Microsoft-Windows-CloudRestoreLauncher
Event ID 1: Error ErrorCode occurred.
#Event ID 2: A backup operation has started.
#Description
A backup operation has started. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
activityId GUID | |
cv AnsiString | |
Trigger UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"event_id": 2,
"level": 4,
"task": 0,
"opcode": 0,
"time_created": "2026-05-27T16:17:04.4467055+00:00",
"computer": "DESKTOP-FF3N5XK.ludus.domain",
"channel": "Microsoft-Windows-CloudRestoreLauncher"
},
"event_data": {
"activityId": "{ea44b186-cedf-0003-a2a8-54eadfcedc01}",
"cv": "KFClce1PikGO8ObbbDX0oA.1.0",
"Trigger": "0"
}
}
Event ID 3: A backup operation has completed.
#Description
A backup operation has completed. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
activityId GUID | |
cv AnsiString | |
Trigger UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"event_id": 3,
"level": 4,
"task": 0,
"opcode": 0,
"time_created": "2026-05-27T16:17:04.4561698+00:00",
"computer": "DESKTOP-FF3N5XK.ludus.domain",
"channel": "Microsoft-Windows-CloudRestoreLauncher"
},
"event_data": {
"activityId": "{ea44b186-cedf-0003-a2a8-54eadfcedc01}",
"cv": "KFClce1PikGO8ObbbDX0oA.1.0",
"Trigger": "0"
}
}
Event ID 4: A restore operation has started.
#Event ID 5: A restore operation has completed.
#Event ID 6: Invoking backup restore handler HandlerId at index HandlerIndex.
#Event ID 7: Skipping backup restore handler HandlerId at index HandlerIndex.
#Event ID 8: Configuration is using variant Variant with payload Payload.
#Event ID 9: Manifest-based OperationMode operation failed to initialize with error ErrorCode.
#Event ID 10: Manifest-based OperationMode operation processed a backup unit and returned status StatusCode.
#Description
Manifest-based OperationMode operation processed a backup unit and returned status StatusCode. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
OperationMode UInt32 | |
StatusCode UInt32 | NTSTATUS reference |
Context UInt32 | |
ManifestId UnicodeString | |
Scope UnicodeString |
Event ID 11: Manifest-based OperationMode operation failed to process a backup with error ErrorCode.
#Description
Manifest-based OperationMode operation failed to process a backup with error ErrorCode. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
OperationMode UInt32 | |
ErrorCode Int32 | |
StatusCode UInt32 | NTSTATUS reference |
Context UInt32 | |
ManifestId UnicodeString | |
Scope UnicodeString |
Event ID 12: The backup operation is associated with a file.
#Event ID 13: The backup operation is associated with a file.
#Event ID 14: The restore operation is associated with a file.
#Event ID 15: The restore operation is associated with a file.
#Event ID 16: Loaded cloud data for TypeName.
#Event ID 17: Unable to load cloud data for TypeName.
#Event ID 18: Saved cloud data for TypeName.
#Event ID 19: Windows backup preferences settings Cloud store APIs Call Event.
#Description
Windows backup preferences settings Cloud store APIs Call Event. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PolicyName UnicodeString |
Event ID 20: Windows backup preferences settings Cloud store APIs Data Event.
#Description
Windows backup preferences settings Cloud store APIs Data Event. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
PolicyName UnicodeString | |
CloudStorePolicyOption UnicodeString |
Event ID 21: Information Message.
#Description
Information Message. See event details for message details.
Message #
Fields #
| Name | Description |
|---|---|
HandlerType UnicodeString | |
Message UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"guid": "{DC327E90-7748-58ED-F39C-8A8987CFAC58}",
"event_source_name": "",
"event_id": 21,
"version": 0,
"level": 5,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-04-13T04:02:11.9587868+00:00",
"event_record_id": 15,
"correlation": {},
"execution": {
"process_id": 8528,
"thread_id": 9012
},
"channel": "Microsoft-Windows-CloudRestoreLauncher/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
}
},
"event_data": {
"HandlerType": "Backup event",
"Message": "Failed to get account type"
},
"message": "Information Message. See event details for message details"
}
Event ID 22: The backup operation is associated with contrast theme.
#Event ID 23: The restore operation is associated with contrast theme.
#Event ID 24: The restore operation is associated with contrast theme.
#Event ID 25: The backup operation is associated with Date and time.
#Event ID 26: The restore operation is associated with Date and time.
#Event ID 27: Background Color
#Fields #
| Name | Description |
|---|---|
HandlerType UnicodeString | |
Red UInt8 | |
Green UInt8 | |
Blue UInt8 |
Event ID 28: Position of the Picture
#Fields #
| Name | Description |
|---|---|
HandlerType UnicodeString | |
Position UInt64 |
Event ID 29: Updated backup time in device profile ProfileId and sent to server transport for delivery to cloud.
#Event ID 30: Updated backup time in device profile ProfileId in local cache; transport not available for delivery to cloud.
#Event ID 31: Error ErrorCode occurred while attempting to update backup time in device profile ProfileId.
#Event ID 32: The backup operation is associated with personalization theme.
#Event ID 33: The restore service identified PlaceholderCount placeholder tiles requiring replacement.
#Event ID 34: The restore service was resumed to monitor placeholders.
#Event ID 35: Origin for OriginContext: Product AppIdOrProducCode with tile TileId was RemoveKind with heuristic Heuristic and replaced by ReplacedByTileId.
#Event ID 36: The backup operation is associated with Secondary Accounts.
#Event ID 37: The restore operation is associated with Secondary Accounts.
#Event ID 38: The API data returned to backup associated with Secondary Accounts.
#Event ID 39: Processing packaged products started
#Event ID 40: Processing packaged products stopped
#Event ID 41: Processing unpackaged products started
#Event ID 42: Processing unpackaged products stopped
#Event ID 43: Creating process CommandLine.
#Event ID 46: The restore operation is associated with personalization theme.
#Event ID 47: The backup operation is associated with ColorSettings.
#Description
The backup operation is associated with ColorSettings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
AppColorMode UInt64 | |
SystemColorMode UInt64 | |
enableTransperency UInt64 | |
colorPrevalnce UInt64 | |
accentColorMode UInt64 | |
dwmColorPrevalence UInt64 | |
Red UInt8 | |
Green UInt8 | |
Blue UInt8 |
Event ID 48: The restore operation is associated with ColorSettings.
#Description
The restore operation is associated with ColorSettings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
AppColorMode UInt64 | |
SystemColorMode UInt64 | |
enableTransperency UInt64 | |
colorPrevalnce UInt64 | |
accentColorMode UInt64 | |
dwmColorPrevalence UInt64 | |
Red UInt8 | |
Green UInt8 | |
Blue UInt8 |
Event ID 49: An app restore operation has started.
#Event ID 50: A app restore operation has completed.
#Event ID 51: Consulting compat providers started.
#Event ID 52: Consulting compat providers stopped.
#Event ID 53: The backup operation is associated with Lunar Calendar Settings.
#Event ID 54: The restore operation is associated with Lunar Calendar Settings.
#Event ID 55: The backup operation is associated with Nightlight settings.
#Description
The backup operation is associated with Nightlight settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
automaticOnSchedule UInt64 | |
automaticOnSunset UInt64 | |
manualScheduleBlueLightReductionOnHours UInt64 | |
manualScheduleBlueLightReductionOffHours UInt64 | |
targetColorTemperature UInt64 | |
sunsetHours UInt64 | |
sunriseHours UInt64 | |
previewColorTemperatureChanges UInt64 | |
darkMode UInt64 |
Event ID 56: The backup operation is associated with Nightlight settings.
#Event ID 57: The restore operation is associated with Nightlight settings.
#Description
The restore operation is associated with Nightlight settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
automaticOnSchedule UInt64 | |
automaticOnSunset UInt64 | |
manualScheduleBlueLightReductionOnHours UInt64 | |
manualScheduleBlueLightReductionOffHours UInt64 | |
targetColorTemperature UInt64 | |
sunsetHours UInt64 | |
sunriseHours UInt64 | |
previewColorTemperatureChanges UInt64 | |
darkMode UInt64 |
Event ID 58: The restore operation is associated with Nightlight settings.
#Event ID 59: The restore operation is associated with Sound settings.
#Description
The restore operation is associated with Sound settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
Event ID 60: The restore operation data, Associated with Sound settings.
#Event ID 61: The backup operation is associated with Ink Pen Settings.
#Description
The backup operation is associated with Ink Pen Settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
singleClickOverride UInt64 | |
singleClickPenWorkspaceVerb UInt64 | |
doubleClickOverride UInt64 | |
doubleClickPenWorkspaceVerb UInt64 | |
longPressOverride UInt64 | |
longPressPenWorkspaceVerb UInt64 | |
penWorkspaceAppLaunchOnPenDetachEnabled UInt64 | |
penEnablePenButtonOverride UInt64 | |
singleClickCustomAppPath UnicodeString | |
doubleClickCustomAppPath UnicodeString | |
longPressCustomAppPath UnicodeString | |
singleClickCustomAppID UnicodeString | |
doubleClickCustomAppID UnicodeString | |
longPressCustomAppID UnicodeString |
Event ID 62: The restore operation is associated with Ink Pen Settings.
#Description
The restore operation is associated with Ink Pen Settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
singleClickOverride UInt64 | |
singleClickPenWorkspaceVerb UInt64 | |
doubleClickOverride UInt64 | |
doubleClickPenWorkspaceVerb UInt64 | |
longPressOverride UInt64 | |
longPressPenWorkspaceVerb UInt64 | |
penWorkspaceAppLaunchOnPenDetachEnabled UInt64 | |
penEnablePenButtonOverride UInt64 | |
singleClickCustomAppPath UnicodeString | |
doubleClickCustomAppPath UnicodeString | |
longPressCustomAppPath UnicodeString | |
singleClickCustomAppID UnicodeString | |
doubleClickCustomAppID UnicodeString | |
longPressCustomAppID UnicodeString |
Event ID 63: Ink Pen Setting Status.
#Description
Ink Pen Setting Status. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Setting UnicodeString | |
Status UnicodeString | NTSTATUS reference |
Event ID 64: The backup operation is associated with Background Slideshow Settings.
#Event ID 65: The restore operation is associated with Background Slideshow Settings.
#Event ID 66: The restore operation Error, Associated with Sound settings.
#Event ID 67: CPL Excluded Event Name, Associated with Sound settings.
#Event ID 68: The backup operation is associated with Device settings.
#Event ID 69: The restore operation is associated with Device settings.
#Event ID 70: The backup operation is associated with Device settings.
#Description
The backup operation is associated with Device settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
Event ID 71: The restore operation is associated with Device settings.
#Description
The restore operation is associated with Device settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
Event ID 72: The Bond Schema Activity backup associated with Device settings restore opration.
#Description
The Bond Schema Activity backup associated with Device settings restore opration. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
LogMessage UnicodeString |
Event ID 73: The Bond Schema Activity backup associated with Device settings backup opration.
#Description
The Bond Schema Activity backup associated with Device settings backup opration. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
LogMessage UnicodeString |
Event ID 74: The Skipping operation is associated with Device settings.
#Description
The Skipping operation is associated with Device settings. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
Operation UnicodeString | Known values
|
LogMessage UnicodeString |
Event ID 75: Taskbar Pins are prevented for All App placeholders with App IDs
#Fields #
| Name | Description |
|---|---|
AppIDs UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"event_id": 75,
"level": 4,
"task": 0,
"opcode": 0,
"time_created": "2026-04-18T01:46:57.9584544+00:00",
"computer": "DESKTOP-FF3N5XK",
"channel": "Microsoft-Windows-CloudRestoreLauncher"
},
"event_data": {
"AppIDs": ""
}
}
Event ID 76: Error: Type; See event details for more information.
#Message #
Fields #
| Name | Description |
|---|---|
Type UInt32 | |
ErrorCode Int32 | |
File AnsiString | |
LineNumber UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"event_id": 76,
"level": 2,
"task": 0,
"opcode": 0,
"time_created": "2026-05-27T20:01:17.7548926+00:00",
"computer": "DESKTOP-FF3N5XK.ludus.domain",
"channel": "Microsoft-Windows-CloudRestoreLauncher"
},
"event_data": {
"ErrorCode": "-2147221231",
"LineNumber": "171",
"File": "pcshell\\shell\\cloudrestorelauncher\\dll\\dll.cpp",
"Type": "1"
}
}
Event ID 77: The backup operation is associated with contrast theme.
#Event ID 78: The restore operation is associated with contrast theme.
#Event ID 79: The backup operation is associated with personalization theme.
#Event ID 80: The restore operation is associated with personalization theme.
#Event ID 81: Manifest-based OperationMode operation processed a backup unit and returned status StatusCode.
#Description
Manifest-based OperationMode operation processed a backup unit and returned status StatusCode. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
OperationMode UInt32 | |
StatusCode UInt32 | NTSTATUS reference |
Status UnicodeString | NTSTATUS reference |
Context UInt32 | |
ManifestId UnicodeString | |
Scope UnicodeString |
Event ID 82: Manifest-based OperationMode operation failed to process a backup with error ErrorCode.
#Description
Manifest-based OperationMode operation failed to process a backup with error ErrorCode. See event details for more information.
Message #
Fields #
| Name | Description |
|---|---|
OperationMode UInt32 | |
ErrorCode Int32 | |
StatusCode UInt32 | NTSTATUS reference |
Status UnicodeString | NTSTATUS reference |
Context UInt32 | |
ManifestId UnicodeString | |
Scope UnicodeString |
Event ID 83: No changes detected in HandlerType since last backup.
#Event ID 84: Backup functionality is currently disabled due to policy settings.
#Description
Backup functionality is currently disabled due to policy settings. For further assistance, please reach out to your administrator.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-CloudRestoreLauncher",
"event_id": 84,
"level": 3,
"task": 0,
"opcode": 0,
"time_created": "2026-05-27T16:17:04.4561635+00:00",
"computer": "DESKTOP-FF3N5XK.ludus.domain",
"channel": "Microsoft-Windows-CloudRestoreLauncher"
},
"event_data": {}
}
Event ID 85: Unable to restore the time zone from backup because the required ?
#Description
Unable to restore the time zone from backup because the required ?Change the time zone? permission is missing. For further assistance, please reach out to your administrator.
Message #
Event ID 86: The backup operation was skipped because the functionality is currently disabled due to policy settings.
#Event ID 87
#Event ID 88
#Fields #
| Name | Description |
|---|---|
OperationStatus UInt32 | NTSTATUS reference |
Event ID 90
#Fields #
| Name | Description |
|---|---|
Operation UInt32 | Known values
|
PolicyName UnicodeString |
Event ID 91
#Fields #
| Name | Description |
|---|---|
Operation UInt32 | Known values
|
PolicyName UnicodeString | |
CloudStorePolicyOption UnicodeString |
Provenance
ETW provider GUID dc327e90-7748-58ed-f39c-8a8987cfac58
Defined in CloudRestoreLauncher.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB