Microsoft-Windows-Deployment-Services-Diagnostics

Event	Title	Channel	Sample	Rule
4096	The following client booted from PXE.	Operational	N	N
4099	The Following Client started TFTP Download.	Operational	N	N
4100	The Following Client completed TFTP Download.	Operational	N	N
4101	The Following Client failed TFTP Download.	Admin	N	N
4101	Event ID 4101	Operational	N	N
4102	The following WDS Client has started.	Operational	N	N
4103	The following WDS Client has processed unattend mode.	Operational	N	N
4104	The following WDS Client has selected Image.	Operational	N	N
4105	The following WDS Client has started Image Transfer.	Operational	N	N
4106	The following WDS Client has ended Image Transfer.	Operational	N	N
4107	The following WDS Client has downgraded Image Transfer.	Operational	N	N
4108	The following WDS Client has started Image Apply.	Operational	N	N
4109	The following WDS Client has ended Image Apply.	Operational	N	N
4110	The following WDS Client has started Post Apply Actions.	Operational	N	N
4111	The following WDS Client has ended Post Apply Actions.	Operational	N	N
4112	The following WDS Client has ended.	Operational	N	N
4113	The following WDS Client has encountered Domain Join Error.	Admin	N	N
4113	Event ID 4113	Operational	N	N
4114	The following WDS Client has encountered Fatal Error.	Admin	N	N
4114	Event ID 4114	Operational	N	N
4115	The following WDS Client has this message.	Operational	N	N
4116	Namespace Registered.	Operational	N	N
4117	Namespace Unregistered.	Operational	N	N
4118	Multicast Session Started.	Operational	N	N
4119	Multicast Session Ended.	Operational	N	N
4120	Client joined Multicast Session.	Operational	N	N
4121	Client exited Multicast Session.	Operational	N	N
4122	Client forced out of Multicast Session.	Operational	N	N
4123	The following WDS Client has encountered an inaccessible driver package.	Operational	N	N
4124	The following WDS Client has started offline driver injection.	Operational	N	N
4125	The following WDS Client has ended offline driver injection.	Operational	N	N
4126	The following WDS Client has encountered a failure while performing offline …	Operational	N	N
4127	Ddp request received for the following client.	Operational	N	N
4128	Ddp request failed for the following client.	Operational	N	N
4129	Ddp request successfully completed for the following client.	Operational	N	N
4130	Client demoted to slower Multicast Session.	Operational	N	N
4131	The following WDS Client has selected Image.	Operational	N	N
4132	The following client attempted to boot from PXE but was ignored because it is …	Operational	N	N
16384	Event ID 16384	Operational	N	N
16384	[.	Verbose	N	N
16385	[.	Debug	N	N
16385	Event ID 16385	Operational	N	N
16386	[.	Debug	N	N
16386	Event ID 16386	Operational	N	N
16387	[.	Debug	N	N
16387	Event ID 16387	Operational	N	N
16388	[.	Debug	N	N
16388	Event ID 16388	Operational	N	N
16389	Event ID 16389	Operational	N	N
16389	[.	Verbose	N	N
16390	Event ID 16390	Operational	N	N
16390	[.	Packet	N	N
24576	Event ID 24576	Operational	N	N
24576	[.	Verbose	Y	N
24577	[.	Debug	N	N
24577	Event ID 24577	Operational	N	N
24578	[.	Debug	N	N
24578	Event ID 24578	Operational	N	N
24579	[.	Debug	N	N
24579	Event ID 24579	Operational	N	N
24580	[.	Debug	N	N
24580	Event ID 24580	Operational	N	N
24581	Event ID 24581	Operational	N	N
24581	[.	Verbose	N	N
24582	Event ID 24582	Operational	N	N
24582	[.	Packet	N	N
32768	Event ID 32768	Operational	N	N
32768	[.	Verbose	N	N
32769	[.	Debug	N	N
32769	Event ID 32769	Operational	N	N
32770	[.	Debug	N	N
32770	Event ID 32770	Operational	N	N
32771	[.	Debug	N	N
32771	Event ID 32771	Operational	N	N
32772	[.	Debug	N	N
32772	Event ID 32772	Operational	N	N
32773	Event ID 32773	Operational	N	N
32773	[.	Verbose	N	N
32774	Event ID 32774	Operational	N	N
32774	[.	Packet	N	N
36864	A device query was successfully processed (status StatusCode).	Metadata	N	N
36864	Event ID 36864	Operational	N	N
36865	A device query failed with status StatusCode.	Metadata	N	N
36865	Event ID 36865	Operational	N	N
36866	Provider [ProviderName] processed a device query with status StatusCode, …	Metadata	N	N
36866	Event ID 36866	Operational	N	N
36867	Provider [ProviderName] failed to process a device query with status StatusCode, …	Metadata	N	N
36867	Event ID 36867	Operational	N	N
40960	Provider [ProviderName] successfully added a device with status StatusCode.	Metadata	N	N
40960	Event ID 40960	Operational	N	N
40962	Provider [ProviderName] failed to add a device with status StatusCode.	Metadata	N	N
40962	Event ID 40962	Operational	N	N
40963	Provider [ProviderName] successfully deleted device [DeviceIdentifier]; status …	Metadata	N	N
40963	Event ID 40963	Operational	N	N
40964	Provider [ProviderName] failed to delete device [DeviceIdentifier]; status code …	Metadata	N	N
40964	Event ID 40964	Operational	N	N
40965	Provider [ProviderName] successfully modified a device with status code …	Metadata	N	N
40965	Event ID 40965	Operational	N	N
40966	Provider [ProviderName] failed to modify a device with status code StatusCode.	Metadata	N	N
40966	Event ID 40966	Operational	N	N
40967	Provider [ProviderName] successfully retrieved metadata for a device with status …	Metadata	N	N
40967	Event ID 40967	Operational	N	N
40968	Provider [ProviderName] failed to retrieve metadata for a device with status …	Metadata	N	N
40968	Event ID 40968	Operational	N	N
40969	The server successfully processed a request for available providers with status …	Metadata	N	N
40969	Event ID 40969	Operational	N	N
40970	The server failed to process a request for available providers with status code …	Metadata	N	N
40970	Event ID 40970	Operational	N	N
45056	The server processed a metadata match request.	Metadata	N	N
45056	Event ID 45056	Operational	N	N
45057	There was an attempt to overwrite an object's metadata which failed because the …	Metadata	N	N
45057	Event ID 45057	Operational	N	N
49152	The server successfully retrieved metadata for an object with status code …	Metadata	N	N
49152	Event ID 49152	Operational	N	N
49153	The server failed to retrieve metadata for an object with status code …	Metadata	N	N
49153	Event ID 49153	Operational	N	N
49154	The server successfully modified metadata for an object with status code …	Metadata	N	N
49154	Event ID 49154	Operational	N	N
49155	The server failed to modify metadata for an object with status code StatusCode.	Metadata	N	N
49155	Event ID 49155	Operational	N	N
49158	A new metadata object was successfully registered in the server with status code …	Metadata	N	N
49158	Event ID 49158	Operational	N	N
49159	The server failed to register a new metadata object with status code StatusCode.	Metadata	N	N
49159	Event ID 49159	Operational	N	N
49162	An object was successfully deleted with status code StatusCode.	Metadata	N	N
49162	Event ID 49162	Operational	N	N
49163	The server failed to delete an object with status code StatusCode.	Metadata	N	N
49163	Event ID 49163	Operational	N	N
49164	An object's parenting relationship was successfully modified with status code …	Metadata	N	N
49164	Event ID 49164	Operational	N	N
49165	The server failed to modify an object's parenting relationship with status code …	Metadata	N	N
49165	Event ID 49165	Operational	N	N
53248	WdsUtil.	Operational	N	N
53249	A WdsUtil.	Operational	N	N
53250	A WdsUtil.	Operational	N	N
57344	The following VHDX apply has started.	Operational	N	N
57345	The following VHDX apply has completed.	Operational	N	N
57346	The following VHDX apply has failed.	Operational	N	N
57347	The PXE server processed a request from a client of architecture Architecture.	Admin	N	N
57347	Event ID 57347	Operational	N	N
57348	A BufferType buffer was created for reading file FilePath.	Operational	N	N
57349	A BufferType buffer created for reading file FilePath was deleted.	Operational	N	N
57350	An endpoint was opened by provider Provider.	Operational	N	N
57351	An endpoint was closed by provider Provider.	Operational	N	N
57352	WdsCim was invoked with the following command line.	Operational	N	N
57353	A WdsCim method was successfully executed.	Operational	N	N
57354	A WdsCim method failed.	Operational	N	N

Event ID 4096: The following client booted from PXE.

Channel: Operational

Message #

The following client booted from PXE: 

Hardware Address: %1
IP: %2
Device ID: %3
ClientArchitecture: %4
Prestaged: %5

Fields #

Name	Description
`ClientHardwareAddress` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientPrestaged` Boolean

Event ID 4099: The Following Client started TFTP Download.

Channel: Operational
Task: TFTP_Download
Opcode: Start

Message #

The Following Client started TFTP Download: 

Client IP: %1
Filename: %2
File Size: %3
Client Port: %4
Server Port: %5
Variable Window: %6

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4100: The Following Client completed TFTP Download.

Channel: Operational
Task: TFTP_Download
Opcode: Stop

Message #

The Following Client completed TFTP Download: 

Client IP: %1
Filename: %2
File Size: %3
Client Port: %4
Server Port: %5
Variable Window: %6

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4101: The Following Client failed TFTP Download.

Channel: Admin

Message #

The Following Client failed TFTP Download: 

Client IP: %1
Filename: %2
ErrorCode: %3
File Size: %4
Client Port: %5
Server Port: %6
Variable Window: %7

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4101

Channel: Operational

Description

The Following Client failed TFTP Download.

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4102: The following WDS Client has started.

Channel: Operational
Task: WDSClient_Session
Opcode: Start

Message #

The following WDS Client has started: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ClientVer: %6
WinPEVer: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientVersion` UnicodeString
`WinPEVersion` UnicodeString

Event ID 4103: The following WDS Client has processed unattend mode.

Channel: Operational

Message #

The following WDS Client has processed unattend mode: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
UnattendMode: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`UnattendMode` Boolean

Event ID 4104: The following WDS Client has selected Image.

Channel: Operational

Message #

The following WDS Client has selected Image: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
FullUserName: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`FullUserName` UnicodeString

Event ID 4105: The following WDS Client has started Image Transfer.

Channel: Operational
Task: WDSClient_ImageTransfer
Opcode: Start

Message #

The following WDS Client has started Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4106: The following WDS Client has ended Image Transfer.

Channel: Operational
Task: WDSClient_ImageTransfer
Opcode: Stop

Message #

The following WDS Client has ended Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4107: The following WDS Client has downgraded Image Transfer.

Channel: Operational

Message #

The following WDS Client has downgraded Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4108: The following WDS Client has started Image Apply.

Channel: Operational
Task: WDSClient_ImageApply
Opcode: Start

Message #

The following WDS Client has started Image Apply: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString

Event ID 4109: The following WDS Client has ended Image Apply.

Channel: Operational
Task: WDSClient_ImageApply
Opcode: Stop

Message #

The following WDS Client has ended Image Apply: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

ImageGroup: %6
ImageName: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString

Event ID 4110: The following WDS Client has started Post Apply Actions.

Channel: Operational
Task: WDSClient_PostApplyActions
Opcode: Start

Message #

The following WDS Client has started Post Apply Actions: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4111: The following WDS Client has ended Post Apply Actions.

Channel: Operational
Task: WDSClient_PostApplyActions
Opcode: Stop

Message #

The following WDS Client has ended Post Apply Actions: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4112: The following WDS Client has ended.

Channel: Operational
Task: WDSClient_Session
Opcode: Stop

Message #

The following WDS Client has ended: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4113: The following WDS Client has encountered Domain Join Error.

Channel: Admin

Message #

The following WDS Client has encountered Domain Join Error: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
MachineName: %6
MachineOU: %7
ErrorCode: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`MachineName` UnicodeString
`MachineOU` UnicodeString
`ErrorCode` HexInt32

Event ID 4113

Channel: Operational

Description

The following WDS Client has encountered Domain Join Error.

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`MachineName` UnicodeString
`MachineOU` UnicodeString
`ErrorCode` HexInt32

Event ID 4114: The following WDS Client has encountered Fatal Error.

Channel: Admin

Message #

The following WDS Client has encountered Fatal Error: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ErrorMessage: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ErrorMessage` UnicodeString

Event ID 4114

Channel: Operational

Description

The following WDS Client has encountered Fatal Error.

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ErrorMessage` UnicodeString

Event ID 4115: The following WDS Client has this message.

Channel: Operational

Message #

The following WDS Client has this message: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
Message: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`Message` UnicodeString

Event ID 4116: Namespace Registered.

Channel: Operational

Message #

Namespace Registered: 

NamespaceName: %1
ContentProvider: %2
NamespaceType: %3

Fields #

Name	Description
`NamespaceName` UnicodeString
`ContenProvider` UnicodeString
`MulticastType` UInt32

Event ID 4117: Namespace Unregistered.

Channel: Operational

Message #

Namespace Unregistered: 

NamespaceName: %1
ContentProvider: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ContenProvider` UnicodeString

Event ID 4118: Multicast Session Started.

Channel: Operational
Task: Multicast_Session
Opcode: Start

Message #

Multicast Session Started: 

NamespaceName: %1
ObjectName: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4119: Multicast Session Ended.

Channel: Operational
Task: Multicast_Session
Opcode: Stop

Message #

Multicast Session Ended: 

NamespaceName: %1
ObjectName: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4120: Client joined Multicast Session.

Channel: Operational
Task: Multicast_ClientSession
Opcode: Start

Message #

Client joined Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4121: Client exited Multicast Session.

Channel: Operational
Task: Multicast_ClientSession
Opcode: Stop

Message #

Client exited Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4122: Client forced out of Multicast Session.

Channel: Operational

Message #

Client forced out of Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4
Reason: %5

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString
`Reason` UInt32

Event ID 4123: The following WDS Client has encountered an inaccessible driver package.

Channel: Operational

Message #

The following WDS Client has encountered an inaccessible driver package: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
DriverPackage: %6
ErrorCode: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`DriverPackageName` UnicodeString
`ErrorCode` UInt32

Event ID 4124: The following WDS Client has started offline driver injection.

Channel: Operational
Task: WDSClient_OfflineDriverInjection
Opcode: Start

Message #

The following WDS Client has started offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4125: The following WDS Client has ended offline driver injection.

Channel: Operational
Task: WDSClient_OfflineDriverInjection
Opcode: Stop

Message #

The following WDS Client has ended offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4126: The following WDS Client has encountered a failure while performing offline driver injection.

Channel: Operational

Message #

The following WDS Client has encountered a failure while performing offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
DriverPackage: %6
ErrorCode: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`DriverPackageName` UnicodeString
`ErrorCode` UInt32

Event ID 4127: Ddp request received for the following client.

Channel: Operational
Task: Ddp_Request
Opcode: Start

Message #

Ddp request received for the following client: 

MAC: %1
IP: %2

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString

Event ID 4128: Ddp request failed for the following client.

Channel: Operational

Message #

Ddp request failed for the following client: 

MAC: %1
IP: %2
ErrorCode: %3

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ErrorCode` UInt32

Event ID 4129: Ddp request successfully completed for the following client.

Channel: Operational
Task: Ddp_Request
Opcode: Stop

Message #

Ddp request successfully completed for the following client: 

MAC: %1
IP: %2
NumDriverPackages: %3

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NumDriverPackages` UInt32

Event ID 4130: Client demoted to slower Multicast Session.

Channel: Operational

Message #

Client demoted to slower Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4131: The following WDS Client has selected Image.

Channel: Operational

Message #

The following WDS Client has selected Image: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
ImageLanguage: %8
ImageArchitecture: %10
FullUserName: %9

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`ImageLanguage` UnicodeString
`FullUserName` UnicodeString
`ImageArch` UInt32

Event ID 4132: The following client attempted to boot from PXE but was ignored because it is not recognized.

Channel: Operational

Message #

The following client attempted to boot from PXE but was ignored because it is not recognized: 

Hardware Address: %1
IP: %2
Device ID: %3
ClientArchitecture: %4
Prestaged: %5

Fields #

Name	Description
`ClientHardwareAddress` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientPrestaged` Boolean

Event ID 16384

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16384: [.

Channel: Verbose

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16385: [.

Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16385

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16386: [.

Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16386

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16387: [.

Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16387

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16388: [.

Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16388

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16389

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16389: [.

Channel: Verbose

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16390

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16390: [.

Channel: Packet

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24576

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24576: [.

Channel: Verbose
Level: Verbose

Message #

[%1/%2] %4

Fields #

Name	Description
`WDSProviderTraceEvent.Component` UnicodeString
`WDSProviderTraceEvent.Provider` UnicodeString
`WDSProviderTraceEvent.Severity` UInt32
`WDSProviderTraceEvent.Message` UnicodeString
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Deployment-Services-Diagnostics",
    "guid": "{22B7D623-566B-47B6-9BA0-BC9DA3C9D646}",
    "event_source_name": "",
    "event_id": 24576,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213694016,
    "time_created": "2026-06-13T14:23:44.0396634+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 6148,
      "thread_id": 3204
    },
    "channel": "Microsoft-Windows-Deployment-Services-Diagnostics/Verbose",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "WDSProviderTraceEvent": {
      "Component": "WDSServer",
      "Provider": "WDSMC",
      "Severity": "65536",
      "Message": "<- CContentProvidersHandler::Shutdown=0"
    }
  },
  "message": "[WDSServer/WDSMC] <- CContentProvidersHandler::Shutdown=0"
}

Event ID 24577: [.

Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24577

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24578: [.

Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24578

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24579: [.

Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24579

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24580: [.

Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24580

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24581

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24581: [.

Channel: Verbose

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24582

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24582: [.

Channel: Packet

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32768

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32768: [.

Channel: Verbose

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32769: [.

Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32769

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32770: [.

Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32770

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32771: [.

Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32771

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32772: [.

Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32772

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32773

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32773: [.

Channel: Verbose

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32774

Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32774: [.

Channel: Packet

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 36864: A device query was successfully processed (status StatusCode).

Channel: Metadata

Message #

A device query was successfully processed (status %3):

Input:
%1

Output:
%2

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36864

Channel: Operational

Description

A device query was successfully processed (status ).

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36865: A device query failed with status StatusCode.

Channel: Metadata

Message #

A device query failed with status %3:

Input:
%1

Output:
%2

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36865

Channel: Operational

Description

A device query failed with status.

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36866: Provider [ProviderName] processed a device query with status StatusCode, response type ResponseType.

Channel: Metadata

Message #

Provider [%1] processed a device query with status %5, response type %4:

Input:
%2

Output:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36866

Channel: Operational

Description

Provider [] processed a device query with status , response type.

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36867: Provider [ProviderName] failed to process a device query with status StatusCode, response type ResponseType.

Channel: Metadata

Message #

Provider [%1] failed to process a device query with status %5, response type %4:

Input:
%2

Output:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36867

Channel: Operational

Description

Provider [] failed to process a device query with status , response type.

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40960: Provider [ProviderName] successfully added a device with status StatusCode.

Channel: Metadata

Message #

Provider [%1] successfully added a device with status %5:

Device Name: %2

Initial Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40960

Channel: Operational

Description

Provider [] successfully added a device with status.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40962: Provider [ProviderName] failed to add a device with status StatusCode.

Channel: Metadata

Message #

Provider [%1] failed to add a device with status %5:

Device Name: %2

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40962

Channel: Operational

Description

Provider [] failed to add a device with status.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40963: Provider [ProviderName] successfully deleted device [DeviceIdentifier]; status code StatusCode.

Channel: Metadata

Message #

Provider [%1] successfully deleted device [%2]; status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40963

Channel: Operational

Description

Provider [] successfully deleted device []; status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40964: Provider [ProviderName] failed to delete device [DeviceIdentifier]; status code StatusCode.

Channel: Metadata

Message #

Provider [%1] failed to delete device [%2]; status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40964

Channel: Operational

Description

Provider [] failed to delete device []; status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40965: Provider [ProviderName] successfully modified a device with status code StatusCode.

Channel: Metadata

Message #

Provider [%1] successfully modified a device with status code %5:

Device Name: %2

New Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40965

Channel: Operational

Description

Provider [] successfully modified a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40966: Provider [ProviderName] failed to modify a device with status code StatusCode.

Channel: Metadata

Message #

Provider [%1] failed to modify a device with status code %5:

Device Name: %2

New Metadata:
%3

Note that the device may or may not be modified with the New Metadata; this is at the discretion of the Provider.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40966

Channel: Operational

Description

Provider [] failed to modify a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40967: Provider [ProviderName] successfully retrieved metadata for a device with status code StatusCode.

Channel: Metadata

Message #

Provider [%1] successfully retrieved metadata for a device with status code %5:

Device Name: %2

Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40967

Channel: Operational

Description

Provider [] successfully retrieved metadata for a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40968: Provider [ProviderName] failed to retrieve metadata for a device with status code StatusCode.

Channel: Metadata

Message #

Provider [%1] failed to retrieve metadata for a device with status code %5:

Device Name: %2

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40968

Channel: Operational

Description

Provider [] failed to retrieve metadata for a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40969: The server successfully processed a request for available providers with status code StatusCode; Count providers available.

Channel: Metadata

Message #

The server successfully processed a request for available providers with status code %5; %4 providers available.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40969

Channel: Operational

Description

The server successfully processed a request for available providers with status code ; providers available.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40970: The server failed to process a request for available providers with status code StatusCode.

Channel: Metadata

Message #

The server failed to process a request for available providers with status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40970

Channel: Operational

Description

The server failed to process a request for available providers with status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 45056: The server processed a metadata match request.

Channel: Metadata

Message #

The server processed a metadata match request:

Object ID: %1

Object Metadata:
%2

Request Metadata:
%3

Match Result: %4

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45056

Channel: Operational

Description

The server processed a metadata match request.

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45057: There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Channel: Metadata

Message #

There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Object ID: %1
5nObject Filter:
%2

Request Metadata:
%3

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45057

Channel: Operational

Description

There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 49152: The server successfully retrieved metadata for an object with status code StatusCode.

Channel: Metadata

Message #

The server successfully retrieved metadata for an object with status code %3:

Object ID: %1

Object Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49152

Channel: Operational

Description

The server successfully retrieved metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49153: The server failed to retrieve metadata for an object with status code StatusCode.

Channel: Metadata

Message #

The server failed to retrieve metadata for an object with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49153

Channel: Operational

Description

The server failed to retrieve metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49154: The server successfully modified metadata for an object with status code StatusCode.

Channel: Metadata

Message #

The server successfully modified metadata for an object with status code %3:

Object ID: %1

New Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49154

Channel: Operational

Description

The server successfully modified metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49155: The server failed to modify metadata for an object with status code StatusCode.

Channel: Metadata

Message #

The server failed to modify metadata for an object with status code %3:

Object ID: %1

New Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49155

Channel: Operational

Description

The server failed to modify metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49158: A new metadata object was successfully registered in the server with status code StatusCode.

Channel: Metadata

Message #

A new metadata object was successfully registered in the server with status code %3:

Object ID: %1

Object Metadata:
%2

Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49158

Channel: Operational

Description

A new metadata object was successfully registered in the server with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49159: The server failed to register a new metadata object with status code StatusCode.

Channel: Metadata

Message #

The server failed to register a new metadata object with status code %3:

Object ID: %1

Object Metadata:
%2

Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49159

Channel: Operational

Description

The server failed to register a new metadata object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49162: An object was successfully deleted with status code StatusCode.

Channel: Metadata

Message #

An object was successfully deleted with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49162

Channel: Operational

Description

An object was successfully deleted with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49163: The server failed to delete an object with status code StatusCode.

Channel: Metadata

Message #

The server failed to delete an object with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49163

Channel: Operational

Description

The server failed to delete an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49164: An object's parenting relationship was successfully modified with status code StatusCode.

Channel: Metadata

Message #

An object's parenting relationship was successfully modified with status code %3:

Object ID: %1

New Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49164

Channel: Operational

Description

An object's parenting relationship was successfully modified with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49165: The server failed to modify an object's parenting relationship with status code StatusCode.

Channel: Metadata

Message #

The server failed to modify an object's parenting relationship with status code %3:

Object ID: %1

New Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49165

Channel: Operational

Description

The server failed to modify an object's parenting relationship with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 53248: WdsUtil.

Channel: Operational
Task: WdsUtil_Command
Opcode: Start

Description

WdsUtil.exe was run with the following command line.

Message #

WdsUtil.exe was run with the following command line:

%1

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 53249: A WdsUtil.

Channel: Operational
Task: WdsUtil_Command
Opcode: Stop

Description

A WdsUtil.exe command was successfully executed.

Message #

A WdsUtil.exe command was successfully executed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 53250: A WdsUtil.

Channel: Operational

Description

A WdsUtil.exe command failed.

Message #

A WdsUtil.exe command failed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57344: The following VHDX apply has started.

Channel: Operational
Task: VhdxApply
Opcode: Start

Message #

The following VHDX apply has started: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57345: The following VHDX apply has completed.

Channel: Operational
Task: VhdxApply
Opcode: Stop

Message #

The following VHDX apply has completed: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57346: The following VHDX apply has failed.

Channel: Operational

Message #

The following VHDX apply has failed: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57347: The PXE server processed a request from a client of architecture Architecture.

Channel: Admin

Message #

The PXE server processed a request from a client of architecture %1.  However there were no boot images installed for this architecture.  PXE clients of this architecture will not be able to complete the boot process successfully.  To resolve this problem, add at least one boot image for this architecture.

Fields #

Name	Description
`Architecture` UnicodeString

Event ID 57347

Channel: Operational

Fields #

Name	Description
`Architecture` UnicodeString

Event ID 57348: A BufferType buffer was created for reading file FilePath.

Channel: Operational

Message #

A %3 buffer was created for reading file %1.

Fields #

Name	Description
`FilePath` UnicodeString
`FileSize` UInt64
`BufferType` UInt32

Event ID 57349: A BufferType buffer created for reading file FilePath was deleted.

Channel: Operational

Message #

A %3 buffer created for reading file %1 was deleted.

Fields #

Name	Description
`FilePath` UnicodeString
`FileSize` UInt64
`BufferType` UInt32

Event ID 57350: An endpoint was opened by provider Provider.

Channel: Operational

Message #

An endpoint was opened by provider %2.

Type: %1
Address: %3

Fields #

Name	Description
`Type` UInt32
`Provider` UnicodeString
`Address` UnicodeString

Event ID 57351: An endpoint was closed by provider Provider.

Channel: Operational

Message #

An endpoint was closed by provider %2.

Type: %1
Address: %3

Fields #

Name	Description
`Type` UInt32
`Provider` UnicodeString
`Address` UnicodeString

Event ID 57352: WdsCim was invoked with the following command line.

Channel: Operational
Task: WdsCim_Command
Opcode: Start

Message #

WdsCim was invoked with the following command line:

%1

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57353: A WdsCim method was successfully executed.

Channel: Operational
Task: WdsCim_Command
Opcode: Stop

Message #

A WdsCim method was successfully executed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57354: A WdsCim method failed.

Channel: Operational

Message #

A WdsCim method failed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Provenance

ETW provider GUID 22b7d623-566b-47b6-9ba0-bc9da3c9d646

Defined in WdsDiag.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB