Microsoft-Windows-Help

126 events across 1 channel

Event	Title	Channel	Sample
52	NavigateBackStart	Operational	N
53	NavigateBackStop	Operational	N
54	DisplaySearchStart	Operational	N
55	DisplaySearchStop	Operational	N
56	DisplayTOCStart	Operational	N
57	DisplayTOCStop	Operational	N
58	ApplicationStartupStart	Operational	N
59	ApplicationStartupStop	Operational	N
60	ApplicationShutDownStart	Operational	N
61	ApplicationShutDownStop	Operational	N
62	LaunchStart	Operational	N
63	LaunchStop	Operational	N
100	NavigationStart	Operational	N
101	NavigationStop	Operational	N
102	ContentSessionDataRetrievalStart	Operational	N
103	ContentSessionDataRetrievalStop	Operational	N
104	SearchSessionDataRetrievalStart	Operational	N
105	SearchSessionDataRetrievalStop	Operational	N
106	TOCSessionDataRetrievalStart	Operational	N
107	TOCSessionDataRetrievalStop	Operational	N
108	TransformStart	Operational	N
109	TransformStop	Operational	N
110	TransformStart110	Operational	N
111	TransformStop111	Operational	N
112	TransformStart112	Operational	N
113	TransformStop113	Operational	N
114	RenderStart	Operational	N
115	RenderStop	Operational	N
116	ContentFilterStart	Operational	N
117	ContentFilterStop	Operational	N
118	ReusableTextStart	Operational	N
119	ReusableTextStop	Operational	N
120	KeywordMergeStart	Operational	N
121	KeywordMergeStop	Operational	N
122	TOCMergeStart	Operational	N
123	TOCMergeStop	Operational	N
124	FullTextMergeStart	Operational	N
125	FullTextMergeStop	Operational	N
126	GlobalMergeStart	Operational	N
127	GlobalMergeStop	Operational	N
128	ExpandCollapseStart	Operational	N
129	ExpandCollapseStop	Operational	N
130	PopupStart	Operational	N
131	PopupStop	Operational	N
132	ContentOnlineDataRetrievalStart	Operational	N
133	ContentOnlineDataRetrievalStop	Operational	N
134	AsyncSearchDataRetrievalStart	Operational	N
135	AsyncSearchDataRetrievalStop	Operational	N
136	TOCOnlineDataRetrievalStart	Operational	N
137	TOCOnlineDataRetrievalStop	Operational	N
138	WriteCharMapStart	Operational	N
139	WriteCharMapStop	Operational	N
140	LaunchShortcutStart	Operational	N
141	LaunchShortcutStop	Operational	N
142	PageCustomizationStart	Operational	N
143	PageCustomizationStop	Operational	N
144	WOTSSearchStart	Operational	N
145	WOTSSearchStop	Operational	N
146	LocalWindowsContentSearchStart	Operational	N
147	LocalWindowsContentSearchStop	Operational	N
148	LocalOEMContentSearchStart	Operational	N
149	LocalOEMContentSearchStop	Operational	N
200	NonPerfEvents	Operational	N
201	NonPerfEvents201	Operational	N
202	NonPerfEvents202	Operational	N
203	NonPerfEvents203	Operational	N
204	NonPerfEvents204	Operational	N
205	NonPerfEvents205	Operational	N
206	NonPerfEvents206	Operational	N
207	NonPerfEvents207	Operational	N
208	NonPerfEvents208	Operational	N
209	NonPerfEvents209	Operational	N
210	NonPerfEvents210	Operational	N
211	NonPerfEvents211	Operational	N
212	NonPerfEvents212	Operational	N
213	NonPerfEvents213	Operational	N
214	NonPerfEvents214	Operational	N
215	NonPerfEvents215	Operational	N
216	NonPerfEvents216	Operational	N
217	NonPerfEvents217	Operational	N
218	NonPerfEvents218	Operational	N
219	NonPerfEvents219	Operational	N
220	NonPerfEvents220	Operational	N
221	NonPerfEvents221	Operational	N
222	NonPerfEvents222	Operational	N
223	NonPerfEvents223	Operational	N
224	NonPerfEvents224	Operational	N
225	NonPerfEvents225	Operational	N
226	NonPerfEvents226	Operational	N
227	NonPerfEvents227	Operational	N
228	NonPerfEvents228	Operational	N
229	NonPerfEvents229	Operational	N
230	NonPerfEvents230	Operational	N
231	NonPerfEvents231	Operational	N
232	NonPerfEvents232	Operational	N
233	NonPerfEvents233	Operational	N
1000	Index merge failed	Operational	N
1001	Connection to the server could not be established	Operational	N
1002	Topic navigation failed	Operational	N
1003	Data storage is not accessible	Operational	N
1004	Registry key for user settings was not found and could not be created	Operational	N
1005	HelpPaneServer could not be CoCreated	Operational	N
1010	Browser control could not be created	Operational	N
1011	Browser control could not be embedded	Operational	N
1012	Browser control could not be activated	Operational	N
1013	Failed to attach to browser event connection points	Operational	N
1020	Local search failed	Operational	N
1021	Online search failed	Operational	N
1022	Online server search response is not valid	Operational	N
1023	Online TOC root is not valid	Operational	N
1024	Online TOC request failed	Operational	N
1025	Online server TOC response is not valid	Operational	N
1026	Local TOC (Collection) is not valid	Operational	N
1027	H1Q load failed	Operational	N
1028	H1Q load succeeded	Operational	N
1029	Cound not find H1Q	Operational	N
1030	Online HTTP data retrieval failed	Operational	N
1040	XML Load failed	Operational	N
1041	XML Transform failed	Operational	N
1042	XML Parser failed to initialize	Operational	N
2000	Group policy found and loaded successfully	Operational	N
2001	Content merge was started	Operational	N
2002	Content merge was completed successfully	Operational	N
2003	Content merge was cancelled by the user	Operational	N
2004	Content merge failed	Operational	N
2005	Access Denied	Operational	N

Event ID 52: NavigateBackStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NavigateBack
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 53: NavigateBackStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NavigateBack
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 54: DisplaySearchStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: DisplaySearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 55: DisplaySearchStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: DisplaySearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 56: DisplayTOCStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: DisplayTOC
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 57: DisplayTOCStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: DisplayTOC
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 58: ApplicationStartupStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ApplicationStartup
Opcode: Start

Event ID 59: ApplicationStartupStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ApplicationStartup
Opcode: Stop

Event ID 60: ApplicationShutDownStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ApplicationShutDown
Opcode: Start

Event ID 61: ApplicationShutDownStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ApplicationShutDown
Opcode: Stop

Event ID 62: LaunchStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Launch
Opcode: Start

Fields #

Name	Description
`sessionid` UInt32

Event ID 63: LaunchStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Launch
Opcode: Stop

Fields #

Name	Description
`sessionid` UInt32

Event ID 100: NavigationStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Navigation
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 101: NavigationStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Navigation
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 102: ContentSessionDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 103: ContentSessionDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 104: SearchSessionDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: SearchSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 105: SearchSessionDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: SearchSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 106: TOCSessionDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCSessionDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 107: TOCSessionDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCSessionDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 108: TransformStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Start

Event ID 109: TransformStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Stop

Event ID 110: TransformStart110

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Start

Event ID 111: TransformStop111

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Stop

Event ID 112: TransformStart112

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Start

Event ID 113: TransformStop113

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Transform
Opcode: Stop

Event ID 114: RenderStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Render
Opcode: Start

Event ID 115: RenderStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Render
Opcode: Stop

Event ID 116: ContentFilterStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentFilter
Opcode: Start

Event ID 117: ContentFilterStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentFilter
Opcode: Stop

Event ID 118: ReusableTextStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ReusableText
Opcode: Start

Event ID 119: ReusableTextStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ReusableText
Opcode: Stop

Event ID 120: KeywordMergeStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: KeywordMerge
Opcode: Start

Event ID 121: KeywordMergeStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: KeywordMerge
Opcode: Stop

Event ID 122: TOCMergeStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCMerge
Opcode: Start

Event ID 123: TOCMergeStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCMerge
Opcode: Stop

Event ID 124: FullTextMergeStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: FullTextMerge
Opcode: Start

Event ID 125: FullTextMergeStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: FullTextMerge
Opcode: Stop

Event ID 126: GlobalMergeStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: GlobalMerge
Opcode: Start

Event ID 127: GlobalMergeStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: GlobalMerge
Opcode: Stop

Event ID 128: ExpandCollapseStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ExpandCollapse
Opcode: Start

Event ID 129: ExpandCollapseStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ExpandCollapse
Opcode: Stop

Event ID 130: PopupStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Popup
Opcode: Start

Event ID 131: PopupStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: Popup
Opcode: Stop

Event ID 132: ContentOnlineDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentOnlineDataRetrieval
Opcode: Start

Event ID 133: ContentOnlineDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: ContentOnlineDataRetrieval
Opcode: Stop

Event ID 134: AsyncSearchDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: AsyncSearchDataRetrieval
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 135: AsyncSearchDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: AsyncSearchDataRetrieval
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 136: TOCOnlineDataRetrievalStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCOnlineDataRetrieval
Opcode: Start

Event ID 137: TOCOnlineDataRetrievalStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: TOCOnlineDataRetrieval
Opcode: Stop

Event ID 138: WriteCharMapStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: WriteCharMap
Opcode: Start

Event ID 139: WriteCharMapStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: WriteCharMap
Opcode: Stop

Event ID 140: LaunchShortcutStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LaunchShortcut
Opcode: Start

Event ID 141: LaunchShortcutStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LaunchShortcut
Opcode: Stop

Event ID 142: PageCustomizationStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: PageCustomization
Opcode: Start

Event ID 143: PageCustomizationStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: PageCustomization
Opcode: Stop

Event ID 144: WOTSSearchStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: WOTSSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 145: WOTSSearchStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: WOTSSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 146: LocalWindowsContentSearchStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LocalWindowsContentSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 147: LocalWindowsContentSearchStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LocalWindowsContentSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 148: LocalOEMContentSearchStart

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LocalOEMContentSearch
Opcode: Start

Fields #

Name	Description
`url` UnicodeString

Event ID 149: LocalOEMContentSearchStop

Provider: Microsoft-Windows-Help
Channel: Operational
Task: LocalOEMContentSearch
Opcode: Stop

Fields #

Name	Description
`url` UnicodeString

Event ID 200: NonPerfEvents

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 201: NonPerfEvents201

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 202: NonPerfEvents202

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 203: NonPerfEvents203

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 204: NonPerfEvents204

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 205: NonPerfEvents205

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 206: NonPerfEvents206

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 207: NonPerfEvents207

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 208: NonPerfEvents208

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 209: NonPerfEvents209

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 210: NonPerfEvents210

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 211: NonPerfEvents211

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 212: NonPerfEvents212

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 213: NonPerfEvents213

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 214: NonPerfEvents214

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 215: NonPerfEvents215

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 216: NonPerfEvents216

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 217: NonPerfEvents217

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 218: NonPerfEvents218

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 219: NonPerfEvents219

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 220: NonPerfEvents220

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 221: NonPerfEvents221

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 222: NonPerfEvents222

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 223: NonPerfEvents223

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 224: NonPerfEvents224

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 225: NonPerfEvents225

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 226: NonPerfEvents226

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 227: NonPerfEvents227

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 228: NonPerfEvents228

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 229: NonPerfEvents229

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 230: NonPerfEvents230

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 231: NonPerfEvents231

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 232: NonPerfEvents232

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 233: NonPerfEvents233

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Event ID 1000: Index merge failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Index merge failed.

Message #

Index merge failed

Event ID 1001: Connection to the server could not be established

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Connection to the server could not be established.

Message #

Connection to the server could not be established

Fields #

Name	Description
`cause` UnicodeString
`url` UnicodeString

Event ID 1002: Topic navigation failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Topic navigation failed.

Message #

Topic navigation failed

Fields #

Name	Description
`url` UnicodeString

Event ID 1003: Data storage is not accessible

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Data storage is not accessible.

Message #

Data storage is not accessible

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1004: Registry key for user settings was not found and could not be created

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Registry key for user settings was not found and could not be created.

Message #

Registry key for user settings was not found and could not be created

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1005: HelpPaneServer could not be CoCreated

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

HelpPaneServer could not be CoCreated.

Message #

HelpPaneServer could not be CoCreated

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1010: Browser control could not be created

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Browser control could not be created.

Message #

Browser control could not be created

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1011: Browser control could not be embedded

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Browser control could not be embedded.

Message #

Browser control could not be embedded

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1012: Browser control could not be activated

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Browser control could not be activated.

Message #

Browser control could not be activated

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1013: Failed to attach to browser event connection points

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Failed to attach to browser event connection points.

Message #

Failed to attach to browser event connection points

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1020: Local search failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Local search failed.

Message #

Local search failed

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1021: Online search failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online search failed.

Message #

Online search failed

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1022: Online server search response is not valid

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online server search response is not valid.

Message #

Online server search response is not valid

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 1023: Online TOC root is not valid

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online TOC root is not valid.

Message #

Online TOC root is not valid

Fields #

Name	Description
`Win32LastError` UInt32

Event ID 1024: Online TOC request failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online TOC request failed.

Message #

Online TOC request failed

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 1025: Online server TOC response is not valid

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online server TOC response is not valid.

Message #

Online server TOC response is not valid

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 1026: Local TOC (Collection) is not valid

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Local TOC (Collection) is not valid.

Message #

Local TOC (Collection) is not valid

Event ID 1027: H1Q load failed

Provider: Microsoft-Windows-Help
Channel: Operational

Description

H1Q load failed.

Message #

H1Q load failed

Event ID 1028: H1Q load succeeded

Provider: Microsoft-Windows-Help
Channel: Operational

Description

H1Q load succeeded.

Message #

H1Q load succeeded

Event ID 1029: Cound not find H1Q

Provider: Microsoft-Windows-Help
Channel: Operational

Description

Cound not find H1Q.

Message #

Cound not find H1Q

Event ID 1030: Online HTTP data retrieval failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Online HTTP data retrieval failed.

Message #

Online HTTP data retrieval failed

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`Win32LastError` UInt32

Event ID 1040: XML Load failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

XML Load failed.

Message #

XML Load failed

Fields #

Name	Description
`Message` UnicodeString
`Url` UnicodeString
`SrcText` UnicodeString
`Reason` UnicodeString
`ErrorCode` UInt32

Event ID 1041: XML Transform failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

XML Transform failed.

Message #

XML Transform failed

Fields #

Name	Description
`Message` UnicodeString
`SrcText` UnicodeString
`Description` UnicodeString
`ErrorCode` UInt32

Event ID 1042: XML Parser failed to initialize

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

XML Parser failed to initialize.

Message #

XML Parser failed to initialize

Event ID 2000: Group policy found and loaded successfully

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Group policy found and loaded successfully.

Message #

Group policy found and loaded successfully

Fields #

Name	Description
`policy` UnicodeString

Event ID 2001: Content merge was started

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents
Opcode: Start

Description

Content merge was started.

Message #

Content merge was started

Event ID 2002: Content merge was completed successfully

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents
Opcode: Stop

Description

Content merge was completed successfully.

Message #

Content merge was completed successfully

Event ID 2003: Content merge was cancelled by the user

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents
Opcode: Suspend

Description

Content merge was cancelled by the user.

Message #

Content merge was cancelled by the user

Event ID 2004: Content merge failed

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents
Opcode: Suspend

Description

Content merge failed.

Message #

Content merge failed

Event ID 2005: Access Denied

Provider: Microsoft-Windows-Help
Channel: Operational
Task: NonPerfEvents

Description

Access Denied.

Message #

Access Denied

Fields #

Name	Description
`ApplicationErrorCode` UInt32
`ErrorMessage` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID de513a55-c345-438b-9a74-e18cac5c5cc5

Defined in apds.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)