Microsoft-Windows-Immersive-Shell-API

Event	Title	Channel	Sample	Rule
1657	Publisher is starting to publish a roamed layout ({Scenario}).	Operational	N	N
1658	Publisher has completed the publish operation with return code {Result} after …	Operational	N	N
1659	Publisher received a request to publish a roamed layout for scenario {Scenario}.	Operational	N	N
1660	Publish processed the request to publish a roamed layout with return code …	Operational	N	N
1661	Publisher loaded the remote layout with return code {Result}.	Operational	N	N
1662	Publisher merged local and remote layouts with return code {Result}.	Operational	N	N
1663	Publisher has started to update the data layer with a payload containing …	Operational	N	N
1664	Publisher complete the update of the data layer with return code {Result}.	Operational	N	N
1665	Publisher attempted to commit the data layer change.	Operational	N	N
1666	Publisher loaded the local layout with return code {Result}.	Operational	N	N
1672	Publisher is running with cloud priority mode enabled …	Operational	N	N
1800	AppLayoutItem - {AppID}; location={TileSize}; order={TileType}; …	Operational	N	N
1802	AppLaunch - {AppID}; location={PackageFullName}.	Operational	N	N
1804	AppSurfaceResize - menu({widthMenu}; {heightMenu}); monitor({widthMonitor}; …	Operational	N	N
2000	CoreApplicationActivationStart	Diagnostic	Y	N
2001	CoreApplicationActivationStop	Diagnostic	Y	N
2002	CoreApplicationSuspensionStart	Diagnostic	Y	N
2003	CoreApplicationSuspensionStop	Diagnostic	Y	N
2004	CoreApplicationExitStart	Diagnostic	N	N
2005	CoreApplicationExitStop	Diagnostic	N	N
2006	CoreApplicationRegistrationStart	Diagnostic	Y	N
2007	CoreApplicationRegistrationStop	Diagnostic	Y	N
2008	CoreApplicationInitializationStart	Diagnostic	Y	N
2009	CoreApplicationInitializationStop	Diagnostic	Y	N
2010	CoreApplicationViewProviderLoadStart	Diagnostic	Y	N
2011	CoreApplicationViewProviderLoadStop	Diagnostic	Y	N
2012	CoreApplicationViewProviderInitializationStart	Diagnostic	N	N
2013	CoreApplicationViewProviderInitializationStop	Diagnostic	N	N
2014	CoreApplicationActivationHandlersStart	Diagnostic	Y	N
2015	CoreApplicationActivationHandlersStop	Diagnostic	Y	N
2016	CoreApplicationSuspendHandlersStart	Diagnostic	N	N
2017	CoreApplicationSuspendHandlersStop	Diagnostic	N	N
2018	CoreApplicationResumeHandlersStart	Diagnostic	Y	N
2019	CoreApplicationResumeHandlersStop	Diagnostic	Y	N
2020	CoreApplicationCreateNewViewStart	Diagnostic	N	N
2021	CoreApplicationCreateNewViewStop	Diagnostic	N	N
2022	CoreApplicationEnteredBackgroundStart	Diagnostic	Y	N
2023	CoreApplicationEnteredBackgroundStop	Diagnostic	Y	N
2024	CoreApplicationEnteredBackgroundDispatchStart	Diagnostic	Y	N
2025	CoreApplicationEnteredBackgroundDispatchStop	Diagnostic	Y	N
2026	CoreApplicationLeavingBackgroundStart	Diagnostic	Y	N
2027	CoreApplicationLeavingBackgroundStop	Diagnostic	Y	N
2028	CoreApplicationLeavingBackgroundDispatchStart	Diagnostic	Y	N
2029	CoreApplicationLeavingBackgroundDispatchStop	Diagnostic	Y	N
2041	CoreApplication - Quiesce - PSM called PsmDoStateChange	Tracing	N	N
2042	CoreApplication - Suspend - Calling PsmBlockUnblock (BlockUnblockBool) for ASTA …	Tracing	N	N
2043	CoreApplication - Resume - Calling PsmBlockUnblock ({BlockUnblockBool}) for ASTA …	Tracing	N	N
2044	CoreApplication - Quiesce - called PsmWaitForAppResume	Tracing	N	N
2045	CoreApplication - ViewInitialize - IsMain IsMainView PID Pid TID ThreadId.	Tracing	Y	N
2046	CoreApplicationSuspendingDeferralStart	Tracing	Y	N
2047	CoreApplicationSuspendingDeferralStop	Tracing	Y	N
2048	CoreApplication - EnteredBackground	Tracing	Y	N
2049	CoreApplication - LeavingBackground	Tracing	Y	N
2050	CoreApplication - Invalid visibility changed event detected.	Tracing	N	N
2101	ImmersiveSettingsPane_ShowStart	Diagnostic	N	N
2102	ImmersiveSettingsPane_ShowStop	Diagnostic	N	N
2104	ImmersiveSettingsPane_DispatchCommandStart	Diagnostic	N	N
2105	ImmersiveSettingsPane_DispatchCommand	Diagnostic	N	N
2106	ImmersiveSettingsPane_DispatchCommandStop	Diagnostic	N	N
2108	ImmersiveSettingsPane_QueryCommandsStart	Diagnostic	N	N
2109	ImmersiveSettingsPane_QueryCommandsStop	Diagnostic	N	N
2111	ImmersiveSettingsPane_RequestCommandsStart	Diagnostic	N	N
2112	ImmersiveSettingsPane_RequestCommandsStop	Diagnostic	N	N
2114	ImmersiveSettingsPane_CommandsRequestedEventHandler	Diagnostic	N	N
2115	ImmersiveSettingsPane_CommandsRequestedEventHandler2115	Diagnostic	N	N
6000	SearchPane_API_GetForCurrentViewStart	Diagnostic	N	N
6001	SearchPane_API_GetForCurrentViewStop	Diagnostic	N	N
6002	SearchPane_API_TypeAhead_AsyncImageDownloadStart	Diagnostic	N	N
6003	SearchPane_API_TypeAhead_AsyncImageDownloadStop	Diagnostic	N	N
6004	SearchPane_API_TypeAhead_DeferralCompleteStart	Diagnostic	N	N
6005	SearchPane_API_TypeAhead_DeferralCompleteStop	Diagnostic	N	N
6200	DataTransferManager_API_AppReturnDataStart	Diagnostic	N	N
6201	DataTransferManager_API_AppReturnDataStop	Diagnostic	N	N
6203	PerfTrack_ShareCharm_TimeToAppStop	Diagnostic	N	N

Event ID 1657: Publisher is starting to publish a roamed layout ({Scenario}).

Channel: Operational

Fields #

Name	Description
`Scenario`

Event ID 1658: Publisher has completed the publish operation with return code {Result} after {FailedAttempts} failing attempts.

Channel: Operational

Fields #

Name	Description
`Result`
`FailedAttempts`

Event ID 1659: Publisher received a request to publish a roamed layout for scenario {Scenario}.

Channel: Operational

Fields #

Name	Description
`Scenario`

Event ID 1660: Publish processed the request to publish a roamed layout with return code {Result}.

Channel: Operational

Fields #

Name	Description
`Result`

Event ID 1661: Publisher loaded the remote layout with return code {Result}.

Channel: Operational

Fields #

Name	Description
`Result`

Event ID 1662: Publisher merged local and remote layouts with return code {Result}.

Channel: Operational

Fields #

Name	Description
`Result`

Event ID 1663: Publisher has started to update the data layer with a payload containing {ItemCount} items and {GroupCount} groups.

Channel: Operational

Fields #

Name	Description
`ItemCount`
`GroupCount`

Event ID 1664: Publisher complete the update of the data layer with return code {Result}.

Channel: Operational

Fields #

Name	Description
`Result`

Event ID 1665: Publisher attempted to commit the data layer change.

Channel: Operational

Description

Publisher attempted to commit the data layer change. The return code was {Result}. The priority was {LowPriority} (true = low; false = normal).

Message #

Publisher attempted to commit the data layer change. The return code was {Result}. The priority was {LowPriority} (true = low; false = normal).

Fields #

Name	Description
`Result`
`LowPriority`

Event ID 1666: Publisher loaded the local layout with return code {Result}.

Channel: Operational

Fields #

Name	Description
`Result`

Event ID 1672: Publisher is running with cloud priority mode enabled ({CloudPriorityModeEnabled}).

Channel: Operational

Fields #

Name	Description
`CloudPriorityModeEnabled`

Event ID 1800: AppLayoutItem - {AppID}; location={TileSize}; order={TileType}; size={PackageFullName}; typeFlags={ShortcutLocation}.

Channel: Operational

Fields #

Name	Description
`AppID`
`TileSize`
`TileType`
`PackageFullName`
`ShortcutLocation`

Event ID 1802: AppLaunch - {AppID}; location={PackageFullName}.

Channel: Operational

Fields #

Name	Description
`AppID`
`PackageFullName`

Event ID 1804: AppSurfaceResize - menu({widthMenu}; {heightMenu}); monitor({widthMonitor}; {heightMonitor}); grid({widthGrid}; {heightGrid}); dpi={monitorDPI}; pp...

Channel: Operational

Description

AppSurfaceResize - menu({widthMenu}; {heightMenu}); monitor({widthMonitor}; {heightMonitor}); grid({widthGrid}; {heightGrid}); dpi={monitorDPI}; ppi={monitorPPI}.

Message #

AppSurfaceResize - menu({widthMenu}; {heightMenu}); monitor({widthMonitor}; {heightMonitor}); grid({widthGrid}; {heightGrid}); dpi={monitorDPI}; ppi={monitorPPI}

Fields #

Name	Description
`widthMenu`
`heightMenu`
`widthMonitor`
`heightMonitor`
`widthGrid`
`heightGrid`
`monitorDPI`
`monitorPPI`

Event ID 2000: CoreApplicationActivationStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationActivation
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2000,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12560,
      "thread_id": 7080
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:42.660Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2001: CoreApplicationActivationStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationActivation
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12560,
      "thread_id": 7080
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:42.686Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2002: CoreApplicationSuspensionStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationSuspension
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2002,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 12384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:00.118Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2003: CoreApplicationSuspensionStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationSuspension
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2003,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 12384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:00.118Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2004: CoreApplicationExitStart

Channel: Diagnostic
Task: CoreApplicationExit
Opcode: Start

Event ID 2005: CoreApplicationExitStop

Channel: Diagnostic
Task: CoreApplicationExit
Opcode: Stop

Event ID 2006: CoreApplicationRegistrationStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationRegistration
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2006,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12560,
      "thread_id": 15348
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:42.424Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2007: CoreApplicationRegistrationStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationRegistration
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2007,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12560,
      "thread_id": 15348
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:42.570Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2008: CoreApplicationInitializationStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationInitialization
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2008,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12532,
      "thread_id": 7908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:01:05.020Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2009: CoreApplicationInitializationStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationInitialization
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2009,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 12532,
      "thread_id": 7908
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:01:05.021Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2010: CoreApplicationViewProviderLoadStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationViewProviderLoad
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2010,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:56.001Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2011: CoreApplicationViewProviderLoadStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationViewProviderLoad
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2011,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:56.001Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2012: CoreApplicationViewProviderInitializationStart

Channel: Diagnostic
Task: CoreApplicationViewProviderInitialization
Opcode: Start

Event ID 2013: CoreApplicationViewProviderInitializationStop

Channel: Diagnostic
Task: CoreApplicationViewProviderInitialization
Opcode: Stop

Event ID 2014: CoreApplicationActivationHandlersStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationActivationHandlers
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2014,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:56.043Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2015: CoreApplicationActivationHandlersStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationActivationHandlers
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2015,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:57.572Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2016: CoreApplicationSuspendHandlersStart

Channel: Diagnostic
Task: CoreApplicationSuspendHandlers
Opcode: Start

Event ID 2017: CoreApplicationSuspendHandlersStop

Channel: Diagnostic
Task: CoreApplicationSuspendHandlers
Opcode: Stop

Event ID 2018: CoreApplicationResumeHandlersStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationResumeHandlers
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2018,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 12384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:02.801Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2019: CoreApplicationResumeHandlersStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationResumeHandlers
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2019,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 12384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:02.801Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2020: CoreApplicationCreateNewViewStart

Channel: Diagnostic
Task: CoreApplicationCreateNewView
Opcode: Start

Event ID 2021: CoreApplicationCreateNewViewStop

Channel: Diagnostic
Task: CoreApplicationCreateNewView
Opcode: Stop

Event ID 2022: CoreApplicationEnteredBackgroundStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationEnteredBackground
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2022,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10212,
      "thread_id": 6688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:44.863Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2023: CoreApplicationEnteredBackgroundStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationEnteredBackground
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2023,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10212,
      "thread_id": 6688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:44.914Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2024: CoreApplicationEnteredBackgroundDispatchStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationEnteredBackgroundDispatch
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2024,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10212,
      "thread_id": 7256
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:44.873Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2025: CoreApplicationEnteredBackgroundDispatchStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationEnteredBackgroundDispatch
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2025,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10212,
      "thread_id": 6688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:44.914Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2026: CoreApplicationLeavingBackgroundStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationLeavingBackground
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2026,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10236,
      "thread_id": 8920
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:41.019Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2027: CoreApplicationLeavingBackgroundStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationLeavingBackground
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2027,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10236,
      "thread_id": 8920
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:41.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2028: CoreApplicationLeavingBackgroundDispatchStart

Channel: Diagnostic
Level: Informational
Task: CoreApplicationLeavingBackgroundDispatch
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2028,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10236,
      "thread_id": 14264
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:41.027Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2029: CoreApplicationLeavingBackgroundDispatchStop

Channel: Diagnostic
Level: Informational
Task: CoreApplicationLeavingBackgroundDispatch
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2029,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10236,
      "thread_id": 8920
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:41.028Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2041: CoreApplication - Quiesce - PSM called PsmDoStateChange

Channel: Tracing
Task: CoreApplicationPsmDoStateChange

Fields #

Name	Description
`QuiesceBool` UInt32

Event ID 2042: CoreApplication - Suspend - Calling PsmBlockUnblock (BlockUnblockBool) for ASTA ThreadId.

Channel: Tracing
Task: CoreApplicationQuiescePsmBlockUnblockASTA

Message #

CoreApplication - Suspend - Calling PsmBlockUnblock (%1) for ASTA %2

Fields #

Name	Description
`BlockUnblockBool` UInt32
`ThreadId` UInt32

Event ID 2043: CoreApplication - Resume - Calling PsmBlockUnblock ({BlockUnblockBool}) for ASTA {ThreadId}.

Channel: Tracing

Fields #

Name	Description
`BlockUnblockBool`
`ThreadId`

Event ID 2044: CoreApplication - Quiesce - called PsmWaitForAppResume

Channel: Tracing
Task: CoreApplicationQuiesceWaitForAppResume

Fields #

Name	Description
`ThreadId` UInt32

Event ID 2045: CoreApplication - ViewInitialize - IsMain IsMainView PID Pid TID ThreadId.

Channel: Tracing
Level: Informational
Task: CoreApplicationViewInitializationProcessAndThread

Message #

CoreApplication - ViewInitialize - IsMain %1 PID %2 TID %3

Fields #

Name	Description
`IsMainView` UInt32
`Pid` UInt32
`ThreadId` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2045,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:45.896Z",
    "version": 0
  },
  "event_data": {
    "IsMainView": 1,
    "Pid": 11968,
    "ThreadId": 9384
  },
  "message": ""
}

Event ID 2046: CoreApplicationSuspendingDeferralStart

Channel: Tracing
Level: Informational
Task: CoreApplicationSuspendingDeferral
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2046,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 9384
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:02.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2047: CoreApplicationSuspendingDeferralStop

Channel: Tracing
Level: Informational
Task: CoreApplicationSuspendingDeferral
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2047,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11968,
      "thread_id": 3948
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:28:02.596Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2048: CoreApplication - EnteredBackground

Channel: Tracing
Level: Informational
Task: CoreApplicationEnteredBackground

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2048,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10212,
      "thread_id": 6688
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:44.863Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2049: CoreApplication - LeavingBackground

Channel: Tracing
Level: Informational
Task: CoreApplicationLeavingBackground

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-CoreApplication/Tracing",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 2049,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 10236,
      "thread_id": 8920
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Immersive-Shell-API",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 16:27:41.019Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 2050: CoreApplication - Invalid visibility changed event detected.

Channel: Tracing
Task: CoreApplicationInvalidEventInProgress

Description

CoreApplication - Invalid visibility changed event detected. Visibility changed event is already in progress.

Message #

CoreApplication - Invalid visibility changed event detected.  Visibility changed event is already in progress.

Event ID 2101: ImmersiveSettingsPane_ShowStart

Channel: Diagnostic
Task: ImmersiveSettingsPane_Show
Opcode: Start

Event ID 2102: ImmersiveSettingsPane_ShowStop

Channel: Diagnostic
Task: ImmersiveSettingsPane_Show
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 2104: ImmersiveSettingsPane_DispatchCommandStart

Channel: Diagnostic
Task: ImmersiveSettingsPane_DispatchCommand
Opcode: Start

Event ID 2105: ImmersiveSettingsPane_DispatchCommand

Channel: Diagnostic
Task: ImmersiveSettingsPane_DispatchCommand

Event ID 2106: ImmersiveSettingsPane_DispatchCommandStop

Channel: Diagnostic
Task: ImmersiveSettingsPane_DispatchCommand
Opcode: Stop

Fields #

Name	Description
`Result` UInt32

Event ID 2108: ImmersiveSettingsPane_QueryCommandsStart

Channel: Diagnostic
Task: ImmersiveSettingsPane_QueryCommands
Opcode: Start

Event ID 2109: ImmersiveSettingsPane_QueryCommandsStop

Channel: Diagnostic
Task: ImmersiveSettingsPane_QueryCommands
Opcode: Stop

Event ID 2111: ImmersiveSettingsPane_RequestCommandsStart

Channel: Diagnostic
Task: ImmersiveSettingsPane_RequestCommands
Opcode: Start

Event ID 2112: ImmersiveSettingsPane_RequestCommandsStop

Channel: Diagnostic
Task: ImmersiveSettingsPane_RequestCommands
Opcode: Stop

Event ID 2114: ImmersiveSettingsPane_CommandsRequestedEventHandler

Channel: Diagnostic
Task: ImmersiveSettingsPane_CommandsRequestedEventHandler

Event ID 2115: ImmersiveSettingsPane_CommandsRequestedEventHandler2115

Channel: Diagnostic
Task: ImmersiveSettingsPane_CommandsRequestedEventHandler

Event ID 6000: SearchPane_API_GetForCurrentViewStart

Channel: Diagnostic
Task: SearchPane_API_GetForCurrentView
Opcode: Start

Event ID 6001: SearchPane_API_GetForCurrentViewStop

Channel: Diagnostic
Task: SearchPane_API_GetForCurrentView
Opcode: Stop

Event ID 6002: SearchPane_API_TypeAhead_AsyncImageDownloadStart

Channel: Diagnostic
Task: SearchPane_API_TypeAhead_AsyncImageDownload
Opcode: Start

Event ID 6003: SearchPane_API_TypeAhead_AsyncImageDownloadStop

Channel: Diagnostic
Task: SearchPane_API_TypeAhead_AsyncImageDownload
Opcode: Stop

Event ID 6004: SearchPane_API_TypeAhead_DeferralCompleteStart

Channel: Diagnostic
Task: SearchPane_API_TypeAhead_DeferralComplete
Opcode: Start

Event ID 6005: SearchPane_API_TypeAhead_DeferralCompleteStop

Channel: Diagnostic
Task: SearchPane_API_TypeAhead_DeferralComplete
Opcode: Stop

Event ID 6200: DataTransferManager_API_AppReturnDataStart

Channel: Diagnostic
Task: DataTransferManager_API_AppReturnData
Opcode: Start

Event ID 6201: DataTransferManager_API_AppReturnDataStop

Channel: Diagnostic
Task: DataTransferManager_API_AppReturnData
Opcode: Stop

Fields #

Name	Description
`AppID` UnicodeString

Event ID 6203: PerfTrack_ShareCharm_TimeToAppStop

Channel: Diagnostic
Task: PerfTrack_ShareCharm_TimeToApp
Opcode: Stop

Fields #

Name	Description
`HWND` UInt32
`AppID` UnicodeString

Provenance

ETW provider GUID 5f0e257f-c224-43e5-9555-2adcb8540a58

Defined in twinapi.appcore.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB