Microsoft-Windows-BrokerInfrastructure

Event	Title	Channel	Sample	Rule
1	An instance of a background task with entry point TaskEntryPoint and name …	Diagnostic	N	N
2	An instance of the background task with entry point EntryPoint running for user …	Diagnostic	N	N
3	The background infrastructure service issued a proxy activation for the …	Diagnostic	N	N
4	Background task for package PackageFullName with entry point EntryPoint was …	Diagnostic	N	N
5	Background task for package PackageFullName with entry point EntryPoint was …	Diagnostic	N	N
6	Background task for package PackageFullName with entry point EntryPoint did not …	Operational	Y	N
7	A signal request for the trigger with ID EventId and type EventType has begun.	Diagnostic	N	N
8	The signal request for the trigger with ID EventId and type EventType has …	Diagnostic	N	N
9	The condition with ID EventId and type EventType is changing state from OldState …	Diagnostic	N	N
10	The condition with ID EventId and type EventType has changed state from OldState …	Diagnostic	N	N
11	The application package PackageFullName running for user UserAccountName in …	Diagnostic	N	N
12	The application package PackageFullName running for user UserAccountName in …	Diagnostic	N	N
13	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N	N
14	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N	N
15	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N	N
16	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N	N
17	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N	N
18	An activation of a background task with entry point TaskEntryPoint and name …	Diagnostic	N	N
19	An instance with ID InstanceId of a background task with entry point …	Diagnostic	N	N
20	A background task with entry point TaskEntryPoint and name TaskName has been …	Diagnostic	N	N
21	The background task with entry point TaskEntryPoint and name TaskName failed to …	Operational	Y	N
22	BackgroundTaskInstanceDCStop_V1	Operational	N	N
23	BackgroundTaskDCStop_V1	Operational	N	N
24	PackageDCStop_V1	Operational	N	N
25	The application package PackageFullName was terminated due to inactivity.	Diagnostic	N	N
26	WatchdogIteration_V1	Operational	N	N
27	A background task with entry point TaskEntryPoint and name TaskName in package …	Diagnostic	N	N
28	SessionStateTransition	Diagnostic	N	N
100	BackgroundTaskPerfTrackStop	Operational	N	N
101	WatchdogIterationPerfTrackWatchdogIteration	Operational	N	N
200	PdcReferenceAcquire	Operational	N	N
201	PdcReferenceRelease	Operational	N	N
300	WorkItemBlockingDisconnectedStandby	Operational	N	N

Event ID 1: An instance of a background task with entry point TaskEntryPoint and name TaskName has been created in session UserContextId and given an ID of InstanceId.

Channel: Diagnostic
Task: BackgroundTask
Opcode: Start

Message #

An instance of a background task with entry point %2 and name %4 has been created in session %5 and given an ID of %6.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`UserContextId` UInt64
`InstanceId` GUID
`ApplicationId` UInt64
`PsmActivationType` UInt32
`CriticalActivation` Boolean
`TriggerEventId` GUID
`TriggerEventType` UInt32

Event ID 2: An instance of the background task with entry point EntryPoint running for user UserSid in session UserContextId returned with error code Result.

Channel: Diagnostic
Task: BackgroundTask
Opcode: Stop

Message #

An instance of the background task with entry point %9 running for user %6 in session %3 returned with error code %5.

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`UserContextId` UInt64
`TaskExecuted` Boolean
`Result` UInt32
`UserSid` SID
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`ApplicationId` UInt64
`CpuThrottleCount` UInt16
`NetThrottleCount` UInt16
`Flags` UInt16

Event ID 3: The background infrastructure service issued a proxy activation for the background task with ID WorkItemId.

Channel: Diagnostic
Task: BackgroundTaskProxy

Message #

The background infrastructure service issued a proxy activation for the background task with ID %1.

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`StateName` UInt64

Event ID 4: Background task for package PackageFullName with entry point EntryPoint was suspended due to CPU resource management policy.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskThrottledCpu

Message #

Background task for package %1 with entry point %3 was suspended due to CPU resource management policy.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Event ID 5: Background task for package PackageFullName with entry point EntryPoint was suspended due to Network resource management policy.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskThrottledNet

Message #

Background task for package %1 with entry point %3 was suspended due to Network resource management policy.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Event ID 6: Background task for package PackageFullName with entry point EntryPoint did not complete in response to a cancel notification.

Channel: Operational
Level: Informational
Task: BackgroundTask
Opcode: TaskForcedCompletion

Message #

Background task for package %1 with entry point %3 did not complete in response to a cancel notification.

Fields #

Name	Description
`PackageFullName` UnicodeString
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`UserSid` SID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 6,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 102,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-11T19:27:55.206435+00:00",
    "event_record_id": 445,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5084
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "PackageFullName": "MicrosoftWindows.Client.CBS_1000.22634.1000.0_x64__cw5n1h2txyewy",
    "EntryPointLength": 38,
    "EntryPoint": "IrisService.BackgroundTask.UpdateTimer",
    "UserSid": "S-1-5-21-3407486967-1585450050-1838039599-1000"
  },
  "message": ""
}

Event ID 7: A signal request for the trigger with ID EventId and type EventType has begun.

Channel: Diagnostic
Task: TriggerSignal
Opcode: Start

Message #

A signal request for the trigger with ID %1 and type %2 has begun.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32

Event ID 8: The signal request for the trigger with ID EventId and type EventType has completed.

Channel: Diagnostic
Task: TriggerSignal
Opcode: Stop

Message #

The signal request for the trigger with ID %1 and type %2 has completed.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32

Event ID 9: The condition with ID EventId and type EventType is changing state from OldState to NewState.

Channel: Diagnostic
Task: ConditionChange
Opcode: Start

Message #

The condition with ID %1 and type %2 is changing state from %3 to %4.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32
`OldState` UInt32
`NewState` Boolean

Event ID 10: The condition with ID EventId and type EventType has changed state from OldState to NewState.

Channel: Diagnostic
Task: ConditionChange
Opcode: Stop

Message #

The condition with ID %1 and type %2 has changed state from %3 to %4.

Fields #

Name	Description
`EventId` GUID
`EventType` UInt32
`OldState` UInt32
`NewState` Boolean

Event ID 11: The application package PackageFullName running for user UserAccountName in session UserContextId is changing state to PackageState.

Channel: Diagnostic
Task: PackageStateChange
Opcode: Start

Message #

The application package %1 running for user %2 in session %3 is changing state to %4.

Fields #

Name	Description
`PackageFullName` UnicodeString
`UserAccountName` UnicodeString
`UserContextId` UInt64
`PackageState` UInt32

Event ID 12: The application package PackageFullName running for user UserAccountName in session UserContextId has changed to state PackageState.

Channel: Diagnostic
Task: PackageStateChange
Opcode: Stop

Message #

The application package %1 running for user %2 in session %3 has changed to state %4.

Fields #

Name	Description
`PackageFullName` UnicodeString
`UserAccountName` UnicodeString
`UserContextId` UInt64
`PackageState` UInt32

Event ID 13: A background task with entry point TaskEntryPoint and name TaskName has been latched because its condition of type ConditionType has value ConditionValue but value ConditionDesiredValue was desired.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskLatched

Message #

A background task with entry point %2 and name %4 has been latched because its condition of type %5 has value %6 but value %7 was desired.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`ConditionType` UInt32
`ConditionValue` UInt32
`ConditionDesiredValue` Boolean

Event ID 14: A background task with entry point TaskEntryPoint and name TaskName has been unlatched.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnlatched

Message #

A background task with entry point %2 and name %4 has been unlatched.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 15: A background task with entry point TaskEntryPoint and name TaskName has been dropped.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskDropped

Message #

A background task with entry point %2 and name %4 has been dropped.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 16: An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because an instance of the task is already running.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskBufferedPolicy

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because an instance of the task is already running.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 17: An activation of a background task with entry point TaskEntryPoint and name TaskName has been buffered because BufferingReason.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskBufferedPackageState

Message #

An activation of a background task with entry point %2 and name %4 has been buffered because %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`BufferingReason` UInt32

Event ID 18: An activation of a background task with entry point TaskEntryPoint and name TaskName that was buffered because BufferingReason has been unbuffered.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnbuffered

Message #

An activation of a background task with entry point %2 and name %4 that was buffered because %5 has been unbuffered.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`BufferingReason` UInt32

Event ID 19: An instance with ID InstanceId of a background task with entry point TaskEntryPoint and name TaskName has been canceled in session UserContextId.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskCanceled

Message #

An instance with ID %5 of a background task with entry point %2 and name %4 has been canceled in session %6.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`InstanceId` GUID
`UserContextId` UInt64

Event ID 20: A background task with entry point TaskEntryPoint and name TaskName has been unregistered because DeletionReason.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskUnregistered

Message #

A background task with entry point %2 and name %4 has been unregistered because %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`DeletionReason` UInt32

Event ID 21: The background task with entry point TaskEntryPoint and name TaskName failed to activate with error code Result.

Channel: Operational
Level: Informational
Task: BackgroundTask
Opcode: TaskActivationFailed

Message #

The background task with entry point %2 and name %4 failed to activate with error code %5.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`Result` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-BrokerInfrastructure",
    "guid": "E6835967-E0D2-41FB-BCEC-58387404E25A",
    "event_source_name": "",
    "event_id": 21,
    "version": 0,
    "level": 4,
    "task": 100,
    "opcode": 113,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-12T02:57:25.195310+00:00",
    "event_record_id": 465,
    "correlation": {},
    "execution": {
      "process_id": 1116,
      "thread_id": 5364
    },
    "channel": "Microsoft-Windows-BackgroundTaskInfrastructure/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "EntryPointLength": 38,
    "TaskEntryPoint": "{8cfc164f-4be5-4fdd-94e9-e2af73ed4a19}",
    "NameLength": 28,
    "TaskName": "DashboardBackgroundFeedsTask",
    "Result": 2147746132
  },
  "message": ""
}

Event ID 22: BackgroundTaskInstanceDCStop_V1

Channel: Operational
Task: BackgroundTaskInstance
Opcode: DC_Stop

Fields #

Name	Description
`WorkItemId` GUID
`ApplicationId` UInt64
`UserContextId` UInt64
`PsmActivationType` UInt32
`CpuThrottleCount` UInt16
`NetThrottleCount` UInt16
`PackageFullName` UnicodeString

Event ID 23: BackgroundTaskDCStop_V1

Channel: Operational
Task: BackgroundTask
Opcode: DC_Stop

Fields #

Name	Description
`WorkItemId` GUID
`BrokerId` GUID
`TriggerEventId` GUID
`TriggerEventType` UInt32
`CriticalActivation` Boolean
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`UserSid` SID
`ConditionCount` UInt16
`ConditinalEvent` Boolean

Event ID 24: PackageDCStop_V1

Channel: Operational
Task: Package
Opcode: DC_Stop

Fields #

Name	Description
`UserContextId` UInt64
`StateFlags` UInt32
`ActiveTaskCount` UInt32
`LockScreen` Boolean
`PackageFullName` UnicodeString
`UserSid` SID

Event ID 25: The application package PackageFullName was terminated due to inactivity.

Channel: Diagnostic
Task: Package
Opcode: PackageWatchdog

Description

The application package PackageFullName was terminated due to inactivity. The following ActiveTaskCount background task(s) were running ActiveTasks.

Message #

The application package %5 was terminated due to inactivity. The following %3 background task(s) were running %7.

Fields #

Name	Description
`SessionId` UInt32
`StateFlags` UInt32
`ActiveTaskCount` UInt32
`LockScreen` Boolean
`PackageFullName` UnicodeString
`UserSid` SID
`ActiveTasks` UnicodeString

Event ID 26: WatchdogIteration_V1

Channel: Operational
Task: WatchdogIteration
Opcode: WatchdogIteration

Fields #

Name	Description
`Duration` UInt32
`Iteration` UInt32
`ActivitySummary` UInt32
`ActivityFilter` UInt32
`HangDetected` Boolean
`EventType` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString
`InstanceId` GUID
`CycleTime` UInt64
`NetTokens` UInt64
`PolicyVersion` UInt8

Event ID 27: A background task with entry point TaskEntryPoint and name TaskName in package PackageFullName is being canceled because it has an inactive instance running in session UserContextId.

Channel: Diagnostic
Task: BackgroundTask
Opcode: TaskWatchdog

Message #

A background task with entry point %2 and name %4 in package %5 is being canceled because it has an inactive instance running in session %7.

Fields #

Name	Description
`EntryPointLength` UInt16
`TaskEntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`InstanceId` GUID
`UserContextId` UInt64
`UserSid` SID
`LockScreen` Boolean

Event ID 28: SessionStateTransition

Channel: Diagnostic
Task: SessionStateTransition
Opcode: SessionStateTransition

Fields #

Name	Description
`SessionId` UInt32
`TransitionId` UInt32
`Transition` UInt32

Event ID 100: BackgroundTaskPerfTrackStop

Channel: Operational
Task: BackgroundTaskPerfTrack
Opcode: Stop

Fields #

Name	Description
`ElapsedTime` UInt32
`TaskThrottleCount` UInt32
`EventType` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString

Event ID 101: WatchdogIterationPerfTrackWatchdogIteration

Channel: Operational
Task: WatchdogIterationPerfTrack
Opcode: WatchdogIteration

Fields #

Name	Description
`Duration` UInt32
`ActivitySummary` UInt32
`EventTypeAndBitfield` UInt32
`PackageFullName` UnicodeString
`EntryPoint` UnicodeString

Event ID 200: PdcReferenceAcquire

Channel: Operational
Task: PdcReference
Opcode: Acquire

Fields #

Name	Description
`ActivityType` UInt32
`PackageFullName` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 201: PdcReferenceRelease

Channel: Operational
Task: PdcReference
Opcode: Release

Fields #

Name	Description
`ActivityType` UInt32
`PackageFullName` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString

Event ID 300: WorkItemBlockingDisconnectedStandby

Channel: Operational
Task: WorkItemBlockingDisconnectedStandby
Opcode: WorkItemBlockingDisconnectedStandby

Fields #

Name	Description
`WorkItemId` GUID
`EntryPointLength` UInt16
`EntryPoint` UnicodeString
`NameLength` UInt16
`TaskName` UnicodeString
`PackageFullName` UnicodeString
`UserSid` SID
`TriggerEventType` UInt32
`ScenarioInstanceId` UInt16
`AlwaysAllowed` Boolean
`VoipApp` Boolean

Provenance

ETW provider GUID e6835967-e0d2-41fb-bcec-58387404e25a

Defined in bisrv.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB