detection.wiki

Microsoft-Windows-Folder Redirection

EventTitleChannelSampleRule
501Successfully applied policy and redirected folder "FromFolder" to "ToFolder".ApplicationNN
502Failed to apply policy and redirect folder "FromFolder" to "ToFolder".ApplicationNN
503Failed to create KnownFolderManager.ApplicationNN
505Failed to get destination path on policy removal for folder "Folder".ApplicationNN
506Failed to update policy state for folder "Folder".ApplicationNN
507Failed to delete policy state for folder "Folder".ApplicationNN
508Failed to resolve path for folder "Folder".ApplicationNN
509Failed to expand path for folder "Folder" path "Path".ApplicationNN
510The folder redirection policy hasn't been applied.ApplicationNN
511Failed to process policy info.ApplicationNN
512Successfully removed policy and redirected folder "FromFolder" to "ToFolder".ApplicationNN
513Failed to remove policy and redirect folder "FromFolder" to "ToFolder".ApplicationNN
514Successfully removed policy for folder "Folder".ApplicationNN
515Failed to remove policy for folder "Folder".ApplicationNN
516Successfully applied policy to keep folder "Folder" at the same location.ApplicationNN
517Failed to apply policy to keep folder "Folder" at the same location.ApplicationNN
1000Folder Redirection Group Policy extension started.OperationalNN
1001Folder Redirection Group Policy extension finished.OperationalNN
1002Group Policy flags=GPFlags.OperationalNN
1003Start Processing Group Policy Objects.OperationalNN
1004Processing configuration file "ConfigurationFile" .OperationalNN
1005Folder "Folder" was previously redirected.OperationalNN
1006Folder "Folder" has to be redirected.OperationalNN
1007No Folders were previously redirected.OperationalNN
1008No Folders have to be redirected.OperationalNN
1009Windows was unable to successfully evaluate whether this computer is a primary …OperationalNN
1010This computer Result a primary computer for this user.OperationalNN
1011Folder Redirection configuration is being controlled by Group Policy.OperationalNN
1012Folder Redirection configuration is being controlled by WMI configuration class …OperationalNN
1073742824Folder Redirection Group Policy extension started.OperationalNN
1073742825Folder Redirection Group Policy extension finished.OperationalNN
1073742826Group Policy flags=.OperationalNN
1073742827Start Processing Group Policy Objects .OperationalNN
1073742828Processing configuration file '{ConfigurationFile}' .OperationalNN
1073742829Folder '{Folder}' was previously redirected.OperationalNN
1073742830Folder '{Folder}' has to be redirected.OperationalNN
1073742831No Folders were previously redirected.OperationalNN
1073742832No Folders have to be redirected.OperationalNN
2147484158Folder redirection policy application has been delayed until the next logon …OperationalNN
3221225974Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'.OperationalNN
3221225975Failed to create KnownFolderManager.OperationalNN
3221225977Failed to get destination path on policy removal for folder '{Folder}'.OperationalNN
3221225978Failed to update policy state for folder '{Folder}'.OperationalNN
3221225979Failed to delete policy state for folder '{Folder}'.OperationalNN
3221225980Failed to resolve path for folder '{Folder}'.OperationalNN
3221225981Failed to expand path for folder '{Folder}' path '{Path}'.OperationalNN
3221225983Failed to process policy info.OperationalNN
3221225985Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'.OperationalNN
3221225987Failed to remove policy for folder '{Folder}'.OperationalNN
3221225989Failed to apply policy to keep folder '{Folder}' at the same location.OperationalNN

Event ID 501: Successfully applied policy and redirected folder "FromFolder" to "ToFolder".

#
Channel
Application

Message #

Successfully applied policy and redirected folder "%1" to "%2".
 Redirection options=%3.

Fields #

NameDescription
FromFolder UnicodeString
ToFolder UnicodeString
Options HexInt32

Event ID 502: Failed to apply policy and redirect folder "FromFolder" to "ToFolder".

#
Channel
Application

Message #

Failed to apply policy and redirect folder "%1" to "%2".
 Redirection options=%3.
 The following error occurred: "%4".
 Error details: "%5".

Fields #

NameDescription
FromFolder UnicodeString
ToFolder UnicodeString
Options HexInt32
Error UnicodeString
ErrorDetails UnicodeString

Event ID 503: Failed to create KnownFolderManager.

#
Channel
Application

Description

Failed to create KnownFolderManager. Folder redirection can not be performed.

Message #

Failed to create KnownFolderManager. Folder redirection can not be performed.
 Error details: "%1".

Fields #

NameDescription
ErrorDetails UnicodeString

Event ID 505: Failed to get destination path on policy removal for folder "Folder".

#
Channel
Application

Message #

Failed to get destination path on policy removal for folder "%1".
 The folder redirection can not be removed.
 Error details: "%2".

Fields #

NameDescription
Folder UnicodeString
ErrorDetails UnicodeString

Event ID 506: Failed to update policy state for folder "Folder".

#
Channel
Application

Message #

Failed to update policy state for folder "%1".
 Error details: "%2".

Fields #

NameDescription
Folder UnicodeString
ErrorDetails UnicodeString

Event ID 507: Failed to delete policy state for folder "Folder".

#
Channel
Application

Message #

Failed to delete policy state for folder "%1".
 Error details: "%2".

Fields #

NameDescription
Folder UnicodeString
ErrorDetails UnicodeString

Event ID 508: Failed to resolve path for folder "Folder".

#
Channel
Application

Message #

Failed to resolve path for folder "%1".
 Folder configuration is invalid or folder is configured to follow parent and the parent folder is not redirected. Folder can not be redirected.
 Error details: "%2".

Fields #

NameDescription
Folder UnicodeString
ErrorDetails UnicodeString

Event ID 509: Failed to expand path for folder "Folder" path "Path".

#
Channel
Application

Message #

Failed to expand path for folder "%1" path "%2".
 The folder can not be redirected.
 Error details: "%3".

Fields #

NameDescription
Folder UnicodeString
Path UnicodeString
ErrorDetails UnicodeString

Event ID 510: The folder redirection policy hasn't been applied.

#
Channel
Application

Description

The folder redirection policy hasn't been applied. It's been delayed until the next sign-in because the group policy sign-in optimization is in effect.

Message #

The folder redirection policy hasn't been applied. It's been delayed until the next sign-in because the group policy sign-in optimization is in effect.

Event ID 511: Failed to process policy info.

#
Channel
Application

Message #

Failed to process policy info.
 Error details: "%1".

Fields #

NameDescription
ErrorDetails UnicodeString

Event ID 512: Successfully removed policy and redirected folder "FromFolder" to "ToFolder".

#
Channel
Application

Message #

Successfully removed policy and redirected folder "%1" to "%2".
 Removal options=%3.

Fields #

NameDescription
FromFolder UnicodeString
ToFolder UnicodeString
Options HexInt32

Event ID 513: Failed to remove policy and redirect folder "FromFolder" to "ToFolder".

#
Channel
Application

Message #

Failed to remove policy and redirect folder "%1" to "%2".
 Removal options=%3.
 The following error occurred: "%4".
 Error details: "%5".

Fields #

NameDescription
FromFolder UnicodeString
ToFolder UnicodeString
Options HexInt32
Error UnicodeString
ErrorDetails UnicodeString

Event ID 514: Successfully removed policy for folder "Folder".

#
Channel
Application

Message #

Successfully removed policy for folder "%1".
 Removal options=%2.

Fields #

NameDescription
Folder UnicodeString
Options HexInt32

Event ID 515: Failed to remove policy for folder "Folder".

#
Channel
Application

Message #

Failed to remove policy for folder "%1".
 Removal options=%2.
 The following error occurred: "%3".
 Error details: "%4".

Fields #

NameDescription
Folder UnicodeString
Options HexInt32
Error UnicodeString
ErrorDetails UnicodeString

Event ID 516: Successfully applied policy to keep folder "Folder" at the same location.

#
Channel
Application

Message #

Successfully applied policy to keep folder "%1" at the same location.
 Redirection options=%2.

Fields #

NameDescription
Folder UnicodeString
Options HexInt32

Event ID 517: Failed to apply policy to keep folder "Folder" at the same location.

#
Channel
Application

Message #

Failed to apply policy to keep folder "%1" at the same location.
 Redirection options=%2.
 The following error occurred: "%3".
 Error details: "%4".

Fields #

NameDescription
Folder UnicodeString
Options HexInt32
Error UnicodeString
ErrorDetails UnicodeString

Event ID 1000: Folder Redirection Group Policy extension started.

#
Channel
Operational

Event ID 1001: Folder Redirection Group Policy extension finished.

#
Channel
Operational

Event ID 1002: Group Policy flags=GPFlags.

#
Channel
Operational

Message #

Group Policy flags=%1.

Fields #

NameDescription
GPFlags HexInt32

Event ID 1003: Start Processing Group Policy Objects.

#
Channel
Operational

Event ID 1004: Processing configuration file "ConfigurationFile" .

#
Channel
Operational

Message #

Processing configuration file "%1" ...

Fields #

NameDescription
ConfigurationFile UnicodeString

Event ID 1005: Folder "Folder" was previously redirected.

#
Channel
Operational

Message #

Folder "%1" was previously redirected.
 Redirection options were = %2

Fields #

NameDescription
Folder UnicodeString
Options HexInt32

Event ID 1006: Folder "Folder" has to be redirected.

#
Channel
Operational

Message #

Folder "%1" has to be redirected.
 Redirection options = %2.
 Parent folder = "%3".
 Path = "%4".
 Group = %5.

Fields #

NameDescription
Folder UnicodeString
Options HexInt32
ParentFolder UnicodeString
Path UnicodeString
Group UnicodeString

Event ID 1007: No Folders were previously redirected.

#
Channel
Operational

Event ID 1008: No Folders have to be redirected.

#
Channel
Operational

Event ID 1009: Windows was unable to successfully evaluate whether this computer is a primary computer for this user.

#
Channel
Operational

Description

Windows was unable to successfully evaluate whether this computer is a primary computer for this user. This may be due to failing to access the Active Directory server at this time. The user will have his or her redirected folders configured on this machine. Contact the Administrator for more assistance. Error: Error

Message #

Windows was unable to successfully evaluate whether this computer is a primary computer for this user. This may be due to failing to access the Active Directory server at this time. The user will have his or her redirected folders configured on this machine. Contact the Administrator for more assistance. Error: %1

Fields #

NameDescription
Error HexInt32

Event ID 1010: This computer Result a primary computer for this user.

#
Channel
Operational

Message #

This computer %1 a primary computer for this user.

Fields #

NameDescription
Result UnicodeString

Event ID 1011: Folder Redirection configuration is being controlled by Group Policy.

#
Channel
Operational

Event ID 1012: Folder Redirection configuration is being controlled by WMI configuration class Win32_FolderRedirectionUserConfiguration.

#
Channel
Operational

Event ID 1073742824: Folder Redirection Group Policy extension started.

#
Channel
Operational

Event ID 1073742825: Folder Redirection Group Policy extension finished.

#
Channel
Operational

Event ID 1073742826: Group Policy flags=.

#
Channel
Operational

Description

Group Policy flags={GPFlags}.

Message #

Group Policy flags={GPFlags}.

Fields #

NameDescription
GPFlags

Event ID 1073742827: Start Processing Group Policy Objects .

#
Channel
Operational

Event ID 1073742828: Processing configuration file '{ConfigurationFile}' .

#
Channel
Operational

Fields #

NameDescription
ConfigurationFile

Event ID 1073742829: Folder '{Folder}' was previously redirected.

#
Channel
Operational

Description

Folder '{Folder}' was previously redirected. Redirection options were = {Options}.

Message #

Folder '{Folder}' was previously redirected. Redirection options were = {Options}

Fields #

NameDescription
Folder
Options

Event ID 1073742830: Folder '{Folder}' has to be redirected.

#
Channel
Operational

Description

Folder '{Folder}' has to be redirected. Redirection options = {Options}. Parent folder = '{ParentFolder}'. Path = '{Path}'. Group = {Group}.

Message #

Folder '{Folder}' has to be redirected. Redirection options = {Options}. Parent folder = '{ParentFolder}'. Path = '{Path}'. Group = {Group}.

Fields #

NameDescription
Folder
Options
ParentFolder
Path
Group

Event ID 1073742831: No Folders were previously redirected.

#
Channel
Operational

Event ID 1073742832: No Folders have to be redirected.

#
Channel
Operational

Event ID 2147484158: Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect.

#
Channel
Operational

Event ID 3221225974: Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'.

#
Channel
Operational

Description

Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to apply policy and redirect folder '{FromFolder}' to '{ToFolder}'. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
FromFolder
ToFolder
Options
Error
ErrorDetails

Event ID 3221225975: Failed to create KnownFolderManager.

#
Channel
Operational

Description

Failed to create KnownFolderManager. Folder redirection can not be performed. Error details: '{ErrorDetails}'.

Message #

Failed to create KnownFolderManager. Folder redirection can not be performed. Error details: '{ErrorDetails}'.

Fields #

NameDescription
ErrorDetails

Event ID 3221225977: Failed to get destination path on policy removal for folder '{Folder}'.

#
Channel
Operational

Description

Failed to get destination path on policy removal for folder '{Folder}'. The folder redirection can not be removed. Error details: '{ErrorDetails}'.

Message #

Failed to get destination path on policy removal for folder '{Folder}'. The folder redirection can not be removed. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
ErrorDetails

Event ID 3221225978: Failed to update policy state for folder '{Folder}'.

#
Channel
Operational

Description

Failed to update policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Message #

Failed to update policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
ErrorDetails

Event ID 3221225979: Failed to delete policy state for folder '{Folder}'.

#
Channel
Operational

Description

Failed to delete policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Message #

Failed to delete policy state for folder '{Folder}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
ErrorDetails

Event ID 3221225980: Failed to resolve path for folder '{Folder}'.

#
Channel
Operational

Message #

Failed to resolve path for folder '{Folder}'. Folder configuration is invalid or folder is configured to follow parent and the parent folder is not redirected. Folder can not be redirected. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
ErrorDetails

Event ID 3221225981: Failed to expand path for folder '{Folder}' path '{Path}'.

#
Channel
Operational

Description

Failed to expand path for folder '{Folder}' path '{Path}'. The folder can not be redirected. Error details: '{ErrorDetails}'.

Message #

Failed to expand path for folder '{Folder}' path '{Path}'. The folder can not be redirected. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
Path
ErrorDetails

Event ID 3221225983: Failed to process policy info.

#
Channel
Operational

Description

Failed to process policy info. Error details: '{ErrorDetails}'.

Message #

Failed to process policy info. Error details: '{ErrorDetails}'.

Fields #

NameDescription
ErrorDetails

Event ID 3221225985: Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'.

#
Channel
Operational

Description

Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to remove policy and redirect folder '{FromFolder}' to '{ToFolder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
FromFolder
ToFolder
Options
Error
ErrorDetails

Event ID 3221225987: Failed to remove policy for folder '{Folder}'.

#
Channel
Operational

Description

Failed to remove policy for folder '{Folder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to remove policy for folder '{Folder}'. Removal options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
Options
Error
ErrorDetails

Event ID 3221225989: Failed to apply policy to keep folder '{Folder}' at the same location.

#
Channel
Operational

Description

Failed to apply policy to keep folder '{Folder}' at the same location. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Message #

Failed to apply policy to keep folder '{Folder}' at the same location. Redirection options={Options}. The following error occurred: '{Error}'. Error details: '{ErrorDetails}'.

Fields #

NameDescription
Folder
Options
Error
ErrorDetails

Provenance

ETW provider GUID 7d7b0c39-93f6-4100-bd96-4dda859652c5

Defined in fdeploy.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02