Microsoft-Windows-CloudStore

60 events across 3 channels

Event	Title	Channel	Sample
1	Error ErrorCode occurred.	Operational	Y
2	Error ErrorCode occurred.	Operational	Y
1000	Discovered schema provider SchemaProvider.	Debug	N
1001	Successfully loaded ProviderCount schemas.	Debug	N
2001	Ignoring ommitted field FieldId with unknown type BondDataType.	Operational	N
2003	Conflict resolution of type {QualifiedTypeName} started.	Operational	N
2004	Conflict resolution of type QualifiedTypeName complete.	Debug	Y
2005	Conflict resolution of type {QualifiedTypeName} complete.	Operational	N
2006	Conflict resolution of type {CorrelationVector} complete.	Debug	N
2007	Resolved a set containing duplicated values.	Operational	N
2008	The 'original' version (OriginalVersion) of type QualifiedTypeName is more …	Operational	N
2009	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2010	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2011	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2012	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2013	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2014	The data of type QualifiedTypeName was corrupted and ignored.	Operational	N
2015	The AppExtension of name AppExtensionName having type TypeName failed with error …	Operational	N
2016	The AppExtension of name AppExtensionName having type TypeName failed with error …	Operational	N
2017	Found an list item instance with a missing index value while merging vector as a …	Operational	N
2018	Conflict resolution policy of VectorAsMap requires an index field to be defined …	Operational	N
2019	Conflict resolution policy of VectorAsMap requires index fields to be an integer …	Operational	N
2020	Conflict resolution policy of VectorAsMap the list items to be a structure.	Operational	N
3002	Sucessfully deleted Version.	Debug	N
3003	Saving Id and merging with 'theirs' data.	Debug	Y
3004	Saving Id without 'theirs' data.	Debug	N
3005	Overwriting Id with 'yours' data to repair inaccessible store (access failed …	Operational	N
3006	Uploading Id failed with error code ErrorCode.	Operational	N
3007	Successfully loaded CorrelationVector.	Debug	Y
3008	Successfully saved CorrelationVector.	Debug	Y
3010	Successfully saved cloud data for {Id}.	Debug	N
3012	Successfully saved merged cloud data for {Id}.	Debug	N
3013	Downloading Id failed with error code ErrorCode.	Operational	Y
3014	Delete of Id was ignored because the data changed after it was deleted.	Debug	N
3015	The attempt to load CorrelationVector failed because the data was corrupt.	Operational	N
3016	The value {Id} was garbage collected from the local cache because it was not …	Operational	N
3017	The object ObjectName has an unexpected security descriptor.	Debug	Y
3018	The cache invalidator has started.	Debug	Y
3019	The cache invalidator has stopped.	Debug	Y
3020	The cache invalidator is processing ActivitiesCount activities.	Debug	N
3021	The Backup master policy is set.	Operational	Y
3022	Backup policy name Id set failed with error code ErrorCode.	Operational	N
3023	The transport layer reported a failure: Id with error code ErrorCode.	Operational	Y
3032	Error TranslatedErrorCode occurred trying to perform file copy operation for …	Operational	N
3033	Error TranslatedErrorCode occurred trying to retrive the device profile during …	Operational	N
4000	Attempting to save device profile BackupProfileId.	Initialization	Y
4001	Error saving internal type TypeName: StatusCode.	Initialization	N
4002	Successfully setup Cloud Store backup/restore partition information.	Initialization	Y
4003	Failed to setup Cloud Store backup/restore partition information at stage Stage …	Initialization	N
4004	Timed out after mirroring UpdateCount settings sync policies in Elapsed …	Initialization	N
4005	Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.	Initialization	Y
4006	Set policy Target to Enabled.	Initialization	Y
4007	Failed to set policy Target to Enabled: ErrorCode.	Initialization	Y
4008	Restore data successfully copied from restore partition RestorePartitionId to …	Initialization	N
4009	Failed to copy restore data successfully copied from restore partition …	Initialization	N
4010	Copied single restore partition data item from Path to backup partition as Id.	Initialization	N
4011	Skipped copying single restore partition at Path to backup partition as Id as it …	Initialization	N
4012	Error processing type TypeName.	Initialization	N
10000	task_010000	Operational	N
10001	task_010001	Debug	N

Event ID 1: Error ErrorCode occurred.

Provider: Microsoft-Windows-CloudStore
Channel: Operational
Level: Error

Description

Error ErrorCode occurred. See event details for more information.

Message #

Error %3 occurred. See event details for more information.

Fields #

Name	Description
`ProcessName` UnicodeString
`Type` UInt32
`ErrorCode` UInt32
`File` AnsiString
`LineNumber` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "{741BB90C-A7A3-49D6-BD82-1E6B858403F7}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-06-13T14:08:49.3524435+00:00",
    "event_record_id": 2464,
    "correlation": {},
    "execution": {
      "process_id": 1956,
      "thread_id": 7312
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "ProcessName": "svchost.exe",
    "Type": "1",
    "ErrorCode": "2147943712",
    "File": "onecoreuap\\shell\\cloudstore\\store\\cache\\src\\cloudcacheinitializer.cpp",
    "LineNumber": "313"
  },
  "message": "Error 0x80070520 occurred. See event details for more information."
}

Event ID 2: Error ErrorCode occurred.

Provider: Microsoft-Windows-CloudStore
Channel: Operational
Level: Error

Description

Error ErrorCode occurred. See event details for more information.

Message #

Error %3 occurred. See event details for more information.

Fields #

Name	Description
`ProcessName` UnicodeString
`Type` UInt32
`ErrorCode` UInt32
`File` AnsiString
`LineNumber` UInt32
`Context` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "event_id": 2,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-23T06:06:38.2590701+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-CloudStore"
  },
  "event_data": {
    "Type": "1",
    "ErrorCode": "2147943712",
    "ProcessName": "svchost.exe",
    "LineNumber": "5735",
    "Context": "onecoreuap\\shell\\cloudstore\\store\\api\\src\\cloudstore.cpp(5727)\\Windows.CloudStore.dll!00007FFE02064705: (caller: 00007FFE0493C44A) Exception(6) tid(1460) 80070520 A specified logon session does not exist. It may already have been terminated.\n",
    "File": "onecoreuap\\shell\\cloudstore\\store\\api\\src\\cloudstore.cpp"
  }
}

Event ID 1000: Discovered schema provider SchemaProvider.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Discovered schema provider SchemaProvider.

Message #

Discovered schema provider %1.

Fields #

Name	Description
`SchemaProvider` GUID

Event ID 1001: Successfully loaded ProviderCount schemas.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Successfully loaded ProviderCount schemas.

Message #

Successfully loaded %1 schemas.

Fields #

Name	Description
`ProviderCount` UInt32

Event ID 2001: Ignoring ommitted field FieldId with unknown type BondDataType.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Ignoring ommitted field FieldId with unknown type BondDataType.

Message #

Ignoring ommitted field %1 with unknown type %2.

Fields #

Name	Description
`FieldId` UInt16
`BondDataType` UInt32

Event ID 2003: Conflict resolution of type {QualifiedTypeName} started.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Message #

Conflict resolution of type {QualifiedTypeName} started. 'Yours' data is version {YoursVersion} with size {YoursSize}. See event details for more information. Extended information may be available in the Debug log.

Fields #

Name	Description
`QualifiedTypeName`
`YoursVersion`
`YoursSize`

Event ID 2004: Conflict resolution of type QualifiedTypeName complete.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

Conflict resolution of type QualifiedTypeName complete. See event details for more information.

Message #

Conflict resolution of type %2 complete. See event details for more information.

Fields #

Name	Description
`CorrelationVector` AnsiString
`QualifiedTypeName` AnsiString
`SchemaSize` UInt32
`Schema` Binary
`ForceLastWriterWins` Boolean
`OriginalVersion` UInt64
`OriginalTombstoned` Boolean
`OriginalSize` UInt32
`OriginalData` Binary
`TheirsVersion` UInt64
`TheirsTombstoned` Boolean
`TheirsSize` UInt32
`TheirsData` Binary
`YoursVersion` UInt64
`YoursTombstoned` Boolean
`YoursSize` UInt32
`YoursData` Binary
`ResolvedVersion` UInt64
`ResolvedTombstoned` Boolean
`ResolvedSize` UInt32
`ResolvedData` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "{741BB90C-A7A3-49D6-BD82-1E6B858403F7}",
    "event_source_name": "",
    "event_id": 2004,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-04-22T03:18:46.7691396+00:00",
    "event_record_id": 4288,
    "correlation": {
      "ActivityID": "{5D13569F-CEA5-000B-F88B-145DA5CEDC01}"
    },
    "execution": {
      "process_id": 2560,
      "thread_id": 10028
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "CorrelationVector": "smQ/g1iulCJ0PKzgFJZGTC.2.2",
    "QualifiedTypeName": "Windows.Data.Settings.SettingsUsageHistory",
    "SchemaSize": "0",
    "Schema": "",
    "ForceLastWriterWins": "false",
    "OriginalVersion": "1776827843",
    "OriginalTombstoned": "false",
    "OriginalSize": "476",
    "OriginalData": "434201000D120A0319530065007400740069006E0067007300500061006700650049006E007300740061006C006C0065006400410070007000730008000000000000F03F26D884A1EDCEA3B3EE015238530079007300740065006D00530065007400740069006E00670073005F00530074006F007200610067006500530065006E00730065005F00410070007000530069007A00650073004C006900730074005F0055006E0069006E007300740061006C006C0042007500740074006F006E00001C530065007400740069006E0067007300500061006700650052006500730074006F00720065004D00750073005500700064006100740065000881FEA28D99C1F33F26CE86C1CCE8C0B4EE01521430005F004100700070006C0069006300610062006C0065005500700064006100740065005F0030000016530065007400740069006E0067007300500061006700650057006F0072006B0041006300630065007300730008000000000000F03F2685CF90E2CFD9B3EE015230530079007300740065006D00530065007400740069006E00670073005F0057006F0072006B004100630063006500730073005F0041006400640057006F0072006B004F0072005300630068006F006F006C004100630063006F0075006E0074000000",
    "TheirsVersion": "1776827843",
    "TheirsTombstoned": "false",
    "TheirsSize": "476",
    "TheirsData": "434201000D120A0319530065007400740069006E0067007300500061006700650049006E007300740061006C006C0065006400410070007000730008000000000000F03F26D884A1EDCEA3B3EE015238530079007300740065006D00530065007400740069006E00670073005F00530074006F007200610067006500530065006E00730065005F00410070007000530069007A00650073004C006900730074005F0055006E0069006E007300740061006C006C0042007500740074006F006E00001C530065007400740069006E0067007300500061006700650052006500730074006F00720065004D00750073005500700064006100740065000881FEA28D99C1F33F26CE86C1CCE8C0B4EE01521430005F004100700070006C0069006300610062006C0065005500700064006100740065005F0030000016530065007400740069006E0067007300500061006700650057006F0072006B0041006300630065007300730008000000000000F03F2685CF90E2CFD9B3EE015230530079007300740065006D00530065007400740069006E00670073005F0057006F0072006B004100630063006500730073005F0041006400640057006F0072006B004F0072005300630068006F006F006C004100630063006F0075006E0074000000",
    "YoursVersion": "1776827926",
    "YoursTombstoned": "false",
    "YoursSize": "675",
    "YoursData": "434201000D120A0419530065007400740069006E0067007300500061006700650049006E007300740061006C006C0065006400410070007000730008000000000000F03F26D884A1EDCEA3B3EE015238530079007300740065006D00530065007400740069006E00670073005F00530074006F007200610067006500530065006E00730065005F00410070007000530069007A00650073004C006900730074005F0055006E0069006E007300740061006C006C0042007500740074006F006E00001C530065007400740069006E0067007300500061006700650052006500730074006F00720065004D00750073005500700064006100740065000881FEA28D99C1F33F26CE86C1CCE8C0B4EE01521430005F004100700070006C0069006300610062006C0065005500700064006100740065005F003000001B530065007400740069006E00670073005000610067006500570069006E0064006F007700730044006500660065006E0064006500720008000000000000F03F269E9086DAEBC0B4EE01523D530079007300740065006D00530065007400740069006E00670073005F00480061006E0064006C00650072005F00570069006E0064006F0077007300530065006300750072006900740079005F00540068007200650061007400500072006F00740065006300740069006F006E004800650061006400650072000016530065007400740069006E0067007300500061006700650057006F0072006B0041006300630065007300730008000000000000F03F2685CF90E2CFD9B3EE015230530079007300740065006D00530065007400740069006E00670073005F0057006F0072006B004100630063006500730073005F0041006400640057006F0072006B004F0072005300630068006F006F006C004100630063006F0075006E0074000000",
    "ResolvedVersion": "1776827926",
    "ResolvedTombstoned": "false",
    "ResolvedSize": "675",
    "ResolvedData": "434201000D120A0419530065007400740069006E0067007300500061006700650049006E007300740061006C006C0065006400410070007000730008000000000000F03F26D884A1EDCEA3B3EE015238530079007300740065006D00530065007400740069006E00670073005F00530074006F007200610067006500530065006E00730065005F00410070007000530069007A00650073004C006900730074005F0055006E0069006E007300740061006C006C0042007500740074006F006E00001C530065007400740069006E0067007300500061006700650052006500730074006F00720065004D00750073005500700064006100740065000881FEA28D99C1F33F26CE86C1CCE8C0B4EE01521430005F004100700070006C0069006300610062006C0065005500700064006100740065005F003000001B530065007400740069006E00670073005000610067006500570069006E0064006F007700730044006500660065006E0064006500720008000000000000F03F269E9086DAEBC0B4EE01523D530079007300740065006D00530065007400740069006E00670073005F00480061006E0064006C00650072005F00570069006E0064006F0077007300530065006300750072006900740079005F00540068007200650061007400500072006F00740065006300740069006F006E004800650061006400650072000016530065007400740069006E0067007300500061006700650057006F0072006B0041006300630065007300730008000000000000F03F2685CF90E2CFD9B3EE015230530079007300740065006D00530065007400740069006E00670073005F0057006F0072006B004100630063006500730073005F0041006400640057006F0072006B004F0072005300630068006F006F006C004100630063006F0075006E0074000000"
  },
  "message": "Conflict resolution of type Windows.Data.Settings.SettingsUsageHistory complete. See event details for more information."
}

Event ID 2005: Conflict resolution of type {QualifiedTypeName} complete.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Conflict resolution of type {QualifiedTypeName} complete. Result is version {Version} with size {Size}. See event details for more information. Extended information may be available in the Debug log.

Message #

Conflict resolution of type {QualifiedTypeName} complete. Result is version {Version} with size {Size}. See event details for more information. Extended information may be available in the Debug log.

Fields #

Name	Description
`QualifiedTypeName`
`Version`
`Size`

Event ID 2006: Conflict resolution of type {CorrelationVector} complete.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Conflict resolution of type {CorrelationVector} complete. See event details for more information.

Message #

Conflict resolution of type {CorrelationVector} complete. See event details for more information.

Fields #

Name	Description
`CorrelationVector`

Event ID 2007: Resolved a set containing duplicated values.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Resolved a set containing duplicated values. The duplicate values were ignored. See event details for more information.

Message #

Resolved a set containing duplicated values. The duplicate values were ignored. See event details for more information.

Fields #

Name	Description
`Index` UInt64

Event ID 2008: The 'original' version (OriginalVersion) of type QualifiedTypeName is more recent than the 'theirs' version (TheirsVersion) or the 'yours' version (YoursVersion).

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The 'original' version () of type is more recent than the 'theirs' version () or the 'yours' version (). Healing the store by using the most recent version (). See event details for more information.

Message #

The 'original' version (%2) of type %1 is more recent than the 'theirs' version (%3) or the 'yours' version (%4). Healing the store by using the most recent version (%5). See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString
`OriginalVersion` UInt64
`TheirsVersion` UInt64
`YoursVersion` UInt64
`ResolvedVersion` UInt64

Event ID 2009: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString
`Base64String` AnsiString

Event ID 2010: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString

Event ID 2011: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString
`Size` UInt32
`Data` Binary

Event ID 2012: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString

Event ID 2013: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString
`Base64String` AnsiString

Event ID 2014: The data of type QualifiedTypeName was corrupted and ignored.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The data of type QualifiedTypeName was corrupted and ignored. See event details for more information.

Message #

The data of type %1 was corrupted and ignored. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString

Event ID 2015: The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Message #

The AppExtension of name %1 having type %2 failed with error code %3 found.

Fields #

Name	Description
`AppExtensionName` UnicodeString
`TypeName` UnicodeString
`ErrorCode` UInt32

Event ID 2016: The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The AppExtension of name AppExtensionName having type TypeName failed with error code ErrorCode found.

Message #

The AppExtension of name %1 having type %2 failed with error code %3 found.

Fields #

Name	Description
`AppExtensionName` UnicodeString
`TypeName` UnicodeString
`ErrorCode` UInt32

Event ID 2017: Found an list item instance with a missing index value while merging vector as a map.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Found an list item instance with a missing index value while merging vector as a map. The list item was ignored. See event details for more information.

Message #

Found an list item instance with a missing index value while merging vector as a map. The list item was ignored. See event details for more information.

Fields #

Name	Description
`Index` UInt64

Event ID 2018: Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap requires an index field to be defined on the list item structure. Using MergeAsSet instead. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString

Event ID 2019: Conflict resolution policy of VectorAsMap requires index fields to be an integer or string.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Conflict resolution policy of VectorAsMap requires index fields to be an integer or string. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap requires index fields to be an integer or string. Using MergeAsSet instead. See event details for more information.

Fields #

Name	Description
`QualifiedTypeName` AnsiString

Event ID 2020: Conflict resolution policy of VectorAsMap the list items to be a structure.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Conflict resolution policy of VectorAsMap the list items to be a structure. Using MergeAsSet instead. See event details for more information.

Message #

Conflict resolution policy of VectorAsMap the list items to be a structure. Using MergeAsSet instead. See event details for more information.

Fields #

Name	Description
`BondDataType` UInt32

Event ID 3002: Sucessfully deleted Version.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Sucessfully deleted Version. See event details for more information.

Message #

Sucessfully deleted %2. See event details for more information.

Fields #

Name	Description
`Id` AnsiString
`Version` UInt64

Event ID 3003: Saving Id and merging with 'theirs' data.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

Saving Id and merging with 'theirs' data. 'Theirs' data has size Size and is version Version.

Message #

Saving %1 and merging with 'theirs' data. 'Theirs' data has size %3 and is version %2.

Fields #

Name	Description
`Id` AnsiString
`Version` UInt64
`Size` UInt64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3003,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.135294+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Id": "$de${e5ec10ba-db50-407a-b646-c86d386f4af1}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap",
    "Version": 134179047067427004,
    "Size": 1261
  },
  "message": ""
}

Event ID 3004: Saving Id without 'theirs' data.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Saving Id without 'theirs' data.

Message #

Saving %1 without 'theirs' data.

Fields #

Name	Description
`Id` AnsiString

Event ID 3005: Overwriting Id with 'yours' data to repair inaccessible store (access failed with error code ErrorCode).

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Overwriting Id with 'yours' data to repair inaccessible store (access failed with error code ErrorCode).

Message #

Overwriting %1 with 'yours' data to repair inaccessible store (access failed with error code %2).

Fields #

Name	Description
`Id` AnsiString
`ErrorCode` UInt32

Event ID 3006: Uploading Id failed with error code ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Uploading Id failed with error code ErrorCode. The data was sucessfully stored locally and will be uploaded later.

Message #

Uploading %1 failed with error code %2. The data was sucessfully stored locally and will be uploaded later.

Fields #

Name	Description
`Id` AnsiString
`ErrorCode` UInt32

Event ID 3007: Successfully loaded CorrelationVector.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

Successfully loaded CorrelationVector. See event details for more information.

Message #

Successfully loaded %2. See event details for more information.

Fields #

Name	Description
`CorrelationVector` AnsiString
`Id` AnsiString
`Version` UInt64
`Size` UInt32
`Data` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3007,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.134672+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "434201000D10120104267B00450035004500430031003000420041002D0044004200350030002D0034003000370041002D0042003600340036002D004300380036004400330038003600460034004100460031007D0000",
    "CorrelationVector": "",
    "Id": "$$windows.data.platform.partitioning.activepartitions",
    "Version": 134151755085939223,
    "Size": 87
  },
  "message": ""
}

Event ID 3008: Successfully saved CorrelationVector.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

Successfully saved CorrelationVector. See event details for more information.

Message #

Successfully saved %2. See event details for more information.

Fields #

Name	Description
`CorrelationVector` AnsiString
`Id` AnsiString
`Version` UInt64
`Size` UInt32
`Data` Binary

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3008,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T19:59:29.136026+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 2812,
      "thread_id": 6540
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "Data_0": "434201000D120A0A1D50007E0043004C0041005500440045005F0050005A00530038005300580052004A00580046004A004A004300210043004C004100550044004500C70A5E97033DC51401C61E909780EBECE1ACEE01005550007E00570049004E0044004F00570053002E0049004D004D0045005200530049005600450043004F004E00540052004F004C00500041004E0045004C005F004300570035004E0031004800320054005800590045005700590021004D004900430052004F0053004F00460054002E00570049004E0044004F00570053002E0049004D004D0045005200530049005600450043004F004E00540052004F004C00500041004E0045004C00C70AC3780E3CC51401C61EF091F49ADCE3ACEE01001C57007E004D004900430052004F0053004F00460054002E00570049004E0044004F00570053002E004500580050004C004F00520045005200C70A92A59A3DC51409C61EA0B0DAA7F0E3ACEE01000857007E004D0053004500440047004500C70ADBFAA63CC51405C61E909EF2BBA2E2ACEE01003057007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0043004D0044002E00450058004500C70A669E913DC5140BC61EC0FDFDA59EE4ACEE01003457007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C004D0053005000410049004E0054002E00450058004500C70AF735CE3BC61E8A9F8FF1F3C9A6EE01003457007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C004E004F00540045005000410044002E00450058004500C70A5FC48F3CC51403C61ED090BFD4FCF8A6EE01003957007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0053004E0049005000500049004E00470054004F004F004C002E00450058004500C70A386F343DC61E8A9F8FF1F3C9A6EE01004E57007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C00570049004E0044004F005700530050004F005700450052005300480045004C004C005C00560031002E0030005C0050004F005700450052005300480045004C004C002E00450058004500C70A19F7053CC51402C61EE0BCD6F5ADE2ACEE01005257007E007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C00570049004E0044004F005700530050004F005700450052005300480045004C004C005C00560031002E0030005C0050004F005700450052005300480045004C004C005F004900530045002E00450058004500C70A37E32F3DC51403C61EE0BB82CF9EE2ACEE010000",
    "CorrelationVector": "",
    "Id": "$de${e5ec10ba-db50-407a-b646-c86d386f4af1}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap",
    "Version": 134179055691341358,
    "Size": 1261
  },
  "message": ""
}

Event ID 3010: Successfully saved cloud data for {Id}.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Successfully saved cloud data for {Id}. See event details for more information.

Message #

Successfully saved cloud data for {Id}. See event details for more information.

Fields #

Name	Description
`Id`

Event ID 3012: Successfully saved merged cloud data for {Id}.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Successfully saved merged cloud data for {Id}. See event details for more information.

Message #

Successfully saved merged cloud data for {Id}. See event details for more information.

Fields #

Name	Description
`Id`

Event ID 3013: Downloading Id failed with error code ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Operational
Level: Warning

Description

Downloading Id failed with error code ErrorCode.

Message #

Downloading %1 failed with error code %2.

Fields #

Name	Description
`Id` AnsiString
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3013,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-06T01:48:34.113221+00:00",
    "event_record_id": 57,
    "correlation": {
      "ActivityID": "E4DB489E-1037-0000-DAED-EDE43710DA01"
    },
    "execution": {
      "process_id": 16236,
      "thread_id": 22096
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Id": "default$windows.data.settings.settingsusagehistory|windows.data.settings.settingsusagehistory",
    "ErrorCode": 2147746053
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3014: Delete of Id was ignored because the data changed after it was deleted.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

Delete of Id was ignored because the data changed after it was deleted. See event details for more information.

Message #

Delete of %1 was ignored because the data changed after it was deleted. See event details for more information.

Fields #

Name	Description
`Id` AnsiString
`TheirsVersion` UInt64
`YoursVersion` UInt64

Event ID 3015: The attempt to load CorrelationVector failed because the data was corrupt.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The attempt to load CorrelationVector failed because the data was corrupt. See event details for more information.

Message #

The attempt to load %1 failed because the data was corrupt. See event details for more information.

Fields #

Name	Description
`CorrelationVector` AnsiString
`Id` AnsiString
`Version` UInt64
`Size` UInt32
`Data` Binary

Event ID 3016: The value {Id} was garbage collected from the local cache because it was not reachable.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

The value {Id} was garbage collected from the local cache because it was not reachable.

Message #

The value {Id} was garbage collected from the local cache because it was not reachable.

Fields #

Name	Description
`Id`

Event ID 3017: The object ObjectName has an unexpected security descriptor.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

The object ObjectName has an unexpected security descriptor. Recovering by resetting the security descriptor. See event details for more information.

Message #

The object %1 has an unexpected security descriptor. Recovering by resetting the security descriptor. See event details for more information.

Fields #

Name	Description
`ObjectName` UnicodeString
`CurrentAcl` UnicodeString
`ExpectedAcl` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3017,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:06:36.816855+00:00",
    "event_record_id": 25,
    "correlation": {},
    "execution": {
      "process_id": 1944,
      "thread_id": 8164
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236"
    }
  },
  "event_data": {
    "ObjectName": "CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CloudStore",
    "CurrentAcl": "D:(A;CI;KA;;;S-1-15-3-1024-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126)(A;OICIID;KA;;;S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;BA)(A;OICIID;KR;;;RC)",
    "ExpectedAcl": "D:AI(A;CI;KA;;;S-1-15-3-1024-3035980445-2343077072-2039973919-2593655016-2336600711-3402322490-2613491542-1611519126)(A;OICIID;KA;;;S-1-5-82-3876422241-1344743610-1729199087-774402673-2621913236)(A;OICIID;KA;;;SY)(A;OICIID;KA;;;BA)(A;OICIID;KR;;;RC)"
  },
  "message": ""
}

Event ID 3018: The cache invalidator has started.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

The cache invalidator has started.

Message #

The cache invalidator has started.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3018,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:07:56.365500+00:00",
    "event_record_id": 73,
    "correlation": {},
    "execution": {
      "process_id": 8768,
      "thread_id": 9872
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 3019: The cache invalidator has stopped.

Provider: Microsoft-Windows-CloudStore
Channel: Debug
Level: Informational

Description

The cache invalidator has stopped.

Message #

The cache invalidator has stopped.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3019,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-13T20:04:05.525095+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 6852,
      "thread_id": 7628
    },
    "channel": "Microsoft-Windows-CloudStore/Debug",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 3020: The cache invalidator is processing ActivitiesCount activities.

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Description

The cache invalidator is processing ActivitiesCount activities.

Message #

The cache invalidator is processing %2 activities.

Fields #

Name	Description
`CorrelationVector` AnsiString
`ActivitiesCount` UInt16

Event ID 3021: The Backup master policy is set.

Provider: Microsoft-Windows-CloudStore
Channel: Operational
Level: Informational

Description

The Backup master policy is set.

Message #

The Backup master policy is set.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 3021,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:29:02.865478+00:00",
    "event_record_id": 17,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3022: Backup policy name Id set failed with error code ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Backup policy name Id set failed with error code ErrorCode.

Message #

Backup policy name %1 set failed with error code %2.

Fields #

Name	Description
`Id` AnsiString
`ErrorCode` UInt32

Event ID 3023: The transport layer reported a failure: Id with error code ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Operational
Level: Informational

Description

The transport layer reported a failure: Id with error code ErrorCode.

Message #

The transport layer reported a failure: %1 with error code %2.

Fields #

Name	Description
`Id` AnsiString
`ErrorCode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "{741BB90C-A7A3-49D6-BD82-1E6B858403F7}",
    "event_source_name": "",
    "event_id": 3023,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": -9223372036854775808,
    "time_created": "2026-04-22T03:18:46.7774222+00:00",
    "event_record_id": 1348,
    "correlation": {
      "ActivityID": "{5D13569F-CEA5-000B-F88B-145DA5CEDC01}"
    },
    "execution": {
      "process_id": 2560,
      "thread_id": 10028
    },
    "channel": "Microsoft-Windows-CloudStore/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1104"
    }
  },
  "event_data": {
    "Id": "Transport Layer is not accessible",
    "ErrorCode": "2147746132"
  },
  "message": "The transport layer reported a failure: Transport Layer is not accessible with error code 0x80040154."
}

Event ID 3032: Error TranslatedErrorCode occurred trying to perform file copy operation for schema Type.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Error TranslatedErrorCode occurred trying to perform file copy operation for schema Type. See event details for more information.

Message #

Error %2 occurred trying to perform file copy operation for schema %1. See event details for more information.

Fields #

Name	Description
`Type` AnsiString
`TranslatedErrorCode` Int32
`Stage` UInt32
`Path` UnicodeString

Event ID 3033: Error TranslatedErrorCode occurred trying to retrive the device profile during an operation on a backup/restore schema.

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Description

Error TranslatedErrorCode occurred trying to retrive the device profile during an operation on a backup/restore schema. See event details for more information.

Message #

Error %1 occurred trying to retrive the device profile during an operation on a backup/restore schema. See event details for more information.

Fields #

Name	Description
`TranslatedErrorCode` Int32
`IsProfileUpdate` Boolean
`ProfileCollection` AnsiString
`ProfileInstance` AnsiString
`SchemaCollection` AnsiString
`Cv` AnsiString

Event ID 4000: Attempting to save device profile BackupProfileId.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization
Level: Informational

Description

Attempting to save device profile BackupProfileId. See event details for more information.

Message #

Attempting to save device profile %1. See event details for more information.

Fields #

Name	Description
`BackupProfileId` AnsiString
`ProcessName` UnicodeString
`IsDelete` Boolean
`Cv` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 4000,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:29:03.009433+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Initialization",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "BackupProfileId": "{8dcb8207-c294-40da-82e0-ce8f415acdb8}",
    "ProcessName": "taskhostw.exe",
    "IsDelete": false,
    "Cv": "/FVp6ocjxkiUITaIBQcllQ.0.1.2"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4001: Error saving internal type TypeName: StatusCode.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Error saving internal type TypeName: StatusCode. See event details for more information.

Message #

Error saving internal type %1: %2. See event details for more information.

Fields #

Name	Description
`TypeName` AnsiString
`StatusCode` Int32	NTSTATUS reference
`Cv` AnsiString

Event ID 4002: Successfully setup Cloud Store backup/restore partition information.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization
Level: Informational

Description

Successfully setup Cloud Store backup/restore partition information. See event details for more information.

Message #

Successfully setup Cloud Store backup/restore partition information. See event details for more information.

Fields #

Name	Description
`BackupProfileId` UnicodeString
`RestoreProfileId` UnicodeString
`DeviceDisplayName` UnicodeString
`Cv` AnsiString
`TypeName` AnsiString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "event_id": 4002,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:59:10.6802443+00:00",
    "computer": "DESKTOP-FF3N5XK",
    "channel": "Microsoft-Windows-CloudStore"
  },
  "event_data": {
    "Cv": "NmABboFC0eJKuI0kb2s0sN.0.0.0.1.2",
    "DeviceDisplayName": "",
    "BackupProfileId": "",
    "RestoreProfileId": "",
    "TypeName": "Windows.Data.Platform.BackupRestore.DeviceProfile"
  }
}

Event ID 4003: Failed to setup Cloud Store backup/restore partition information at stage Stage with error StatusCode.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Failed to setup Cloud Store backup/restore partition information at stage Stage with error StatusCode. See event details for more information.

Message #

Failed to setup Cloud Store backup/restore partition information at stage %2 with error %1. See event details for more information.

Fields #

Name	Description
`StatusCode` Int32	NTSTATUS reference
`Stage` Int32
`Cv` AnsiString
`TypeName` AnsiString

Event ID 4004: Timed out after mirroring UpdateCount settings sync policies in Elapsed milliseconds.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Timed out after mirroring UpdateCount settings sync policies in Elapsed milliseconds. See event details for more information.

Message #

Timed out after mirroring %2 settings sync policies in %1 milliseconds. See event details for more information.

Fields #

Name	Description
`Elapsed` UInt64
`UpdateCount` UInt32
`LastSource` UnicodeString
`LastTarget` UnicodeString

Event ID 4005: Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization
Level: Informational

Description

Completed mirroring UpdateCount settings sync policies in Elapsed milliseconds.

Message #

Completed mirroring %2 settings sync policies in %1 milliseconds.

Fields #

Name	Description
`Elapsed` UInt64
`UpdateCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "741BB90C-A7A3-49D6-BD82-1E6B858403F7",
    "event_source_name": "",
    "event_id": 4005,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2023-11-05T22:29:03.084800+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 5784,
      "thread_id": 6016
    },
    "channel": "Microsoft-Windows-CloudStore/Initialization",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
    }
  },
  "event_data": {
    "Elapsed": 62,
    "UpdateCount": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4006: Set policy Target to Enabled.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization
Level: Informational

Description

Set policy Target to Enabled.

Message #

Set policy %1 to %2.

Fields #

Name	Description
`Target` UnicodeString
`Enabled` Boolean
`Forced` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "event_id": 4006,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:30:48.5219514+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-CloudStore"
  },
  "event_data": {
    "Forced": "false",
    "Target": "MicrosoftDevice",
    "Enabled": "false"
  }
}

Event ID 4007: Failed to set policy Target to Enabled: ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization
Level: Warning

Description

Failed to set policy Target to Enabled: ErrorCode.

Message #

Failed to set policy %1 to %2: %4.

Fields #

Name	Description
`Target` UnicodeString
`Enabled` Boolean
`Forced` Boolean
`ErrorCode` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-CloudStore",
    "guid": "{741BB90C-A7A3-49D6-BD82-1E6B858403F7}",
    "event_source_name": "",
    "event_id": 4007,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-26T03:33:57.8095329+00:00",
    "event_record_id": 28,
    "correlation": {
      "ActivityID": "{D0BE9A23-BB1B-0003-2D97-C0D01BBBDC01}"
    },
    "execution": {
      "process_id": 9244,
      "thread_id": 9612
    },
    "channel": "Microsoft-Windows-CloudStore/Initialization",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-3407486967-1585450050-1838039599-1000"
    }
  },
  "event_data": {
    "Target": "MicrosoftDevice",
    "Enabled": "false",
    "Forced": "true",
    "ErrorCode": "-2147221164"
  },
  "message": "Failed to set policy MicrosoftDevice to false: Class not registered."
}

Event ID 4008: Restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId.

Message #

Restore data successfully copied from restore partition %1 to backup partition %2

Fields #

Name	Description
`RestorePartitionId` UnicodeString
`BackupPartitionId` UnicodeString

Event ID 4009: Failed to copy restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId: ErrorCode.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Failed to copy restore data successfully copied from restore partition RestorePartitionId to backup partition BackupPartitionId: ErrorCode.

Message #

Failed to copy restore data successfully copied from restore partition %1 to backup partition %2: %3

Fields #

Name	Description
`RestorePartitionId` UnicodeString
`BackupPartitionId` UnicodeString
`ErrorCode` Int32

Event ID 4010: Copied single restore partition data item from Path to backup partition as Id.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Copied single restore partition data item from Path to backup partition as Id.

Message #

Copied single restore partition data item from %1 to backup partition as %2

Fields #

Name	Description
`Path` UnicodeString
`Id` AnsiString

Event ID 4011: Skipped copying single restore partition at Path to backup partition as Id as it already exists.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Skipped copying single restore partition at Path to backup partition as Id as it already exists.

Message #

Skipped copying single restore partition at %1 to backup partition as %2 as it already exists

Fields #

Name	Description
`Path` UnicodeString
`Id` AnsiString

Event ID 4012: Error processing type TypeName.

Provider: Microsoft-Windows-CloudStore
Channel: Initialization

Description

Error processing type TypeName.

Message #

Error processing type %1

Fields #

Name	Description
`TypeName` AnsiString
`ErrorCode` Int32
`Stage` Int32

Event ID 10000: task_010000

Provider: Microsoft-Windows-CloudStore
Channel: Operational

Event ID 10001: task_010001

Provider: Microsoft-Windows-CloudStore
Channel: Debug

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 741bb90c-a7a3-49d6-bd82-1e6b858403f7

Defined in Windows.CloudStore.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3323, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)