Microsoft-Windows-DeviceManagement-Pushrouter

107 events across 1 channel

Event	Title	Channel	Sample
100	MDM PushRouter Service: Failed to create ConfigManager lock service binding.	Operational	N
101	MDM PushRouter Service: Successfully created RPC Server Interface group.	Operational	Y
102	MDM PushRouter Service: Failed to create RPC Server Interface group.	Operational	N
103	MDM PushRouter Service: Failed to activate RPC Server Interface group because a …	Operational	N
104	MDM PushRouter Service: Successfully activated RPC Server Interface group.	Operational	Y
105	MDM PushRouter Service: Failed to activate RPC Server Interface group.	Operational	N
106	MDM PushRouter Service: Successfully deactivated RPC Server Interface group.	Operational	Y
107	MDM PushRouter Service: Failed to deactivate RPC Server Interface group.	Operational	N
108	MDM PushRouter Service: Successfully closed RPC Server Interface group.	Operational	Y
109	MDM PushRouter Service: Failed to close RPC Server Interface group.	Operational	N
110	MDM PushRouter Service: PushRouter RPC interface Idle status changed.	Operational	Y
111	MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT).	Operational	Y
112	MDM PushRouter Service: All clients handled.	Operational	Y
113	MDM PushRouter Service: Number of active client count rolled over.	Operational	N
114	MDM PushRouter Service: PushRouter RPC run down occured.	Operational	N
115	MDM PushRouter Service: PushRouter::Open called by a client needing a handle to …	Operational	Y
116	MDM PushRouter Service: PushRouter::Open called by a client needing to interact …	Operational	Y
117	MDM PushRouter Service: PushRouter::Open called by a client needing to interact …	Operational	N
118	MDM PushRouter Service: PushRouter was submitted a message from the same service …	Operational	Y
119	MDM PushRouter Service: PushRouter was submitted a message from the same service …	Operational	Y
120	MDM PushRouter Service: PushRouter was submitted a message from the same service …	Operational	N
121	MDM PushRouter Service: PushRouter was submitted a message by a RPC client.	Operational	Y
122	MDM PushRouter Service: PushRouter was submitted a message by a RPC client.	Operational	N
123	MDM PushRouter Service: PushRouter was created successfully.	Operational	Y
124	MDM PushRouter Service: PushRouter could not be created successfully.	Operational	N
125	MDM PushRouter Service: Opening Service Control Manager to change PushRouter …	Operational	N
126	MDM PushRouter Service: Opening service handle to change PushRouter startup type …	Operational	N
127	MDM PushRouter Service: Changing PushRouter start up type to auto start failed.	Operational	N
128	MDM PushRouter Service: Changing PushRouter start up type to delayed auto start …	Operational	N
129	MDM PushRouter Service: PushRouter close called by a client interacting with it …	Operational	Y
130	MDM PushRouter Service: PushRouter close called by a client interacting with it …	Operational	N
131	MDM PushRouter Service: A client initiated a get message operation from …	Operational	Y
132	MDM PushRouter Service: A client was able to successfully get a message from …	Operational	Y
133	MDM PushRouter Service: A client failed to get a message from PushRouter.	Operational	N
134	MDM PushRouter Service: PushRouter was instantiated.	Operational	Y
135	MDM Message Persistence: Persisted message found.	Operational	Y
136	MDM Message Persistence: Failed to load persisted message file.	Operational	N
137	MDM Message Persistence: Queue Id found for persisted message.	Operational	N
138	MDM Message Persistence: No client found for queue Id for persisted message.	Operational	N
139	MDM Message Persistence: Client found for queue Id for persisted message.	Operational	N
140	MDM Message Persistence: Client failed to launch for queue Id for persisted …	Operational	N
141	MDM Message Persistence: No persisted message found.	Operational	Y
142	MDM Message Persistence: Failed to delete messages file.	Operational	N
143	MDM Message Persistence: Failed to process persisted messages.	Operational	N
144	MDM Message Persistence: Successfully processed persisted messages.	Operational	Y
145	MDM PushRouter Service: PushRouter started routing a message.	Operational	Y
146	MDM PushRouter Service: Routing a message failed.	Operational	N
147	MDM PushRouter Service: Message routed successfully.	Operational	Y
148	MDM PushRouter Service: PushRouter started routing a new message.	Operational	Y
149	MDM PushRouter Service: Failed to route a new message.	Operational	N
150	MDM PushRouter Service: Successfully routed a new message.	Operational	Y
151	MDM Message Persistence: Failed to load unauthenticated messages file.	Operational	N
152	MDM PushRouter Authentication: Loaded an authentication provider.	Operational	Y
153	MDM PushRouter Authentication: Getting authentication provider failed.	Operational	N
154	MDM PushRouter Authentication: Loaded authentication provider failed to …	Operational	N
155	MDM PushRouter Authentication: Message authenticated successfully.	Operational	Y
156	MDM PushRouter Authentication: Message could not be authenticated.	Operational	N
157	MDM PushRouter Proxy: RPC call to get a message from PushRouter failed.	Operational	N
158	MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded.	Operational	N
159	MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed.	Operational	N
160	MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded.	Operational	N
161	MDM PushRouter Authentication: Failed to get network shared secret because ICCID …	Operational	N
162	MDM PushRouter Authentication: WAP Verification succeeded.	Operational	N
163	MDM PushRouter Authentication: WAP Verification failed.	Operational	N
164	MDM PushRouter Authentication: WAP Authentication failed.	Operational	N
165	MDM PushRouter Authentication: WAP Authentication succeeded.	Operational	N
166	MDM PushRouter Authentication: SyncMl Authentication failed.	Operational	N
167	MDM PushRouter Authentication: SyncMl Authentication succeeded.	Operational	Y
168	MDM PushRouter Authentication: Getting ServerID from the trigger failed.	Operational	N
169	MDM PushRouter Authentication: Getting ServerID from the trigger succeeded.	Operational	Y
170	MDM PushRouter Authentication: Validating trigger failed.	Operational	N
171	MDM PushRouter Authentication: Validating trigger succeeded.	Operational	Y
172	MDM PushRouter Authentication: Validating nonce failed.	Operational	N
173	MDM PushRouter Authentication: Validating nonce succeeded.	Operational	Y
174	MDM PushRouter Authentication: Using default nonce resync is set to false.	Operational	N
175	MDM PushRouter Authentication: Default nonce not found.	Operational	N
176	MDM PushRouter: Changing dmwappushservice startup type to demand started.	Operational	N
177	MDM PushRouter: Changing dmwappushservice startup type to demand started failed.	Operational	N
178	MDM PushRouter: Pushrouter failed to start because the dmwappushservice service …	Operational	N
300	MDM Common Utility for Policies: Policy query.	Operational	Y
301	MDM Common Utility for Policies: Policy set.	Operational	N
500	DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was …	Operational	N
501	DmWapPushService: Failed to copy WAP message into a format that PushRouter …	Operational	N
502	DmWapPushService: Successfully copied WAP message into a format that PushRouter …	Operational	N
503	DmWapPushService: Failed to retrieve body of WAP message.	Operational	N
504	DmWapPushService: Successfully retrieved body of WAP message.	Operational	N
505	DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).	Operational	N
506	DmWapPushService: Failed to register WNF with EventAggregator for WAP messages …	Operational	Y
507	DmWapPushService: Successfully registered WNF with EventAggregator for WAP …	Operational	Y
508	DmWapPushService: Callback to handle a new WAP message received.	Operational	N
509	DmWapPushService: There are pending RPC clients currently.	Operational	Y
510	DmWapPushService: No pending RPC clients remain.	Operational	Y
511	DmWapPushService: Setting the timer to check if all RPC clients are handled to …	Operational	Y
512	DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) …	Operational	Y
513	DmWapPushService: Initialized idle stop-start for DmWapPushService.	Operational	Y
514	DmWapPushService: Service status updated.	Operational	Y
515	DmWapPushService: Failed to initialize service.	Operational	N
516	DmWapPushService: Successfully initialized service.	Operational	Y
517	DmWapPushService: Failed to register service's RPC interface.	Operational	N
518	DmWapPushService: Successfully registered service's RPC interface.	Operational	Y
519	DmWapPushService: Failed to uninitialize service.	Operational	N
520	DmWapPushService: Successfully uninitialized service.	Operational	Y
521	DmWapPushService: Failed to unregister service's RPC interface.	Operational	N
522	DmWapPushService: Successfully unregistered service's RPC interface.	Operational	Y
523	DmWapPushService: Service handler invoked.	Operational	Y
524	DmWapPushService: DmWapPushService is being initialized.	Operational	Y
525	DmWapPushService: Stop Service handler registered.	Operational	Y

Event ID 100: MDM PushRouter Service: Failed to create ConfigManager lock service binding.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to create ConfigManager lock service binding. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to create ConfigManager lock service binding. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 101: MDM PushRouter Service: Successfully created RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Successfully created RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully created RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736188+00:00",
    "event_record_id": 7327,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 102: MDM PushRouter Service: Failed to create RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to create RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to create RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 103: MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to activate RPC Server Interface group because a duplicate end point exists. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 104: MDM PushRouter Service: Successfully activated RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Successfully activated RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully activated RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738835+00:00",
    "event_record_id": 7329,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 105: MDM PushRouter Service: Failed to activate RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to activate RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to activate RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 106: MDM PushRouter Service: Successfully deactivated RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Successfully deactivated RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully deactivated RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378775+00:00",
    "event_record_id": 7376,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 107: MDM PushRouter Service: Failed to deactivate RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to deactivate RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to deactivate RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 108: MDM PushRouter Service: Successfully closed RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Successfully closed RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully closed RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 108,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378898+00:00",
    "event_record_id": 7377,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 109: MDM PushRouter Service: Failed to close RPC Server Interface group.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to close RPC Server Interface group. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to close RPC Server Interface group. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 110: MDM PushRouter Service: PushRouter RPC interface Idle status changed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter RPC interface Idle status changed. Is group idle: (HexInt1).

Message #

MDM PushRouter Service: PushRouter RPC interface Idle status changed. Is group idle: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 110,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:16.062812+00:00",
    "event_record_id": 7371,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1"
  },
  "message": ""
}

Event ID 111: MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT).

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Number of PushRouter clients remaining: (HRESULT). Operation: (Message1).

Message #

MDM PushRouter Service: Number of PushRouter clients remaining: (%2). Operation: (%1).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 111,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.376378+00:00",
    "event_record_id": 7373,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 9048
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Checking if all clients are handled",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 112: MDM PushRouter Service: All clients handled.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: All clients handled. Number of PushRouter clients remaining: (HexInt1).

Message #

MDM PushRouter Service: All clients handled. Number of PushRouter clients remaining: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:16.062830+00:00",
    "event_record_id": 7372,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 113: MDM PushRouter Service: Number of active client count rolled over.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Number of active client count rolled over. Number of PushRouter clients remaining: (HexInt1).

Message #

MDM PushRouter Service: Number of active client count rolled over. Number of PushRouter clients remaining: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Event ID 114: MDM PushRouter Service: PushRouter RPC run down occured.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter RPC run down occured.

Message #

MDM PushRouter Service: PushRouter RPC run down occured.

Event ID 115: MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing a handle to PushRouter.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 115,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.897771+00:00",
    "event_record_id": 7352,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 116: MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded. Client id: (Message1), Content Type: (Message2):, App Id: (Message3), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter succeeded. Client id: (%1), Content Type: (%2):, App Id: (%3), Result: (%4).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 116,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.899083+00:00",
    "event_record_id": 7354,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "PC5",
    "Message2": "application/vnd.syncml.notification",
    "Message3": "x-wap-application:syncml.dm",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 117: MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed. Content Type: (Message1):, App Id: (Message2), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter::Open called by a client needing to interact with PushRouter failed. Content Type: (%1):, App Id: (%2), Result: (%3).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`HRESULT` HexInt32

Event ID 118: MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message origin: (HexInt1).

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message origin: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 118,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.740105+00:00",
    "event_record_id": 7333,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x3"
  },
  "message": ""
}

Event ID 119: MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission succeeded. Sender Address: (), Content Type: (), App Id: (), Result: ().

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission succeeded. Sender Address: (%1), Content Type: (%2), App Id: (%3), Result: (%4).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765530+00:00",
    "event_record_id": 7339,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "NULL",
    "Message2": "application/vnd.syncml.notification",
    "Message3": "NULL",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 120: MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission failed. Sender Address: ():, Content Type: (),App Id: (), Result: ().

Message #

MDM PushRouter Service: PushRouter was submitted a message from the same service PushRouter is running in. Message submission failed. Sender Address: (%1):, Content Type: (%2),App Id: (%3), Result: (%4).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`HRESULT` HexInt32

Event ID 121: MDM PushRouter Service: PushRouter was submitted a message by a RPC client.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission succeeded. Message origin: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission succeeded. Message origin: (%1), Result: (%2).

Fields #

Name	Description
`HexInt1` HexInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 121,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765562+00:00",
    "event_record_id": 7340,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x3",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 122: MDM PushRouter Service: PushRouter was submitted a message by a RPC client.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission failed. Message origin: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was submitted a message by a RPC client. Message submission failed. Message origin: (%1), Result: (%2).

Fields #

Name	Description
`HexInt1` HexInt32
`HRESULT` HexInt32

Event ID 123: MDM PushRouter Service: PushRouter was created successfully.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter was created successfully. Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter was created successfully. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 123,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.897951+00:00",
    "event_record_id": 7353,
    "correlation": {
      "ActivityID": "AEBE4C57-66E3-4324-8BB1-F438C2253964"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 124: MDM PushRouter Service: PushRouter could not be created successfully.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter could not be created successfully. Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter could not be created successfully. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 125: MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed. Result: ({HRESULT}).

Message #

MDM PushRouter Service: Opening Service Control Manager to change PushRouter startup type failed. Result: ({HRESULT}).

Fields #

Name	Description
`HRESULT`

Event ID 126: MDM PushRouter Service: Opening service handle to change PushRouter startup type failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Opening service handle to change PushRouter startup type failed. Result: ({HRESULT}).

Message #

MDM PushRouter Service: Opening service handle to change PushRouter startup type failed. Result: ({HRESULT}).

Fields #

Name	Description
`HRESULT`

Event ID 127: MDM PushRouter Service: Changing PushRouter start up type to auto start failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Changing PushRouter start up type to auto start failed. Result: (HRESULT).

Message #

MDM PushRouter Service: Changing PushRouter start up type to auto start failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 128: MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed. Result: (HRESULT).

Message #

MDM PushRouter Service: Changing PushRouter start up type to delayed auto start failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 129: MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded. Client id: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter close called by a client interacting with it succeeded. Client id: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 129,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:16.047385+00:00",
    "event_record_id": 7364,
    "correlation": {
      "ActivityID": "3C7B2557-A3AD-4E72-AF98-0B95D4A5B22B"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "PC5",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 130: MDM PushRouter Service: PushRouter close called by a client interacting with it failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: PushRouter close called by a client interacting with it failed. Client id: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Service: PushRouter close called by a client interacting with it failed. Client id: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 131: MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Message #

MDM PushRouter Service: A client initiated a get message operation from PushRouter.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 131,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:06.036773+00:00",
    "event_record_id": 7363,
    "correlation": {
      "ActivityID": "7FBD6708-DDA2-4966-92A3-E43FEAE64147"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 132: MDM PushRouter Service: A client was able to successfully get a message from PushRouter.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: A client was able to successfully get a message from PushRouter. Content Type: (Message1), App Id: (Message2), Source Address: (Message3), Client ID: (Message4), Security Account: (Message5), Message origin: (HexInt1), Result: (HexInt3).

Message #

MDM PushRouter Service: A client was able to successfully get a message from PushRouter. Content Type: (%1), App Id: (%2), Source Address: (%3), Client ID: (%4), Security Account: (%5), Message origin: (%6), Result: (%7).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`Message4` UnicodeString
`Message5` UnicodeString
`HexInt1` HexInt32
`HexInt3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 132,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.909201+00:00",
    "event_record_id": 7356,
    "correlation": {
      "ActivityID": "36236335-6C3A-4D79-A11A-C8A243448C83"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "application/vnd.syncml.notification",
    "Message2": "NULL",
    "Message3": "",
    "Message4": "PC5",
    "Message5": "OmaDmClient_Enterprise",
    "HexInt1": "0x3",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 133: MDM PushRouter Service: A client failed to get a message from PushRouter.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: A client failed to get a message from PushRouter. Content Type: (Message1), App Id: (Message2), Source Address: (Message3), Client ID: (Message4), Message origin: (HexInt1), Result: (HexInt3).

Message #

MDM PushRouter Service: A client failed to get a message from PushRouter. Content Type: (%1), App Id: (%2), Source Address: (%3), Client ID: (%4), Message origin: (%5), Result: (%6).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`Message4` UnicodeString
`HexInt1` HexInt32
`HexInt3` HexInt32

Event ID 134: MDM PushRouter Service: PushRouter was instantiated.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter was instantiated.

Message #

MDM PushRouter Service: PushRouter was instantiated.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 134,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.755805+00:00",
    "event_record_id": 7337,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 135: MDM Message Persistence: Persisted message found.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM Message Persistence: Persisted message found. Location: (Message1).

Message #

MDM Message Persistence: Persisted message found. Location: (%1).

Fields #

Name	Description
`Message1` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 135,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.740876+00:00",
    "event_record_id": 7334,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\PushRouter\\1.queue"
  },
  "message": ""
}

Event ID 136: MDM Message Persistence: Failed to load persisted message file.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Failed to load persisted message file. Location: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to load persisted message file. Location: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 137: MDM Message Persistence: Queue Id found for persisted message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Queue Id found for persisted message. Location: (Message1), Queue Id: (HRESULT).

Message #

MDM Message Persistence: Queue Id found for persisted message. Location: (%1), Queue Id: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 138: MDM Message Persistence: No client found for queue Id for persisted message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: No client found for queue Id for persisted message. Location: (Message1), Queue Id: (HexInt1), Result: (HRESULT).

Message #

MDM Message Persistence: No client found for queue Id for persisted message. Location: (%1), Queue Id: (%2), Result: (%3).

Fields #

Name	Description
`Message1` UnicodeString
`HexInt1` HexInt32
`HRESULT` HexInt32

Event ID 139: MDM Message Persistence: Client found for queue Id for persisted message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Client found for queue Id for persisted message. Location: (Message1), Queue Id: (Message2), Result: (HexInt3).

Message #

MDM Message Persistence: Client found for queue Id for persisted message. Location: (%1), Queue Id: (%2), Result: (%3).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`HexInt3` HexInt32
`HRESULT` HexInt32

Event ID 140: MDM Message Persistence: Client failed to launch for queue Id for persisted message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Client failed to launch for queue Id for persisted message. Location: (Message1), Client: (Message2), Queue Id: (HexInt3), Result: (HRESULT).

Message #

MDM Message Persistence: Client failed to launch for queue Id for persisted message. Location: (%1), Client: (%2), Queue Id: (%3), Result: (%4).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`HexInt3` HexInt32
`HRESULT` HexInt32

Event ID 141: MDM Message Persistence: No persisted message found.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM Message Persistence: No persisted message found.Location: (Message1).

Message #

MDM Message Persistence: No persisted message found.Location: (%1).

Fields #

Name	Description
`Message1` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.741841+00:00",
    "event_record_id": 7335,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\PushRouter\\1.queue"
  },
  "message": ""
}

Event ID 142: MDM Message Persistence: Failed to delete messages file.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Failed to delete messages file. Queue name: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to delete messages file. Queue name: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 143: MDM Message Persistence: Failed to process persisted messages.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Failed to process persisted messages. Result: (HRESULT).

Message #

MDM Message Persistence: Failed to process persisted messages. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 144: MDM Message Persistence: Successfully processed persisted messages.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM Message Persistence: Successfully processed persisted messages. Result: (HRESULT).

Message #

MDM Message Persistence: Successfully processed persisted messages. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 144,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.755596+00:00",
    "event_record_id": 7336,
    "correlation": {
      "ActivityID": "E4DFE51C-35B1-4568-917B-5EE744140CBF"
    },
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 145: MDM PushRouter Service: PushRouter started routing a message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter started routing a message.

Message #

MDM PushRouter Service: PushRouter started routing a message.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 145,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.820264+00:00",
    "event_record_id": 7349,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 146: MDM PushRouter Service: Routing a message failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Routing a message failed. Content: (Message1), Application: (Message2), Sender: (Message3), Client: (Message4), Queue Id: (Message5), Result: (HexInt1).

Message #

MDM PushRouter Service: Routing a message failed. Content: (%1), Application: (%2), Sender: (%3), Client: (%4), Queue Id: (%5), Result: (%6).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`Message4` UnicodeString
`Message5` UnicodeString
`HexInt1` HexInt32

Event ID 147: MDM PushRouter Service: Message routed successfully.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Message routed successfully. Content: (Message1), Application: (Message2), Sender: (Message3), Client: (Message4), Queue Id: (Message5), Result: (HexInt1).

Message #

MDM PushRouter Service: Message routed successfully. Content: (%1), Application: (%2), Sender: (%3), Client: (%4), Queue Id: (%5), Result: (%6).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`Message4` UnicodeString
`Message5` UnicodeString
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 147,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.841537+00:00",
    "event_record_id": 7350,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "application/vnd.syncml.notification",
    "Message2": "NULL",
    "Message3": "NULL",
    "Message4": "PC5",
    "Message5": "1",
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 148: MDM PushRouter Service: PushRouter started routing a new message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: PushRouter started routing a new message.

Message #

MDM PushRouter Service: PushRouter started routing a new message.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 148,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765585+00:00",
    "event_record_id": 7341,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 149: MDM PushRouter Service: Failed to route a new message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Service: Failed to route a new message. Result: (HRESULT).

Message #

MDM PushRouter Service: Failed to route a new message. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 150: MDM PushRouter Service: Successfully routed a new message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Service: Successfully routed a new message. Result: (HRESULT).

Message #

MDM PushRouter Service: Successfully routed a new message. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 150,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.841554+00:00",
    "event_record_id": 7351,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 151: MDM Message Persistence: Failed to load unauthenticated messages file.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Message Persistence: Failed to load unauthenticated messages file.Queue name: (Message1), Result: (HRESULT).

Message #

MDM Message Persistence: Failed to load unauthenticated messages file.Queue name: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 152: MDM PushRouter Authentication: Loaded an authentication provider.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: Loaded an authentication provider. Name: (Message1).

Message #

MDM PushRouter Authentication: Loaded an authentication provider. Name: (%1).

Fields #

Name	Description
`Message1` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 152,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.765605+00:00",
    "event_record_id": 7342,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "SecProviders.SyncMLSecProvider"
  },
  "message": ""
}

Event ID 153: MDM PushRouter Authentication: Getting authentication provider failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Getting authentication provider failed. Name: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting authentication provider failed. Name: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 154: MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message. Name: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Loaded authentication provider failed to authenticate message. Name: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 155: MDM PushRouter Authentication: Message authenticated successfully.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: Message authenticated successfully. Name: (Message1), Security account name: (Message2), Message headers: (Message3), Sender address: (Message4), Role: (HexInt1), Result: (HexInt3).

Message #

MDM PushRouter Authentication: Message authenticated successfully. Name: (%1), Security account name: (%2), Message headers: (%3), Sender address: (%4), Role: (%5), Result: (%6).

Fields #

Name	Description
`Message1` UnicodeString
`Message2` UnicodeString
`Message3` UnicodeString
`Message4` UnicodeString
`HexInt1` HexInt32
`HexInt3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 155,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.811427+00:00",
    "event_record_id": 7348,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "SecProviders.SyncMLSecProvider",
    "Message2": "OmaDmClient_Enterprise",
    "Message3": "Content-Type: application/vnd.syncml.notification\r\nX-Wap-Application-Id: x-wap-application:syncml.dm",
    "Message4": "NULL",
    "HexInt1": "0x20",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 156: MDM PushRouter Authentication: Message could not be authenticated.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Message could not be authenticated. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Message could not be authenticated. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 157: MDM PushRouter Proxy: RPC call to get a message from PushRouter failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Proxy: RPC call to get a message from PushRouter failed. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to get a message from PushRouter failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 158: MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to get a message from PushRouter succeeded. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 159: MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to submit a message from PushRouter failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 160: MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded. Result: (HRESULT).

Message #

MDM PushRouter Proxy: RPC call to submit a message from PushRouter succeeded. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 161: MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Message #

MDM PushRouter Authentication: Failed to get network shared secret because ICCID is null.

Event ID 162: MDM PushRouter Authentication: WAP Verification succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: WAP Verification succeeded. Security param: (HexInt1), Security role assigned: (HexInt2), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Verification succeeded. Security param: (%1), Security role assigned: (%2), Result: (%3).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HRESULT` HexInt32

Event ID 163: MDM PushRouter Authentication: WAP Verification failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: WAP Verification failed. Security param: (HexInt1), Security role assigned: (HexInt2), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Verification failed. Security param: (%1), Security role assigned: (%2), Result: (%3).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HRESULT` HexInt32

Event ID 164: MDM PushRouter Authentication: WAP Authentication failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: WAP Authentication failed. Security param: (HexInt1), Policy Value: (HexInt2), Security role assigned: (HexInt3), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Authentication failed. Security param: (%1), Policy Value: (%2), Security role assigned: (%3), Result: (%4).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HexInt3` HexInt32
`HRESULT` HexInt32

Event ID 165: MDM PushRouter Authentication: WAP Authentication succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: WAP Authentication succeeded. Security param: (HexInt1), Policy Value: (HexInt2), Security role assigned: (HexInt3), Result: (HRESULT).

Message #

MDM PushRouter Authentication: WAP Authentication succeeded. Security param: (%1), Policy Value: (%2), Security role assigned: (%3), Result: (%4).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HexInt3` HexInt32
`HRESULT` HexInt32

Event ID 166: MDM PushRouter Authentication: SyncMl Authentication failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: SyncMl Authentication failed. Headers: (Message1), Message Body size: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: SyncMl Authentication failed. Headers: (%1), Message Body size: (%2), Result: (%3).

Fields #

Name	Description
`Message1` UnicodeString
`HexInt1` HexInt32
`HRESULT` HexInt32

Event ID 167: MDM PushRouter Authentication: SyncMl Authentication succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: SyncMl Authentication succeeded. Headers: (Message1), Message Body size: (HexInt1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: SyncMl Authentication succeeded. Headers: (%1), Message Body size: (%2), Result: (%3).

Fields #

Name	Description
`Message1` UnicodeString
`HexInt1` HexInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 167,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.811409+00:00",
    "event_record_id": 7347,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Content-Type: application/vnd.syncml.notification\r\nX-Wap-Application-Id: x-wap-application:syncml.dm",
    "HexInt1": "0x3c",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 168: MDM PushRouter Authentication: Getting ServerID from the trigger failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Getting ServerID from the trigger failed. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting ServerID from the trigger failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 169: MDM PushRouter Authentication: Getting ServerID from the trigger succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: Getting ServerID from the trigger succeeded. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Getting ServerID from the trigger succeeded. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810524+00:00",
    "event_record_id": 7346,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 170: MDM PushRouter Authentication: Validating trigger failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Validating trigger failed. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating trigger failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 171: MDM PushRouter Authentication: Validating trigger succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: Validating trigger succeeded. Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating trigger succeeded. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 171,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810506+00:00",
    "event_record_id": 7345,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 172: MDM PushRouter Authentication: Validating nonce failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Validating nonce failed. Type of nonce: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating nonce failed. Type of nonce: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 173: MDM PushRouter Authentication: Validating nonce succeeded.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM PushRouter Authentication: Validating nonce succeeded. Type of nonce: (Message1), Result: (HRESULT).

Message #

MDM PushRouter Authentication: Validating nonce succeeded. Type of nonce: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 173,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.810461+00:00",
    "event_record_id": 7344,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 8644
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Message1": "Regular",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 174: MDM PushRouter Authentication: Using default nonce resync is set to false.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Using default nonce resync is set to false.

Message #

MDM PushRouter Authentication: Using default nonce resync is set to false.

Event ID 175: MDM PushRouter Authentication: Default nonce not found.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter Authentication: Default nonce not found.

Message #

MDM PushRouter Authentication: Default nonce not found.

Event ID 176: MDM PushRouter: Changing dmwappushservice startup type to demand started.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter: Changing dmwappushservice startup type to demand started. Result: (HRESULT).

Message #

MDM PushRouter: Changing dmwappushservice startup type to demand started. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 177: MDM PushRouter: Changing dmwappushservice startup type to demand started failed.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter: Changing dmwappushservice startup type to demand started failed. Result: (HRESULT).

Message #

MDM PushRouter: Changing dmwappushservice startup type to demand started failed. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 178: MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Message #

MDM PushRouter: Pushrouter failed to start because the dmwappushservice service is disabled.

Event ID 300: MDM Common Utility for Policies: Policy query.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

MDM Common Utility for Policies: Policy query. Policy ID: (HexInt1), Policy Value: (HexInt2), Result: (HRESULT).

Message #

MDM Common Utility for Policies: Policy query. Policy ID: (%1), Policy Value: (%2), Result: (%3).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:02.145061+00:00",
    "event_record_id": 7357,
    "correlation": {},
    "execution": {
      "process_id": 6736,
      "thread_id": 11860
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1022",
    "HexInt2": "0x0",
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 301: MDM Common Utility for Policies: Policy set.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

MDM Common Utility for Policies: Policy set. Policy ID: (HexInt1), Policy Value: (HexInt2), Result: (HRESULT).

Message #

MDM Common Utility for Policies: Policy set. Policy ID: (%1), Policy Value: (%2), Result: (%3).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HRESULT` HexInt32

Event ID 500: DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received. Result: (HRESULT).

Message #

DmWapPushService: Failed to retrieve ICCID of the SIM on which the message was received. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 501: DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.ICCID: (Message1), Result: (HRESULT).

Message #

DmWapPushService: Failed to copy WAP message into a format that PushRouter understands.ICCID: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 502: DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.ICCID: (Message1), Result: (HRESULT).

Message #

DmWapPushService: Successfully copied WAP message into a format that PushRouter understands.ICCID: (%1), Result: (%2).

Fields #

Name	Description
`Message1` UnicodeString
`HRESULT` HexInt32

Event ID 503: DmWapPushService: Failed to retrieve body of WAP message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to retrieve body of WAP message. Result: (HRESULT).

Message #

DmWapPushService: Failed to retrieve body of WAP message. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 504: DmWapPushService: Successfully retrieved body of WAP message.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Successfully retrieved body of WAP message. Result: (HRESULT).

Message #

DmWapPushService: Successfully retrieved body of WAP message. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 505: DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (HexInt1).

Message #

DmWapPushService: The current value of SECPOLICY_WSPNOTIFICATIONS is: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Event ID 506: DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Error

Description

DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router. Result: (HexInt1).

Message #

DmWapPushService: Failed to register WNF with EventAggregator for WAP messages received by SMS Router. Result: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 506,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-15T23:43:24.011193+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 14788,
      "thread_id": 14400
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0xc002000b"
  },
  "message": ""
}

Event ID 507: DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router. Result: (HexInt1).

Message #

DmWapPushService: Successfully registered WNF with EventAggregator for WAP messages received by SMS Router. Result: (%1).

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 507,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736008+00:00",
    "event_record_id": 7325,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0"
  },
  "message": ""
}

Event ID 508: DmWapPushService: Callback to handle a new WAP message received.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Callback to handle a new WAP message received.

Message #

DmWapPushService: Callback to handle a new WAP message received.

Event ID 509: DmWapPushService: There are pending RPC clients currently.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: There are pending RPC clients currently.

Message #

DmWapPushService: There are pending RPC clients currently.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 509,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:01.369389+00:00",
    "event_record_id": 7367,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 510: DmWapPushService: No pending RPC clients remain.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: No pending RPC clients remain.

Message #

DmWapPushService: No pending RPC clients remain.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 510,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378179+00:00",
    "event_record_id": 7374,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 9048
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 511: DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (HexInt1) seconds.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (HexInt1) seconds.

Message #

DmWapPushService: Setting the timer to check if all RPC clients are handled to fire after (%1) seconds.

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 511,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:53:01.369414+00:00",
    "event_record_id": 7368,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x78"
  },
  "message": ""
}

Event ID 512: DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) seconds.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Idle timeout of DmWapPushService is currently set to (HexInt1) seconds.

Message #

DmWapPushService: Idle timeout of DmWapPushService is currently set to (%1) seconds.

Fields #

Name	Description
`HexInt1` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 512,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.374089+00:00",
    "event_record_id": 7319,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x78"
  },
  "message": ""
}

Event ID 513: DmWapPushService: Initialized idle stop-start for DmWapPushService.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Initialized idle stop-start for DmWapPushService.

Message #

DmWapPushService: Initialized idle stop-start for DmWapPushService.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 513,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379453+00:00",
    "event_record_id": 7379,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 514: DmWapPushService: Service status updated.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Service status updated. Current state: (HexInt1), Exit code: (HexInt2), Wait hint: (HexInt3).

Message #

DmWapPushService: Service status updated. Current state: (%1), Exit code: (%2), Wait hint: (%3).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32
`HexInt3` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 514,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379563+00:00",
    "event_record_id": 7381,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x1",
    "HexInt2": "0x0",
    "HexInt3": "0x0"
  },
  "message": ""
}

Event ID 515: DmWapPushService: Failed to initialize service.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to initialize service. Result: (HRESULT).

Message #

DmWapPushService: Failed to initialize service. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 516: DmWapPushService: Successfully initialized service.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Successfully initialized service. Result: (HRESULT).

Message #

DmWapPushService: Successfully initialized service. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 516,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.736031+00:00",
    "event_record_id": 7326,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 517: DmWapPushService: Failed to register service's RPC interface.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to register service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Failed to register service's RPC interface. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 518: DmWapPushService: Successfully registered service's RPC interface.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Successfully registered service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Successfully registered service's RPC interface. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 518,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738848+00:00",
    "event_record_id": 7330,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 519: DmWapPushService: Failed to uninitialize service.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to uninitialize service. Result: (HRESULT).

Message #

DmWapPushService: Failed to uninitialize service. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 520: DmWapPushService: Successfully uninitialized service.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Successfully uninitialized service. Result: (HRESULT).

Message #

DmWapPushService: Successfully uninitialized service. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 520,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.379544+00:00",
    "event_record_id": 7380,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 521: DmWapPushService: Failed to unregister service's RPC interface.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational

Description

DmWapPushService: Failed to unregister service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Failed to unregister service's RPC interface. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Event ID 522: DmWapPushService: Successfully unregistered service's RPC interface.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Successfully unregistered service's RPC interface. Result: (HRESULT).

Message #

DmWapPushService: Successfully unregistered service's RPC interface. Result: (%1).

Fields #

Name	Description
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 522,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:55:01.378914+00:00",
    "event_record_id": 7378,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 3304
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HRESULT": "0x0"
  },
  "message": ""
}

Event ID 523: DmWapPushService: Service handler invoked.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Service handler invoked. Opcode: (HexInt1), Current state: (HexInt2).

Message #

DmWapPushService: Service handler invoked. Opcode: (%1), Current state: (%2).

Fields #

Name	Description
`HexInt1` HexInt32
`HexInt2` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 523,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-11T23:52:08.830793+00:00",
    "event_record_id": 7132,
    "correlation": {},
    "execution": {
      "process_id": 6116,
      "thread_id": 8576
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x4",
    "HexInt2": "0x4"
  },
  "message": ""
}

Event ID 524: DmWapPushService: DmWapPushService is being initialized.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: DmWapPushService is being initialized.

Message #

DmWapPushService: DmWapPushService is being initialized.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 524,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.373899+00:00",
    "event_record_id": 7317,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 525: DmWapPushService: Stop Service handler registered.

Provider: Microsoft-Windows-DeviceManagement-Pushrouter
Channel: Operational
Level: Informational

Description

DmWapPushService: Stop Service handler registered. Status: (HexInt1), Result: (HRESULT).

Message #

DmWapPushService: Stop Service handler registered. Status: (%1), Result: (%2).

Fields #

Name	Description
`HexInt1` HexInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceManagement-Pushrouter",
    "guid": "F1201B5A-E170-42B6-8D20-B57AC57E6416",
    "event_source_name": "",
    "event_id": 525,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2026-03-12T02:51:01.738885+00:00",
    "event_record_id": 7331,
    "correlation": {},
    "execution": {
      "process_id": 3932,
      "thread_id": 2792
    },
    "channel": "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "HexInt1": "0x0",
    "HRESULT": "0x0"
  },
  "message": ""
}

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f1201b5a-e170-42b6-8d20-b57ac57e6416

Defined in dmpushroutercore.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3470, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)