Microsoft-Windows-BranchCache
41 events across 1 channel
Event ID 1: The BranchCache service started successfully.
#Description
The BranchCache service started successfully.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BranchCache",
"guid": "{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}",
"event_source_name": "",
"event_id": 1,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T04:03:32.7794465+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 9124,
"thread_id": 8160
},
"channel": "Microsoft-Windows-BranchCache/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-20"
}
},
"event_data": {},
"message": "The BranchCache service started successfully."
}
Event ID 2: The BranchCache service stopped successfully.
#Description
The BranchCache service stopped successfully.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BranchCache",
"guid": "{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}",
"event_source_name": "",
"event_id": 2,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T04:15:22.1019452+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 9124,
"thread_id": 5752
},
"channel": "Microsoft-Windows-BranchCache/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-20"
}
},
"event_data": {},
"message": "The BranchCache service stopped successfully."
}
Event ID 3: The BranchCache service detected that this computer roamed to a different location.
#Description
The BranchCache service detected that this computer roamed to a different location. Group Policy settings will refresh.
Message #
Event ID 4: The BranchCache service failed to start.
#Event ID 5: A BranchCache configuration change was detected.
#Event ID 6: This computer is configured as a Hosted Cache server and it is also configured to use a Hosted Cache.
#Description
This computer is configured as a Hosted Cache server and it is also configured to use a Hosted Cache. Only one of these options is allowed.
Message #
Event ID 7: A firewall is blocking inbound traffic on UDP port 3702, which is used to discover the availability of cached content on this computer.
#Description
A firewall is blocking inbound traffic on UDP port 3702, which is used to discover the availability of cached content on this computer. Other computers on the network cannot discover this client.
Message #
Event ID 8: A firewall is blocking inbound traffic on TCP port 80, which is used to serve content to requesting computers.
#Description
A firewall is blocking inbound traffic on TCP port 80, which is used to serve content to requesting computers. As a result, other computers on the network, including the Hosted Cache server, cannot retrieve content from this client. To create a Windows Firewall rule that allows inbound traffic on TCP port 80, run the enable cmdlet appropriate to your service mode from an elevated PowerShell command prompt. If a different firewall is used, modify the firewall settings to allow this traffic.
Message #
Event ID 9: A firewall is blocking inbound traffic on TCP port 443, which is used by the Hosted Cache server for accepting incoming client offers to add content.
#Description
A firewall is blocking inbound traffic on TCP port 443, which is used by the Hosted Cache server for accepting incoming client offers to add content. As a result, clients cannot add content to the Hosted Cache. To create a Windows Firewall rule that allows inbound traffic on TCP port 443, run the command "Enable-BCHostedServer" from an elevated PowerShell command prompt. If a different firewall is used, modify the firewall settings to allow this traffic.
Message #
Event ID 10: The BranchCache service cannot start because the HTTP namespace used for serving content to requesting clients is not reserved.
#Description
The BranchCache service cannot start because the HTTP namespace used for serving content to requesting clients is not reserved.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BranchCache",
"guid": "{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}",
"event_source_name": "",
"event_id": 10,
"version": 0,
"level": 2,
"task": 0,
"opcode": 10,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T13:38:19.7150080+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 7544,
"thread_id": 5036
},
"channel": "Microsoft-Windows-BranchCache/Operational",
"computer": "telemetry-DC-d.cell-d.ludus.domain",
"security": {
"user_id": "S-1-5-20"
}
},
"event_data": {},
"message": "The BranchCache service cannot start because the HTTP namespace used for serving content to requesting clients is not reserved. \r\nRun the enable cmdlet appropriate to your service mode from an elevated PowerShell command prompt."
}
Event ID 11: Content was not cached.
#Event ID 12: BranchCache cannot publish the content at location Error.
#Event ID 13: BranchCache cannot publish the content with content-id: ContentId because the publication cache size was exceeded or the disk does not have enough space.
#Event ID 14: A request message sent to another BranchCache client failed.
#Event ID 15: A request message sent to the Hosted Cache server failed.
#Event ID 16: A BranchCache client or hosted cache server was unresponsive or provided invalid data.
#Event ID 17: A request message from another BranchCache client was dropped because it was not valid.
#Event ID 18: A content retrieval request from another BranchCache client was denied.
#Event ID 19: BranchCache tried to offer content to the Hosted Cache server on Error, but there was an error connecting to the Hosted Cache server.
#Event ID 20: BranchCache tried to offer content to the Hosted Cache server on HostedCacheLocation, but the request timed out.
#Description
BranchCache tried to offer content to the Hosted Cache server on HostedCacheLocation, but the request timed out. The Hosted Cache server might be experiencing heavy loads or might not be reachable because of network or authentication issues.
Message #
Fields #
| Name | Description |
|---|---|
HostedCacheLocation UnicodeString |
Event ID 21: Count instance(s) of event id EventId occurred.
#Event ID 22: The Windows Firewall rules for the BranchCache service are not configured correctly.
#Description
The Windows Firewall rules for the BranchCache service are not configured correctly.
Message #
Event ID 23: The BranchCache service could not be started because it has been disabled.
#Description
The BranchCache service could not be started because it has been disabled.
Message #
Event ID 24: The BranchCache service started, but was unable to load the cache file from disk because the cache file was corrupted or was an incompatible version.
#Event ID 25: The BranchCache service started and loaded a cache file from disk.
#Description
The BranchCache service started and loaded a cache file from disk.
Message #
Fields #
| Name | Description |
|---|---|
LoadPersistedCacheSucceededEvent.Timestamp SYSTEMTIME | |
Timestamp SYSTEMTIME |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BranchCache",
"guid": "{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}",
"event_source_name": "",
"event_id": 25,
"version": 0,
"level": 4,
"task": 0,
"opcode": 16,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T04:03:35.6027279+00:00",
"event_record_id": 2,
"correlation": {},
"execution": {
"process_id": 9124,
"thread_id": 14668
},
"channel": "Microsoft-Windows-BranchCache/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-20"
}
},
"user_data": {
"LoadPersistedCacheSucceededEvent": {
"Timestamp": "1601-01-01T00:00:00.0000000Z"
}
},
"message": "The BranchCache service started and loaded a cache file from disk."
}
Event ID 26: BranchCache saved a cache file to disk.
#Event ID 27: The BranchCache service stopped and was unable to save the cache file to disk.
#Event ID 28: The BranchCache service is stopping.
#Description
The BranchCache service is stopping.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-BranchCache",
"guid": "{7EAFCF79-06A7-460B-8A55-BD0A0C9248AA}",
"event_source_name": "",
"event_id": 28,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T04:15:21.9806347+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 9124,
"thread_id": 5752
},
"channel": "Microsoft-Windows-BranchCache/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-20"
}
},
"event_data": {},
"message": "The BranchCache service is stopping."
}
Event ID 29: An SSL certificate is not bound to the port Port on the Hosted Cache server.
#Event ID 30: BranchCache cannot initialize the local cache at location Error.
#Event ID 31: A request message sent to a Hosted Cache client failed.
#Event ID 32: The size of the republication cache store at Path is too small.
#Event ID 33: The size of the publication cache store at Path is too small.
#Event ID 34: BranchCache failed to register a service connection point.
#Event ID 35: BranchCache failed to update a service connection point.
#Event ID 36: BranchCache failed to delete a service connection point.
#Event ID 37: BranchCache failed to discover a service connection point.
#Event ID 38: BranchCache completed defragmentation of the republication cache store at Error.
#Event ID 39: It is recommended that you consider defragmentation of the republication cache store at Path.
#Event ID 40: Client request was dropped because allowable simultaneous uploads limit was reached.
#Event ID 41: BranchCache cannot start because another application or service is listening on TCP port ListenPort (HTTP).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 7eafcf79-06a7-460b-8a55-bd0a0c9248aa
Defined in peerdistsvc.dll, which carries the event manifest.
Observed on:
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02