Microsoft-Windows-Help

Event	Title	Channel	Sample	Rule
52	NavigateBackStart	Operational	N	N
53	NavigateBackStop	Operational	N	N
54	DisplaySearchStart	Operational	N	N
55	DisplaySearchStop	Operational	N	N
56	DisplayTOCStart	Operational	N	N
57	DisplayTOCStop	Operational	N	N
58	ApplicationStartupStart	Operational	N	N
59	ApplicationStartupStop	Operational	N	N
60	ApplicationShutDownStart	Operational	N	N
61	ApplicationShutDownStop	Operational	N	N
62	LaunchStart	Operational	N	N
63	LaunchStop	Operational	N	N
100	NavigationStart	Operational	N	N
101	NavigationStop	Operational	N	N
102	ContentSessionDataRetrievalStart	Operational	N	N
103	ContentSessionDataRetrievalStop	Operational	N	N
104	SearchSessionDataRetrievalStart	Operational	N	N
105	SearchSessionDataRetrievalStop	Operational	N	N
106	TOCSessionDataRetrievalStart	Operational	N	N
107	TOCSessionDataRetrievalStop	Operational	N	N
108	TransformStart	Operational	N	N
109	TransformStop	Operational	N	N
110	TransformStart110	Operational	N	N
111	TransformStop111	Operational	N	N
112	TransformStart112	Operational	N	N
113	TransformStop113	Operational	N	N
114	RenderStart	Operational	N	N
115	RenderStop	Operational	N	N
116	ContentFilterStart	Operational	N	N
117	ContentFilterStop	Operational	N	N
118	ReusableTextStart	Operational	N	N
119	ReusableTextStop	Operational	N	N
120	KeywordMergeStart	Operational	N	N
121	KeywordMergeStop	Operational	N	N
122	TOCMergeStart	Operational	N	N
123	TOCMergeStop	Operational	N	N
124	FullTextMergeStart	Operational	N	N
125	FullTextMergeStop	Operational	N	N
126	GlobalMergeStart	Operational	N	N
127	GlobalMergeStop	Operational	N	N
128	ExpandCollapseStart	Operational	N	N
129	ExpandCollapseStop	Operational	N	N
130	PopupStart	Operational	N	N
131	PopupStop	Operational	N	N
132	ContentOnlineDataRetrievalStart	Operational	N	N
133	ContentOnlineDataRetrievalStop	Operational	N	N
134	AsyncSearchDataRetrievalStart	Operational	N	N
135	AsyncSearchDataRetrievalStop	Operational	N	N
136	TOCOnlineDataRetrievalStart	Operational	N	N
137	TOCOnlineDataRetrievalStop	Operational	N	N
138	WriteCharMapStart	Operational	N	N
139	WriteCharMapStop	Operational	N	N
140	LaunchShortcutStart	Operational	N	N
141	LaunchShortcutStop	Operational	N	N
142	PageCustomizationStart	Operational	N	N
143	PageCustomizationStop	Operational	N	N
144	WOTSSearchStart	Operational	N	N
145	WOTSSearchStop	Operational	N	N
146	LocalWindowsContentSearchStart	Operational	N	N
147	LocalWindowsContentSearchStop	Operational	N	N
148	LocalOEMContentSearchStart	Operational	N	N
149	LocalOEMContentSearchStop	Operational	N	N
200	NonPerfEvents	Operational	N	N
201	NonPerfEvents201	Operational	N	N
202	NonPerfEvents202	Operational	N	N
203	NonPerfEvents203	Operational	N	N
204	NonPerfEvents204	Operational	N	N
205	NonPerfEvents205	Operational	N	N
206	NonPerfEvents206	Operational	N	N
207	NonPerfEvents207	Operational	N	N
208	NonPerfEvents208	Operational	N	N
209	NonPerfEvents209	Operational	N	N
210	NonPerfEvents210	Operational	N	N
211	NonPerfEvents211	Operational	N	N
212	NonPerfEvents212	Operational	N	N
213	NonPerfEvents213	Operational	N	N
214	NonPerfEvents214	Operational	N	N
215	NonPerfEvents215	Operational	N	N
216	NonPerfEvents216	Operational	N	N
217	NonPerfEvents217	Operational	N	N
218	NonPerfEvents218	Operational	N	N
219	NonPerfEvents219	Operational	N	N
220	NonPerfEvents220	Operational	N	N
221	NonPerfEvents221	Operational	N	N
222	NonPerfEvents222	Operational	N	N
223	NonPerfEvents223	Operational	N	N
224	NonPerfEvents224	Operational	N	N
225	NonPerfEvents225	Operational	N	N
226	NonPerfEvents226	Operational	N	N
227	NonPerfEvents227	Operational	N	N
228	NonPerfEvents228	Operational	N	N
229	NonPerfEvents229	Operational	N	N
230	NonPerfEvents230	Operational	N	N
231	NonPerfEvents231	Operational	N	N
232	NonPerfEvents232	Operational	N	N
233	NonPerfEvents233	Operational	N	N
1000	Index merge failed	Operational	N	N
1001	Connection to the server could not be established	Operational	N	N
1002	Topic navigation failed	Operational	N	N
1003	Data storage is not accessible	Operational	N	N
1004	Registry key for user settings was not found and could not be created	Operational	N	N
1005	HelpPaneServer could not be CoCreated	Operational	N	N
1010	Browser control could not be created	Operational	N	N
1011	Browser control could not be embedded	Operational	N	N
1012	Browser control could not be activated	Operational	N	N
1013	Failed to attach to browser event connection points	Operational	N	N
1020	Local search failed	Operational	N	N
1021	Online search failed	Operational	N	N
1022	Online server search response is not valid	Operational	N	N
1023	Online TOC root is not valid	Operational	N	N
1024	Online TOC request failed	Operational	N	N
1025	Online server TOC response is not valid	Operational	N	N
1026	Local TOC (Collection) is not valid	Operational	N	N
1027	H1Q load failed	Operational	N	N
1028	H1Q load succeeded	Operational	N	N
1029	Cound not find H1Q	Operational	N	N
1030	Online HTTP data retrieval failed	Operational	N	N
1040	XML Load failed	Operational	N	N
1041	XML Transform failed	Operational	N	N
1042	XML Parser failed to initialize	Operational	N	N
2000	Group policy found and loaded successfully	Operational	N	N
2001	Content merge was started	Operational	N	N
2002	Content merge was completed successfully	Operational	N	N
2003	Content merge was cancelled by the user	Operational	N	N
2004	Content merge failed	Operational	N	N
2005	Access Denied	Operational	N	N

Event ID 52: NavigateBackStart

Channel: Operational
Task: NavigateBack
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 53: NavigateBackStop

Channel: Operational
Task: NavigateBack
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 54: DisplaySearchStart

Channel: Operational
Task: DisplaySearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 55: DisplaySearchStop

Channel: Operational
Task: DisplaySearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 56: DisplayTOCStart

Channel: Operational
Task: DisplayTOC
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 57: DisplayTOCStop

Channel: Operational
Task: DisplayTOC
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 58: ApplicationStartupStart

Channel: Operational
Task: ApplicationStartup
Opcode: Start

Event ID 59: ApplicationStartupStop

Channel: Operational
Task: ApplicationStartup
Opcode: Stop

Event ID 60: ApplicationShutDownStart

Channel: Operational
Task: ApplicationShutDown
Opcode: Start

Event ID 61: ApplicationShutDownStop

Channel: Operational
Task: ApplicationShutDown
Opcode: Stop

Event ID 62: LaunchStart

Channel: Operational
Task: Launch
Opcode: Start

Fields #

Name	Description
`sessionid` UInt32

Event ID 63: LaunchStop

Channel: Operational
Task: Launch
Opcode: Stop

Fields #

Name	Description
`sessionid` UInt32

Event ID 100: NavigationStart

Channel: Operational
Task: Navigation
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 101: NavigationStop

Channel: Operational
Task: Navigation
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 102: ContentSessionDataRetrievalStart

Channel: Operational
Task: ContentSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 103: ContentSessionDataRetrievalStop

Channel: Operational
Task: ContentSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 104: SearchSessionDataRetrievalStart

Channel: Operational
Task: SearchSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 105: SearchSessionDataRetrievalStop

Channel: Operational
Task: SearchSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 106: TOCSessionDataRetrievalStart

Channel: Operational
Task: TOCSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 107: TOCSessionDataRetrievalStop

Channel: Operational
Task: TOCSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 108: TransformStart

Channel: Operational
Task: Transform
Opcode: Start

Event ID 109: TransformStop

Channel: Operational
Task: Transform
Opcode: Stop

Event ID 110: TransformStart110

Channel: Operational
Task: Transform
Opcode: Start

Event ID 111: TransformStop111

Channel: Operational
Task: Transform
Opcode: Stop

Event ID 112: TransformStart112

Channel: Operational
Task: Transform
Opcode: Start

Event ID 113: TransformStop113

Channel: Operational
Task: Transform
Opcode: Stop

Event ID 114: RenderStart

Channel: Operational
Task: Render
Opcode: Start

Event ID 115: RenderStop

Channel: Operational
Task: Render
Opcode: Stop

Event ID 116: ContentFilterStart

Channel: Operational
Task: ContentFilter
Opcode: Start

Event ID 117: ContentFilterStop

Channel: Operational
Task: ContentFilter
Opcode: Stop

Event ID 118: ReusableTextStart

Channel: Operational
Task: ReusableText
Opcode: Start

Event ID 119: ReusableTextStop

Channel: Operational
Task: ReusableText
Opcode: Stop

Event ID 120: KeywordMergeStart

Channel: Operational
Task: KeywordMerge
Opcode: Start

Event ID 121: KeywordMergeStop

Channel: Operational
Task: KeywordMerge
Opcode: Stop

Event ID 122: TOCMergeStart

Channel: Operational
Task: TOCMerge
Opcode: Start

Event ID 123: TOCMergeStop

Channel: Operational
Task: TOCMerge
Opcode: Stop

Event ID 124: FullTextMergeStart

Channel: Operational
Task: FullTextMerge
Opcode: Start

Event ID 125: FullTextMergeStop

Channel: Operational
Task: FullTextMerge
Opcode: Stop

Event ID 126: GlobalMergeStart

Channel: Operational
Task: GlobalMerge
Opcode: Start

Event ID 127: GlobalMergeStop

Channel: Operational
Task: GlobalMerge
Opcode: Stop

Event ID 128: ExpandCollapseStart

Channel: Operational
Task: ExpandCollapse
Opcode: Start

Event ID 129: ExpandCollapseStop

Channel: Operational
Task: ExpandCollapse
Opcode: Stop

Event ID 130: PopupStart

Channel: Operational
Task: Popup
Opcode: Start

Event ID 131: PopupStop

Channel: Operational
Task: Popup
Opcode: Stop

Event ID 132: ContentOnlineDataRetrievalStart

Channel: Operational
Task: ContentOnlineDataRetrieval
Opcode: Start

Event ID 133: ContentOnlineDataRetrievalStop

Channel: Operational
Task: ContentOnlineDataRetrieval
Opcode: Stop

Event ID 134: AsyncSearchDataRetrievalStart

Channel: Operational
Task: AsyncSearchDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 135: AsyncSearchDataRetrievalStop

Channel: Operational
Task: AsyncSearchDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 136: TOCOnlineDataRetrievalStart

Channel: Operational
Task: TOCOnlineDataRetrieval
Opcode: Start

Event ID 137: TOCOnlineDataRetrievalStop

Channel: Operational
Task: TOCOnlineDataRetrieval
Opcode: Stop

Event ID 138: WriteCharMapStart

Channel: Operational
Task: WriteCharMap
Opcode: Start

Event ID 139: WriteCharMapStop

Channel: Operational
Task: WriteCharMap
Opcode: Stop

Event ID 140: LaunchShortcutStart

Channel: Operational
Task: LaunchShortcut
Opcode: Start

Event ID 141: LaunchShortcutStop

Channel: Operational
Task: LaunchShortcut
Opcode: Stop

Event ID 142: PageCustomizationStart

Channel: Operational
Task: PageCustomization
Opcode: Start

Event ID 143: PageCustomizationStop

Channel: Operational
Task: PageCustomization
Opcode: Stop

Event ID 144: WOTSSearchStart

Channel: Operational
Task: WOTSSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 145: WOTSSearchStop

Channel: Operational
Task: WOTSSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 146: LocalWindowsContentSearchStart

Channel: Operational
Task: LocalWindowsContentSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 147: LocalWindowsContentSearchStop

Channel: Operational
Task: LocalWindowsContentSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 148: LocalOEMContentSearchStart

Channel: Operational
Task: LocalOEMContentSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 149: LocalOEMContentSearchStop

Channel: Operational
Task: LocalOEMContentSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 200: NonPerfEvents

Channel: Operational
Task: NonPerfEvents

Event ID 201: NonPerfEvents201

Channel: Operational
Task: NonPerfEvents

Event ID 202: NonPerfEvents202

Channel: Operational
Task: NonPerfEvents

Event ID 203: NonPerfEvents203

Channel: Operational
Task: NonPerfEvents

Event ID 204: NonPerfEvents204

Channel: Operational
Task: NonPerfEvents

Event ID 205: NonPerfEvents205

Channel: Operational
Task: NonPerfEvents

Event ID 206: NonPerfEvents206

Channel: Operational
Task: NonPerfEvents

Event ID 207: NonPerfEvents207

Channel: Operational
Task: NonPerfEvents

Event ID 208: NonPerfEvents208

Channel: Operational
Task: NonPerfEvents

Event ID 209: NonPerfEvents209

Channel: Operational
Task: NonPerfEvents

Event ID 210: NonPerfEvents210

Channel: Operational
Task: NonPerfEvents

Event ID 211: NonPerfEvents211

Channel: Operational
Task: NonPerfEvents

Event ID 212: NonPerfEvents212

Channel: Operational
Task: NonPerfEvents

Event ID 213: NonPerfEvents213

Channel: Operational
Task: NonPerfEvents

Event ID 214: NonPerfEvents214

Channel: Operational
Task: NonPerfEvents

Event ID 215: NonPerfEvents215

Channel: Operational
Task: NonPerfEvents

Event ID 216: NonPerfEvents216

Channel: Operational
Task: NonPerfEvents

Event ID 217: NonPerfEvents217

Channel: Operational
Task: NonPerfEvents

Event ID 218: NonPerfEvents218

Channel: Operational
Task: NonPerfEvents

Event ID 219: NonPerfEvents219

Channel: Operational
Task: NonPerfEvents

Event ID 220: NonPerfEvents220

Channel: Operational
Task: NonPerfEvents

Event ID 221: NonPerfEvents221

Channel: Operational
Task: NonPerfEvents

Event ID 222: NonPerfEvents222

Channel: Operational
Task: NonPerfEvents

Event ID 223: NonPerfEvents223

Channel: Operational
Task: NonPerfEvents

Event ID 224: NonPerfEvents224

Channel: Operational
Task: NonPerfEvents

Event ID 225: NonPerfEvents225

Channel: Operational
Task: NonPerfEvents

Event ID 226: NonPerfEvents226

Channel: Operational
Task: NonPerfEvents

Event ID 227: NonPerfEvents227

Channel: Operational
Task: NonPerfEvents

Event ID 228: NonPerfEvents228

Channel: Operational
Task: NonPerfEvents

Event ID 229: NonPerfEvents229

Channel: Operational
Task: NonPerfEvents

Event ID 230: NonPerfEvents230

Channel: Operational
Task: NonPerfEvents

Event ID 231: NonPerfEvents231

Channel: Operational
Task: NonPerfEvents

Event ID 232: NonPerfEvents232

Channel: Operational
Task: NonPerfEvents

Event ID 233: NonPerfEvents233

Channel: Operational
Task: NonPerfEvents

Event ID 1000: Index merge failed

Channel: Operational
Task: NonPerfEvents

Event ID 1001: Connection to the server could not be established

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`cause` UnicodeString
`url` UnicodeString

Event ID 1002: Topic navigation failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`url` UnicodeString

Event ID 1003: Data storage is not accessible

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1004: Registry key for user settings was not found and could not be created

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1005: HelpPaneServer could not be CoCreated

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1010: Browser control could not be created

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1011: Browser control could not be embedded

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1012: Browser control could not be activated

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1013: Failed to attach to browser event connection points

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1020: Local search failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1021: Online search failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1022: Online server search response is not valid

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 1023: Online TOC root is not valid

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1024: Online TOC request failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1025: Online server TOC response is not valid

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 1026: Local TOC (Collection) is not valid

Channel: Operational
Task: NonPerfEvents

Event ID 1027: H1Q load failed

Channel: Operational

Event ID 1028: H1Q load succeeded

Channel: Operational

Event ID 1029: Cound not find H1Q

Channel: Operational

Event ID 1030: Online HTTP data retrieval failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`Win32LastError` UInt32

Event ID 1040: XML Load failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Message` UnicodeString
`Url` UnicodeString
`SrcText` UnicodeString
`Reason` UnicodeString
`ErrorCode` UInt32

Event ID 1041: XML Transform failed

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`Message` UnicodeString
`SrcText` UnicodeString
`Description` UnicodeString
`ErrorCode` UInt32

Event ID 1042: XML Parser failed to initialize

Channel: Operational
Task: NonPerfEvents

Event ID 2000: Group policy found and loaded successfully

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`policy` UnicodeString

Event ID 2001: Content merge was started

Channel: Operational
Task: NonPerfEvents
Opcode: Start

Event ID 2002: Content merge was completed successfully

Channel: Operational
Task: NonPerfEvents
Opcode: Stop

Event ID 2003: Content merge was cancelled by the user

Channel: Operational
Task: NonPerfEvents
Opcode: Suspend

Event ID 2004: Content merge failed

Channel: Operational
Task: NonPerfEvents
Opcode: Suspend

Event ID 2005: Access Denied

Channel: Operational
Task: NonPerfEvents

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Provenance

ETW provider GUID de513a55-c345-438b-9a74-e18cac5c5cc5

Defined in apds.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB