Microsoft-Windows-DeviceAssociationService
58 events across 2 channels
Event ID 2500: Device Association (Pairing) Succeeded.
#Event ID 2501: Device Disassociation (Unpairing) Succeeded.
#Event ID 3500: Device Association Service detected a fatal hang.
#Event ID 3501: Device Association Failed.
#Event ID 3502: Device Disassociation (Unpairing) Failed.
#Event ID 3503: Device Association Service detected an endpoint discovery failure.
#Event ID 3504: Device Association Failed - Initialize OOB.
#Event ID 3505: Device Association Failed - Enumerate Ceremonies.
#Event ID 3506: Device Association Failed - Read Ceremony Data.
#Event ID 3507: Device Association Failed - Write Ceremony Data.
#Event ID 3508: Device Association Failed - Initialize Association.
#Event ID 3509: Device Association Failed - Select Ceremony.
#Event ID 3510: Device Association Failed - Finalize.
#Event ID 4500: Device Association Service dispatched thread timed out.
#Event ID 5500: Device Association Service RPC create query has started.
#Event ID 5501: Device Association Service RPC create query has exited.
#Event ID 5502: Device Association Service create query has started (provider queries inclusive).
#Event ID 5503: Device Association Service create query has exited (provider queries inclusive).
#Event ID 5504: Device Association provider create query has started.
#Event ID 5505: Device Association provider create query has exited.
#Event ID 5700: Device Association Service create association context has started (provider inclusive).
#Event ID 5701: Device Association Service create association context has exited (provider inclusive).
#Event ID 5702: Device Association Service create association context has started (provider only).
#Event ID 5703: Device Association Service create association context has exited (provider only).
#Event ID 5704: Device Association Service enum association ceremonies has started (provider inclusive).
#Event ID 5705: Device Association Service enum association ceremonies has exited (provider inclusive).
#Event ID 5706: Device Association Service enum association ceremonies has started (provider only).
#Event ID 5707: Device Association Service enum association ceremonies has exited (provider only).
#Event ID 5708: Device Association Service select ceremony has started (provider inclusive).
#Event ID 5709: Device Association Service select ceremony has exited (provider inclusive).
#Event ID 5710: Device Association Service select ceremony ceremonies has started (provider only).
#Event ID 5711: Device Association Service select ceremony has exited (provider only).
#Event ID 5712: Device Association Service read ceremony data has started (provider inclusive).
#Event ID 5713: Device Association Service read ceremony data has exited (provider inclusive).
#Event ID 5714: Device Association Service read ceremony data ceremonies has started (provider only).
#Event ID 5715: Device Association Service read ceremony data has exited (provider only).
#Event ID 5716: Device Association Service write ceremony data has started (provider inclusive).
#Event ID 5717: Device Association Service write ceremony data has exited (provider inclusive).
#Event ID 5718: Device Association Service write ceremony data ceremonies has started (provider only).
#Event ID 5719: Device Association Service write ceremony data has exited (provider only).
#Event ID 5720: Device Association Service finalize ceremony has started (provider inclusive).
#Event ID 5721: Device Association Service finalize ceremony has exited (provider inclusive).
#Event ID 5722: Device Association Service finalize ceremony ceremonies has started (provider only).
#Event ID 5723: Device Association Service finalize ceremony has exited (provider only).
#Event ID 5724: Device Association Service finalize ceremony has started (provider inclusive).
#Event ID 5725: Device Association Service finalize ceremony has exited (provider inclusive).
#Event ID 5726: Device Association Service finalize ceremony ceremonies has started (provider only).
#Event ID 5727: Device Association Service finalize ceremony has exited (provider only).
#Event ID 5728: Device Association Service remove association has started (provider inclusive).
#Event ID 5729: Device Association Service remove association has exited (provider inclusive).
#Event ID 5730: Device Association Service remove association ceremonies has started (provider only).
#Event ID 5731: Device Association Service remove association has exited (provider only).
#Event ID 5732: Device Association Service close association has started (provider inclusive).
#Event ID 5733: Device Association Service close association has exited (provider inclusive).
#Event ID 5734: Device Association Service close association ceremonies has started (provider only).
#Event ID 5735: Device Association Service close association has exited (provider only).
#Event ID 5736: Device Association Service association has started (provider inclusive, entire association).
#Event ID 5737: Device Association Service association has exited (provider inclusive, entire association).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 56c71c31-cfbd-4cdd-8559-505e042bbbe1
Defined in das.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02