameList' was canceled at 'RestoreTime'.

Channel: Application
Opcode: Info

Message #

The operation to recover Hyper-V component(s) '%1' was canceled at '%2'.

Fields #

Name	Description
`RestoreTargetNameList` UnicodeString
`RestoreTime` FILETIME

Event ID 1044: New Online backup provider registered.

Channel: Application
Opcode: Info

Fields #

Name	Description
`ResourceDll` UnicodeString
`SnapinId` GUID
`ProviderNameId` UInt32
`ProviderIconId` UInt32

Event ID 1045: Online backup provider deregistered.

Channel: Application
Opcode: Info

Event ID 1281: Online backup has reported a status change.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`SnapinId` GUID
`StatusInfo` UnicodeString

Event ID 1282: New Online backup provider registered.

Channel: Microsoft-Windows-Backup
Opcode: Info

Fields #

Name	Description
`ResourceDll` UnicodeString
`SnapinId` GUID
`ProviderNameId` UInt32
`ProviderIconId` UInt32

Event ID 1283: Online backup provider deregistered.

Channel: Microsoft-Windows-Backup
Opcode: Info

Provenance

ETW provider GUID 1db28f2e-8f80-4027-8c5a-a11f7f10f62d

Defined in BlbEvents.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB