detection.wiki

Microsoft-Windows-DeviceAssociationService

EventTitleChannelSampleRule
2500Device Association (Pairing) Succeeded.SystemNN
2501Device Disassociation (Unpairing) Succeeded.SystemNN
3500Device Association Service detected a fatal hang.SystemNN
3501Device Association Failed.SystemNN
3502Device Disassociation (Unpairing) Failed.SystemNN
3503Device Association Service detected an endpoint discovery failure.SystemNN
3504Device Association Failed - Initialize OOB.SystemNN
3505Device Association Failed - Enumerate Ceremonies.SystemNN
3506Device Association Failed - Read Ceremony Data.SystemNN
3507Device Association Failed - Write Ceremony Data.SystemNN
3508Device Association Failed - Initialize Association.SystemNN
3509Device Association Failed - Select Ceremony.SystemNN
3510Device Association Failed - Finalize.SystemNN
4500Device Association Service dispatched thread timed out.SystemNN
5500Device Association Service RPC create query has started.PerformanceNN
5501Device Association Service RPC create query has exited.PerformanceNN
5502Device Association Service create query has started (provider queries …PerformanceNN
5503Device Association Service create query has exited (provider queries inclusive).PerformanceNN
5504Device Association provider create query has started.PerformanceNN
5505Device Association provider create query has exited.PerformanceNN
5700Device Association Service create association context has started (provider …PerformanceNN
5701Device Association Service create association context has exited (provider …PerformanceNN
5702Device Association Service create association context has started (provider …PerformanceNN
5703Device Association Service create association context has exited (provider …PerformanceNN
5704Device Association Service enum association ceremonies has started (provider …PerformanceNN
5705Device Association Service enum association ceremonies has exited (provider …PerformanceNN
5706Device Association Service enum association ceremonies has started (provider …PerformanceNN
5707Device Association Service enum association ceremonies has exited (provider …PerformanceNN
5708Device Association Service select ceremony has started (provider inclusive).PerformanceNN
5709Device Association Service select ceremony has exited (provider inclusive).PerformanceNN
5710Device Association Service select ceremony ceremonies has started (provider …PerformanceNN
5711Device Association Service select ceremony has exited (provider only).PerformanceNN
5712Device Association Service read ceremony data has started (provider inclusive).PerformanceNN
5713Device Association Service read ceremony data has exited (provider inclusive).PerformanceNN
5714Device Association Service read ceremony data ceremonies has started (provider …PerformanceNN
5715Device Association Service read ceremony data has exited (provider only).PerformanceNN
5716Device Association Service write ceremony data has started (provider inclusive).PerformanceNN
5717Device Association Service write ceremony data has exited (provider inclusive).PerformanceNN
5718Device Association Service write ceremony data ceremonies has started (provider …PerformanceNN
5719Device Association Service write ceremony data has exited (provider only).PerformanceNN
5720Device Association Service finalize ceremony has started (provider inclusive).PerformanceNN
5721Device Association Service finalize ceremony has exited (provider inclusive).PerformanceNN
5722Device Association Service finalize ceremony ceremonies has started (provider …PerformanceNN
5723Device Association Service finalize ceremony has exited (provider only).PerformanceNN
5724Device Association Service finalize ceremony has started (provider inclusive).PerformanceNN
5725Device Association Service finalize ceremony has exited (provider inclusive).PerformanceNN
5726Device Association Service finalize ceremony ceremonies has started (provider …PerformanceNN
5727Device Association Service finalize ceremony has exited (provider only).PerformanceNN
5728Device Association Service remove association has started (provider inclusive).PerformanceNN
5729Device Association Service remove association has exited (provider inclusive).PerformanceNN
5730Device Association Service remove association ceremonies has started (provider …PerformanceNN
5731Device Association Service remove association has exited (provider only).PerformanceNN
5732Device Association Service close association has started (provider inclusive).PerformanceNN
5733Device Association Service close association has exited (provider inclusive).PerformanceNN
5734Device Association Service close association ceremonies has started (provider …PerformanceNN
5735Device Association Service close association has exited (provider only).PerformanceNN
5736Device Association Service association has started (provider inclusive, entire …PerformanceNN
5737Device Association Service association has exited (provider inclusive, entire …PerformanceNN

Event ID 2500: Device Association (Pairing) Succeeded.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
IsPersisted Boolean
IsManagingDevnodes Boolean
IsPerUser Boolean
PerUserSid UnicodeString
IsPartOfSet Boolean
AssociationError UInt32
ProtocolError UInt32

Event ID 2501: Device Disassociation (Unpairing) Succeeded.

#
Channel
System
Task
das_Association

Fields #

NameDescription
pid UInt32
tid UInt32
timeout UInt32

Event ID 3500: Device Association Service detected a fatal hang.

#
Channel
System
Task
das_Watchdog

Fields #

NameDescription
pid UInt32
tid UInt32
timeout UInt32

Event ID 3501: Device Association Failed.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
IsPersisted Boolean
IsManagingDevnodes Boolean
IsPerUser Boolean
PerUserSid UnicodeString
IsPartOfSet Boolean
AssociationError UInt32
ProtocolError UInt32

Event ID 3502: Device Disassociation (Unpairing) Failed.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3503: Device Association Service detected an endpoint discovery failure.

#
Channel
System
Task
das_Query

Fields #

NameDescription
AbortingProtocolProvider UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
InternalError UInt32

Event ID 3504: Device Association Failed - Initialize OOB.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3505: Device Association Failed - Enumerate Ceremonies.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3506: Device Association Failed - Read Ceremony Data.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3507: Device Association Failed - Write Ceremony Data.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3508: Device Association Failed - Initialize Association.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
AumId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3509: Device Association Failed - Select Ceremony.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 3510: Device Association Failed - Finalize.

#
Channel
System
Task
das_Association

Fields #

NameDescription
AepId UnicodeString
ClientProcessName UnicodeString
ClientPid UInt32
AssociationError UInt32
ProtocolError UInt32

Event ID 4500: Device Association Service dispatched thread timed out.

#
Channel
System
Task
das_Dispatcher

Fields #

NameDescription
pid UInt32
tid UInt32
timeout UInt32

Event ID 5500: Device Association Service RPC create query has started.

#
Channel
Performance
Task
das_Query
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5501: Device Association Service RPC create query has exited.

#
Channel
Performance
Task
das_Query
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5502: Device Association Service create query has started (provider queries inclusive).

#
Channel
Performance
Task
das_Query
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5503: Device Association Service create query has exited (provider queries inclusive).

#
Channel
Performance
Task
das_Query
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5504: Device Association provider create query has started.

#
Channel
Performance
Task
das_Query
Opcode
Start

Fields #

NameDescription
ProviderName UnicodeString
DasContext Pointer

Event ID 5505: Device Association provider create query has exited.

#
Channel
Performance
Task
das_Query
Opcode
Stop

Fields #

NameDescription
ProviderName UnicodeString
DasContext Pointer

Event ID 5700: Device Association Service create association context has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5701: Device Association Service create association context has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5702: Device Association Service create association context has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5703: Device Association Service create association context has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5704: Device Association Service enum association ceremonies has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5705: Device Association Service enum association ceremonies has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5706: Device Association Service enum association ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5707: Device Association Service enum association ceremonies has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5708: Device Association Service select ceremony has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5709: Device Association Service select ceremony has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5710: Device Association Service select ceremony ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5711: Device Association Service select ceremony has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5712: Device Association Service read ceremony data has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

References #

Event ID 5713: Device Association Service read ceremony data has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5714: Device Association Service read ceremony data ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5715: Device Association Service read ceremony data has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5716: Device Association Service write ceremony data has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5717: Device Association Service write ceremony data has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5718: Device Association Service write ceremony data ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5719: Device Association Service write ceremony data has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5720: Device Association Service finalize ceremony has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5721: Device Association Service finalize ceremony has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5722: Device Association Service finalize ceremony ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5723: Device Association Service finalize ceremony has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5724: Device Association Service finalize ceremony has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5725: Device Association Service finalize ceremony has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5726: Device Association Service finalize ceremony ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5727: Device Association Service finalize ceremony has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5728: Device Association Service remove association has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5729: Device Association Service remove association has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5730: Device Association Service remove association ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5731: Device Association Service remove association has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5732: Device Association Service close association has started (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5733: Device Association Service close association has exited (provider inclusive).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5734: Device Association Service close association ceremonies has started (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5735: Device Association Service close association has exited (provider only).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Event ID 5736: Device Association Service association has started (provider inclusive, entire association).

#
Channel
Performance
Task
das_Association
Opcode
Start

Fields #

NameDescription
DasContext Pointer

Event ID 5737: Device Association Service association has exited (provider inclusive, entire association).

#
Channel
Performance
Task
das_Association
Opcode
Stop

Fields #

NameDescription
DasContext Pointer

Provenance

ETW provider GUID 56c71c31-cfbd-4cdd-8559-505e042bbbe1

Defined in das.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB