Microsoft-Windows-Immersive-Shell-API
74 events across 4 channels
Event ID 1657: Publisher is starting to publish a roamed layout ({Scenario}).
#Event ID 1658: Publisher has completed the publish operation with return code {Result} after {FailedAttempts} failing attempts.
#Event ID 1659: Publisher received a request to publish a roamed layout for scenario {Scenario}.
#Event ID 1660: Publish processed the request to publish a roamed layout with return code {Result}.
#Event ID 1661: Publisher loaded the remote layout with return code {Result}.
#Event ID 1662: Publisher merged local and remote layouts with return code {Result}.
#Event ID 1663: Publisher has started to update the data layer with a payload containing {ItemCount} items and {GroupCount} groups.
#Event ID 1664: Publisher complete the update of the data layer with return code {Result}.
#Event ID 1665: Publisher attempted to commit the data layer change.
#Event ID 1666: Publisher loaded the local layout with return code {Result}.
#Event ID 1672: Publisher is running with cloud priority mode enabled ({CloudPriorityModeEnabled}).
#Event ID 1800: AppLayoutItem - {AppID}; location={TileSize}; order={TileType}; size={PackageFullName}; typeFlags={ShortcutLocation}.
#Event ID 1802: AppLaunch - {AppID}; location={PackageFullName}.
#Event ID 1804: AppSurfaceResize - menu({widthMenu}; {heightMenu}); monitor({widthMonitor}; {heightMonitor}); grid({widthGrid}; {heightGrid}); dpi={monitorDPI}; pp...
#Event ID 2000: CoreApplicationActivationStart
#Event ID 2001: CoreApplicationActivationStop
#Event ID 2002: CoreApplicationSuspensionStart
#Event ID 2003: CoreApplicationSuspensionStop
#Event ID 2004: CoreApplicationExitStart
#Event ID 2005: CoreApplicationExitStop
#Event ID 2006: CoreApplicationRegistrationStart
#Event ID 2007: CoreApplicationRegistrationStop
#Event ID 2008: CoreApplicationInitializationStart
#Event ID 2009: CoreApplicationInitializationStop
#Event ID 2010: CoreApplicationViewProviderLoadStart
#Event ID 2011: CoreApplicationViewProviderLoadStop
#Event ID 2012: CoreApplicationViewProviderInitializationStart
#Event ID 2013: CoreApplicationViewProviderInitializationStop
#Event ID 2014: CoreApplicationActivationHandlersStart
#Event ID 2015: CoreApplicationActivationHandlersStop
#Event ID 2016: CoreApplicationSuspendHandlersStart
#Event ID 2017: CoreApplicationSuspendHandlersStop
#Event ID 2018: CoreApplicationResumeHandlersStart
#Event ID 2019: CoreApplicationResumeHandlersStop
#Event ID 2020: CoreApplicationCreateNewViewStart
#Event ID 2021: CoreApplicationCreateNewViewStop
#Event ID 2022: CoreApplicationEnteredBackgroundStart
#Event ID 2023: CoreApplicationEnteredBackgroundStop
#Event ID 2024: CoreApplicationEnteredBackgroundDispatchStart
#Event ID 2025: CoreApplicationEnteredBackgroundDispatchStop
#Event ID 2026: CoreApplicationLeavingBackgroundStart
#Event ID 2027: CoreApplicationLeavingBackgroundStop
#Event ID 2028: CoreApplicationLeavingBackgroundDispatchStart
#Event ID 2029: CoreApplicationLeavingBackgroundDispatchStop
#Event ID 2041: CoreApplication - Quiesce - PSM called PsmDoStateChange
#Event ID 2042: CoreApplication - Suspend - Calling PsmBlockUnblock (BlockUnblockBool) for ASTA ThreadId.
#Event ID 2043: CoreApplication - Resume - Calling PsmBlockUnblock ({BlockUnblockBool}) for ASTA {ThreadId}.
#Event ID 2044: CoreApplication - Quiesce - called PsmWaitForAppResume
#Event ID 2045: CoreApplication - ViewInitialize - IsMain IsMainView PID Pid TID ThreadId.
#Event ID 2046: CoreApplicationSuspendingDeferralStart
#Event ID 2047: CoreApplicationSuspendingDeferralStop
#Event ID 2048: CoreApplication - EnteredBackground
#Description
CoreApplication - EnteredBackground.
Message #
Event ID 2049: CoreApplication - LeavingBackground
#Description
CoreApplication - LeavingBackground.
Message #
Event ID 2050: CoreApplication - Invalid visibility changed event detected.
#Description
CoreApplication - Invalid visibility changed event detected. Visibility changed event is already in progress.
Message #
Event ID 2101: ImmersiveSettingsPane_ShowStart
#Event ID 2104: ImmersiveSettingsPane_DispatchCommandStart
#Event ID 2105: ImmersiveSettingsPane_DispatchCommand
#Event ID 2108: ImmersiveSettingsPane_QueryCommandsStart
#Event ID 2109: ImmersiveSettingsPane_QueryCommandsStop
#Event ID 2111: ImmersiveSettingsPane_RequestCommandsStart
#Event ID 2112: ImmersiveSettingsPane_RequestCommandsStop
#Event ID 2114: ImmersiveSettingsPane_CommandsRequestedEventHandler
#Event ID 2115: ImmersiveSettingsPane_CommandsRequestedEventHandler2115
#Event ID 6000: SearchPane_API_GetForCurrentViewStart
#Event ID 6001: SearchPane_API_GetForCurrentViewStop
#Event ID 6002: SearchPane_API_TypeAhead_AsyncImageDownloadStart
#Event ID 6003: SearchPane_API_TypeAhead_AsyncImageDownloadStop
#Event ID 6004: SearchPane_API_TypeAhead_DeferralCompleteStart
#Event ID 6005: SearchPane_API_TypeAhead_DeferralCompleteStop
#Event ID 6200: DataTransferManager_API_AppReturnDataStart
#Event ID 6203: PerfTrack_ShareCharm_TimeToAppStop
#Fields #
| Name | Description |
|---|---|
HWND UInt32 | |
AppID UnicodeString |
Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 5f0e257f-c224-43e5-9555-2adcb8540a58
Defined in twinapi.appcore.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02