Microsoft-Windows-Immersive-Shell
Event ID 102: The shell startup sequence completed with result Result.
#Event ID 105: ImmersiveShellShutdown
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "{315A8872-923E-4EA2-9889-33CD4754BF64}",
"event_source_name": "",
"event_id": 105,
"version": 0,
"level": 4,
"task": 104,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-06-13T05:22:33.5138587+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 6456,
"thread_id": 6740
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
}
},
"event_data": {},
"message": ""
}
Event ID 111: The shell is starting up, the shell component with table index ComponentClsid is InitalizationStep, current result (Result).
#Event ID 112: The shell is starting up, the shell component with table index ComponentClsid is InitalizationStep, current result (Result).
#Event ID 113: The shell is shutting down; the shell component with table index {TableEntryIndex} (in the fixed table) is {InitalizationStep}; current result.
#Event ID 114: The shell is shutting down; the shell component with table index {TableEntryIndex} (in the fixed table) is {InitalizationStep}; current result.
#Event ID 121: ImmersiveShellAppManagerModeNotificationStart
#Fields #
| Name | Description |
|---|---|
SystemModeFrom Int32 | |
SystemSubModeFrom Int32 | |
SystemModeTo Int32 | |
SystemSubModeTo Int32 |
Event ID 122: ImmersiveShellAppManagerModeNotificationStop
#Fields #
| Name | Description |
|---|---|
SystemModeFrom Int32 | |
SystemSubModeFrom Int32 | |
SystemModeTo Int32 | |
SystemSubModeTo Int32 |
Event ID 123: ImmersiveShellAppManagerZbandNotificationStart
#Fields #
| Name | Description |
|---|---|
ZbandFrom Int32 | |
ZbandTo Int32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 123,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 15028
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:42.250Z",
"version": 0
},
"event_data": {
"ZbandFrom": 6,
"ZbandTo": 1
},
"message": ""
}
Event ID 124: ImmersiveShellAppManagerZbandNotificationStop
#Fields #
| Name | Description |
|---|---|
ZbandFrom Int32 | |
ZbandTo Int32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 124,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 15028
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:43.271Z",
"version": 0
},
"event_data": {
"ZbandFrom": 6,
"ZbandTo": 1
},
"message": ""
}
Event ID 125: ImmersiveShellAppManagerZbandChangedStart
#Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 125,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 15028
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:42.742Z",
"version": 0
},
"event_data": {
"ListenerIndex": 0
},
"message": ""
}
Event ID 126: ImmersiveShellAppManagerZbandChangedStop
#Fields #
| Name | Description |
|---|---|
ListenerIndex UInt32 | |
Result UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 126,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 15028
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:43.084Z",
"version": 0
},
"event_data": {
"ListenerIndex": 0,
"Result": 0
},
"message": ""
}
Event ID 145: ImmersiveShellAppManagerStartupStart
#Event ID 146: ImmersiveShellAppManagerStartupStop
#Event ID 147: ImmersiveShellAppManagerSetActiveProcessStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 147,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 9788
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:34.870Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 148: ImmersiveShellAppManagerSetActiveProcessStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 148,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 9788
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:34.884Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 151: ImmersiveShellLayoutUpdateStart
#Event ID 152: ImmersiveShellLayoutUpdateStop
#Event ID 153: ImmersiveShellLayoutUpdate
#Fields #
| Name | Description |
|---|---|
BandID UInt32 | |
OuterWorkArea_left Int32 | |
OuterWorkArea_top Int32 | |
OuterWorkArea_right Int32 | |
OuterWorkArea_bottom Int32 | |
InnerWorkArea_left Int32 | |
InnerWorkArea_top Int32 | |
InnerWorkArea_right Int32 | |
InnerWorkArea_bottom Int32 |
Event ID 154: Layout Manager: Initialization
#Event ID 155: Layout Manager: Initialization
#Event ID 156: Layout Manager Invalidation has occurred
#Fields #
| Name | Description |
|---|---|
InvalidationReason UInt32 |
Event ID 161: ImmersiveShellIHMNotificationStart
#Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | |
IHMPosition_left Int32 | |
IHMPosition_top Int32 | |
IHMPosition_right Int32 | |
IHMPosition_bottom Int32 |
Event ID 162: ImmersiveShellIHMNotificationStop
#Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | |
IHMPosition_left Int32 | |
IHMPosition_top Int32 | |
IHMPosition_right Int32 | |
IHMPosition_bottom Int32 |
Event ID 163: ImmersiveShellIHMNotificationStart163
#Fields #
| Name | Description |
|---|---|
FocusedHWND Pointer | |
IHMPosition_left Int32 | |
IHMPosition_top Int32 | |
IHMPosition_right Int32 | |
IHMPosition_bottom Int32 |
Event ID 164: ImmersiveShellIHMNotificationStop164
#Event ID 165: ImmersiveShellAppIHMNotificationStart
#Fields #
| Name | Description |
|---|---|
NotificationType Int32 | |
FocusedHWND Pointer | |
IHMPosition_left Int32 | |
IHMPosition_top Int32 | |
IHMPosition_right Int32 | |
IHMPosition_bottom Int32 |
Event ID 166: ImmersiveShellAppIHMNotificationStop
#Fields #
| Name | Description |
|---|---|
NotificationType Int32 | |
FocusedHWND Pointer | |
IHMPosition_left Int32 | |
IHMPosition_top Int32 | |
IHMPosition_right Int32 | |
IHMPosition_bottom Int32 |
Event ID 171: Application state change for AppID: ApplicationState.
#Message #
Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
ApplicationState UInt32 | |
HasActionsMenu Boolean | |
DesktopTabletModeState UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 171,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 15028
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:28.380Z",
"version": 0
},
"event_data": {
"AppID": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
"ApplicationState": 1,
"DesktopTabletModeState": 0,
"HasActionsMenu": false
},
"message": ""
}
Event ID 173: ImmersiveShellAppManagerWindowTitleChange
#Fields #
| Name | Description |
|---|---|
Window Int32 | |
Title UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 173,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 9788
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:28.308Z",
"version": 0
},
"event_data": {
"Title": "NULL",
"Window": 0
},
"message": ""
}
Event ID 1003: The parsing of the tile notification XML payload has failed.
#Event ID 1004: The notification payload does not have a template definition for the current tile size
#Event ID 1013: TileXML_ProcessMRTResourceStop
#Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | |
NotificationId UInt32 | |
HRESULT UInt32 | |
UnprocessedResourceString UnicodeString | |
ProcessedResourceString UnicodeString |
Event ID 1014: The notification payload exceeds the maximum allowed size
#Event ID 1015: The notification payload is too small to process
#Event ID 1016: The notification payload has an unsupported or invalid unicode byte order mark
#Event ID 1017: The notification payload contains unknown or invalid attributes
#Event ID 1018: The notification payload contains a given tag more times than is allowed by the specification
#Event ID 1019: The notification payload contains an unknown or invalid element
#Event ID 1020: The notification payload contains text within a tag that does not allow it
#Event ID 1021: The notification payload contains more than one visual element
#Event ID 1022: The notification payload's active binding element has a contentId that matches an exising notification
#Event ID 1023: The version 1 notification has an illegal value for its template or fallback attribute
#Event ID 1024: The notification's template attribute is not recognized in this version of Windows.
#Description
The notification's template attribute is not recognized in this version of Windows. Using the fallback template.
Message #
Event ID 1025: Successfully resolved the notification template attribute for this version of Windows
#Event ID 1026: Unable to resolve the notification template attribute for this version of Windows
#Event ID 1027: All payload content was clipped at the current tile size.
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 | |
TemplateName UnicodeString |
Event ID 1201: ImmersiveShellBadgeParseXMLStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 1202: ImmersiveShellBadgeParseXMLStop
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 1203: The parsing of the badge notification XML payload has failed.
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 | |
HRESULT UInt32 | |
Node UnicodeString | |
Line Int32 | |
Position Int32 |
Event ID 1310: AppLayoutItem
#Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString | |
Left UInt32 | |
Top UInt32 | |
Right UInt32 | |
Bottom UInt32 |
Event ID 1315: LayoutCache_LayoutShownStart
#Event ID 1316: LayoutCache_LayoutShownStop
#Event ID 1317: SwitchToAppByIdWithArgumentsStart
#Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | |
Arguments UnicodeString | |
NotificationTargetId UnicodeString |
Event ID 1318: SwitchToAppByIdWithArgumentsStop
#Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | |
Arguments UnicodeString | |
NotificationTargetId UnicodeString | |
HRESULT UInt32 |
Event ID 1401: BackstackManager_GetBackstackStart
#Event ID 1403: BackstackManager_GetBackstackStop
#Event ID 1405: BackstackManager_ClearBackstackStart
#Event ID 1406: BackstackManager_ClearBackstackStop
#Event ID 1408: BackstackManager_RemoveApp
#Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1408,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 9788
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:48.674Z",
"version": 0
},
"event_data": {
"AppUserModelID": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"
},
"message": ""
}
Event ID 1460: DropFeedback_Show
#Event ID 1461: DropFeedback_Hide
#Event ID 1462: DropFeedbackItem_Show
#Fields #
| Name | Description |
|---|---|
ID UInt32 | |
Left Int32 | |
Top Int32 | |
Right Int32 | |
Bottom Int32 |
Event ID 1463: DropFeedbackItem_Update
#Fields #
| Name | Description |
|---|---|
ID UInt32 | |
Left Int32 | |
Top Int32 | |
Right Int32 | |
Bottom Int32 |
Event ID 1470: DragVisual_Show
#Event ID 1471: DragVisual_AppChange
#Event ID 1472: DragVisual_ModeChange
#Event ID 1473: DragVisual_Hide
#Event ID 1474: DragVisual_Destroy
#Event ID 1476: DragVisual_TargetChanged
#Event ID 1477: LauncherTip_ContextMenuHash
#Fields #
| Name | Description |
|---|---|
HashValue UInt32 | |
HashInput UnicodeString |
Event ID 1601: AppsFolder_ParseDisplayNameStart
#Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1601,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 11716
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:34.107Z",
"version": 0
},
"event_data": {
"AppUserModelID": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\notepad.exe"
},
"message": ""
}
Event ID 1602: AppsFolder_ParseDisplayNameStop
#Fields #
| Name | Description |
|---|---|
AppUserModelID UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1602,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 11716
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:34.107Z",
"version": 0
},
"event_data": {
"AppUserModelID": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\notepad.exe"
},
"message": ""
}
Event ID 1603: AppsFolder_EnumObjectsStart
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "{315a8872-923e-4ea2-9889-33cd4754bf64}",
"event_source_name": "",
"event_id": "1603",
"version": "0",
"level": "4",
"task": "1603",
"opcode": "1",
"keywords": 9223372036854775808,
"time_created": "2026-03-16T00:22:36.589439400+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{a60e3c42-2c57-4b04-b4b5-493e577d516d}"
},
"execution": {
"process_id": "7124",
"thread_id": "9460"
},
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 1604: AppsFolder_EnumObjectsStop
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "{315a8872-923e-4ea2-9889-33cd4754bf64}",
"event_source_name": "",
"event_id": "1604",
"version": "0",
"level": "4",
"task": "1603",
"opcode": "2",
"keywords": 9223372036854775808,
"time_created": "2026-03-16T00:22:36.867962200+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{a60e3c42-2c57-4b04-b4b5-493e577d516d}"
},
"execution": {
"process_id": "7124",
"thread_id": "9460"
},
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {},
"message": ""
}
Event ID 1605: AppsFolder_GetDetailsExStart
#Event ID 1606: AppsFolder_GetDetailsExStop
#Event ID 1609: AppsFolder_GetPropertyStoreStart
#Event ID 1610: AppsFolder_GetPropertyStoreStop
#Event ID 1611: AppsFolder_GetPropertyStoreForKeysStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1611,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 14588
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:40.943Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 1612: AppsFolder_GetPropertyStoreForKeysStop
#Fields #
| Name | Description |
|---|---|
StoreType UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1612,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 14588
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:40.943Z",
"version": 0
},
"event_data": {
"StoreType": 1
},
"message": ""
}
Event ID 1613: AppsFolder_ImmersiveApp_OpenVerbStart
#Event ID 1614: AppsFolder_ImmersiveApp_OpenVerbStop
#Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | |
Arguments UnicodeString |
Event ID 1615: AppsFolderItemState_NotifyChange
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
Event Int32 |
Event ID 1617: AppsFolder_DualModeVerbStart
#Event ID 1618: AppsFolder_DualModeVerbStop
#Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | |
Arguments UnicodeString |
Event ID 1621: Activation of app ApplicationId attempted.
#Description
Activation of app ApplicationId attempted. Execution state: ExecutionState, AppState, Result.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | |
ExecutionState UInt32 | 1 attempted. Execution state. |
AppState UInt32 | |
Result Int32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "315A8872-923E-4EA2-9889-33CD4754BF64",
"event_source_name": "",
"event_id": 1621,
"version": 0,
"level": 4,
"task": 1613,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-11-05T23:40:57.847667+00:00",
"event_record_id": 13,
"correlation": {},
"execution": {
"process_id": 5044,
"thread_id": 10784
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-21-1992711665-1655669231-58201500-1000"
}
},
"event_data": {
"ApplicationId": "CanonicalGroupLimited.UbuntuonWindows_79rhkp1fndgsc!ubuntuonwindows",
"ExecutionState": 1,
"AppState": 0,
"Result": 0
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 1622: AppsFolderItemState_Enqueue
#Fields #
| Name | Description |
|---|---|
Operation UInt32 | Known values
|
TargetAppID UnicodeString | |
RefAppID UnicodeString | |
ModifyFlags UInt32 | |
ViewOrSize UInt32 | |
GroupName UnicodeString |
Event ID 1623: AppsFolderItemState_Commit
#Fields #
| Name | Description |
|---|---|
ItemsToProcess UInt32 | |
StartTask Boolean | |
HRESULT UInt32 |
Event ID 1624: AppsFolderItemState_DoCommit
#Fields #
| Name | Description |
|---|---|
ItemsToProcess UInt32 | |
Retry Boolean | |
FailedAttempts UInt32 | |
HRESULT UInt32 |
Event ID 1625: Launcher_Uninstall_StartingThread
#Event ID 1626: Activation of app AppID will be attempted with refreshed data, result Result.
#Event ID 1627: Starting to remove package with full name Package.
#Event ID 1629: Looking up package for {Package} resulted in error {Result}.
#Event ID 1630: AppsFolder_ImmersiveApp_InstallRequest
#Event ID 1631: AppsFolder_ImmersiveApp_InstallRequest1631
#Fields #
| Name | Description |
|---|---|
Package UnicodeString | |
Result UInt32 |
Event ID 1632: Failed to launch ApplicationId.
#Event ID 1702: Toast Manager Initializing completed with status : {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
OperationStatus | NTSTATUS reference |
Event ID 1705: Session creation with Windows Notification Platform completed with status : {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
OperationStatus | NTSTATUS reference |
Event ID 1707: The start position for Toast Layout has been set to - {X-Position} [x]; {Y-Position} [y].
#Event ID 1709: The max display limit for Toast Layout has been set to - {DisplayLimit}.
#Fields #
| Name | Description |
|---|---|
DisplayLimit |
Event ID 1711: The Toast opaque state duration for has been set to - {OpaqueStateDuration}.
#Fields #
| Name | Description |
|---|---|
OpaqueStateDuration |
Event ID 1713: A size for Toasts has been set to - {ToastHeight} [height]; {ToastWidth} [width].
#Fields #
| Name | Description |
|---|---|
ToastHeight | |
ToastWidth |
Event ID 1718: Starting to Process the payload for the Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1719: Completed processing the payload for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
#Description
Completed processing the payload for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}. Is this a Special Toast? {IsSpecialToast}.
Message #
Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
IsSpecialToast |
Event ID 1721: Starting to render UI for the Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1722: The Toast Position for the Notification Id : {NotificationId} is - {X-Position} [x]; {Y-Position} [y].
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1723: The Toast Display Index for the Notification Id : {NotificationId} is {DisplayIndex}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
DisplayIndex |
Event ID 1724: Completed rendering UI for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1726: Unable to display Toast for the Notification Id : {NotificationId} as the number of Toasts displayed has reached the max display limit.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1728: Toast for Notification Id {NotificationId} is entering the Opaque State.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1729: Toast for Notification Id {NotificationId} is leaving the Opaque State.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1731: Toast for Notification Id {NotificationId} is entering the Decay State.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1732: Toast for Notification Id {NotificationId} is leaving the Decay State.
#Event ID 1734: Toast for Notification Id {NotificationId} is entering the Working State.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1735: Toast for Notification Id {NotificationId} is leaving the Working State.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1737: User has Activated the Toast for Notification Id {NotificationId}; App Type {AppType}.
#Event ID 1738: Error rendering UI for the Notification Id : {NotificationId}; App Type {AppType}.
#Description
Error rendering UI for the Notification Id : {NotificationId}; App Type {AppType}. Error Code : {OperationStatus}.
Message #
Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1740: User has Dismissed the Toast for Notification Id {NotificationId}.
#Event ID 1742: Starting to remove the Toast for Notification Id {NotificationId} from Display.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1743: Completed removing the Toast for Notification Id {NotificationId} from Display.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1745: The Toast for Notification Id {NotificationId} is completely Opaque and the Close Button has appeared.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1747: Rearranging displayed toasts owing to change in layout.
#Description
Rearranging displayed toasts owing to change in layout. The new start position is - {X-Position} [x]; {Y-Position} [y].
Message #
Event ID 1749: Completed Parsing the payload XML for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1750: API To generate Tile Rendering Data for the Notification Id : {NotificationId}; App Type {AppType} completed with Status {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1751: Error Receiving tile rendering info for the Notification Id : {NotificationId}; App Type {AppType}.
#Description
Error Receiving tile rendering info for the Notification Id : {NotificationId}; App Type {AppType}. Error Code : {OperationStatus}.
Message #
Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1752: Received tile rendering info for the Notification Id : {NotificationId}; App Type {AppType} with Status {OperationStatus}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Event ID 1754: Calling MediaEngine-Play() on Path : {FilePath} for Notification Id : {NotificationId}.
#Event ID 1755: Attempt to MediaEngine-Play() on Path : {FilePath} for Notification Id : {NotificationId} conflicted with playback for Notification Id : {PlayingNo...
#Event ID 1756: Calling MediaEngine-Stop() on Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1757: Playback for Notification Id : {NotificationId} has completed successfully.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1758: Error received during playback for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1759: The Toast Display Index no longer occupied by the Notification Id : {NotificationId} is {DisplayIndex}.
#Fields #
| Name | Description |
|---|---|
NotificationId | |
DisplayIndex |
Event ID 1760: The Toast with Notification Id : {NotificationId} has been queued as overflow.
#Event ID 1761: The Toast with Notification Id : {NotificationId} has been removed from the overflow queue.
#Event ID 1762: The Toast with Notification Id : {NotificationId} has been cancelled.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1763: Cancel Request for Toast with Notification Id : {NotificationId} has been received.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1764: Cancel Request for Toast with Notification Id : {NotificationId} has been stored.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1765: Toast with Notification Id : {NotificationId} has been frozen/thawed.
#Event ID 1766: Error Parsing the payload XML for the Notification Id : {NotificationId}; App Type {AppType}.
#Message #
Fields #
| Name | Description |
|---|---|
NotificationId | |
AppType | |
OperationStatus | NTSTATUS reference |
Node | |
Line | |
Position | |
Payload |
Event ID 1767: Error Activating Application.
#Description
Error Activating Application. Error Code : {OperationStatus}.
Message #
Fields #
| Name | Description |
|---|---|
OperationStatus | NTSTATUS reference |
Event ID 1772: Toast FadeIn Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1773: Toast FadeIn Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1775: Toast FadeOut Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1776: Toast FadeOut Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1778: Toast Entry Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1779: Toast Entry Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1781: Toast Exit Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1782: Toast Exit Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1784: Toast Reposition Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1785: Toast Reposition Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1787: Toast TapUp Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1788: Toast TapUp Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1790: Toast TapDown Animation started for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1791: Toast TapDown Animation stopped for Notification Id : {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1792: The Alarm Toast with Notification Id : {NotificationId} that was pending has now been displayed and removed from the pending slot.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1793: Canceling Alarm Toast with Notification Id : {OutgoingNotificationId} to replace it wilth Alarm Toast with Notification Id : {IncomingNotificationId}.
#Event ID 1794: The Alarm Toast with Notification Id : {NotificationId} has been set as the pending alarm.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 1830: Notifications have been paused for this tile.
#Fields #
| Name | Description |
|---|---|
Result UInt32 | |
AppID UnicodeString |
Event ID 1833: Notifications have been resumed for this tile.
#Fields #
| Name | Description |
|---|---|
Result UInt32 | |
AppID UnicodeString |
Event ID 1843: Notifications have been cleared for this tile.
#Event ID 1858: The Windows Notification platform has failed initialization.
#Event ID 1864: Failed to download image for tile notification.
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 1865: Failed to present the notification for this tile.
#Event ID 2037: Creation of a tile UI object has failed.
#Event ID 2038: The updating of a tile UI object has failed.
#Event ID 2102: Picker_PickerReady
#Event ID 2104: Picker_NavigationStart
#Event ID 2106: Picker_View_ItemToggled
#Event ID 2112: Picker_JumpBar_MenuInvokedStart
#Event ID 2113: Picker_JumpBar_MenuInvokedStop
#Event ID 2114: Picker_ActionButton_ContentChanged
#Event ID 2116: Picker_BusyState_ShownStart
#Event ID 2117: Picker_BusyState_ShownStop
#Event ID 2118: Picker_WaitForApplicationsStart
#Event ID 2119: Picker_WaitForApplicationsStop
#Event ID 2120: Picker_Application_Signalled
#Event ID 2124: Picker_LocationLabel_Updated
#Event ID 2126: PerfTrack_Picker_NavigateLocal_ResponsiveStart
#Event ID 2127: PerfTrack_Picker_NavigateLocal_ResponsiveStop
#Event ID 2128: PerfTrack_Picker_NavigateLocal_ViewCompleteStart
#Event ID 2129: PerfTrack_Picker_NavigateLocal_ViewCompleteStop
#Fields #
| Name | Description |
|---|---|
TotalCount UInt32 |
Event ID 2130: PerfTrack_Picker_Launch_Open_Tile_ResponsiveStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageName UnicodeString |
Event ID 2131: PerfTrack_Picker_Launch_Open_Tile_ResponsiveStop
#Event ID 2134: PerfTrack_Picker_Launch_Open_Thumbnail_ResponsiveStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageName UnicodeString |
Event ID 2135: PerfTrack_Picker_Launch_Open_Thumbnail_ResponsiveStop
#Event ID 2136: PerfTrack_Picker_Launch_Open_Thumbnail_ViewCompleteStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageName UnicodeString |
Event ID 2137: PerfTrack_Picker_Launch_Open_Thumbnail_ViewCompleteStop
#Fields #
| Name | Description |
|---|---|
TotalCount UInt32 |
Event ID 2138: PerfTrack_Picker_Launch_Save_Tile_ResponsiveStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageName UnicodeString |
Event ID 2139: PerfTrack_Picker_Launch_Save_Tile_ResponsiveStop
#Event ID 2140: PerfTrack_Picker_Launch_Save_Tile_ViewCompleteStart
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageName UnicodeString |
Event ID 2141: PerfTrack_Picker_Launch_Save_Tile_ViewCompleteStop
#Fields #
| Name | Description |
|---|---|
TotalCount UInt32 |
Event ID 2146: PerfTrack_Picker_NavigateHG_ResponsiveStart
#Event ID 2147: PerfTrack_Picker_NavigateHG_ResponsiveStop
#Event ID 2148: PerfTrack_Picker_NavigateHG_ViewCompleteStart
#Event ID 2149: PerfTrack_Picker_NavigateHG_ViewCompleteStop
#Fields #
| Name | Description |
|---|---|
TotalCount UInt32 |
Event ID 2150: PerfTrack_Picker_NavigateUNC_ResponsiveStart
#Event ID 2151: PerfTrack_Picker_NavigateUNC_ResponsiveStop
#Event ID 2152: PerfTrack_Picker_NavigateUNC_ViewCompleteStart
#Event ID 2153: PerfTrack_Picker_NavigateUNC_ViewCompleteStop
#Fields #
| Name | Description |
|---|---|
TotalCount UInt32 |
Event ID 2160: Picker_AppInstanceView_HostedApplication
#Event ID 2164: Picker_AppInstanceView_Commit
#Event ID 2165: Picker_AppInstanceView_StartFileUpdate
#Event ID 2166: Picker_AppInstanceView_ProvideSaveFile
#Event ID 2167: Picker_AppInstanceView_CompleteFileUpdate
#Event ID 2168: Picker_AppInstanceView_CompleteFileUpdate2168
#Fields #
| Name | Description |
|---|---|
ClientAllowsUX Boolean | |
FileIsUpdated Boolean |
Event ID 2169: Picker_CachedFileUpdater_UIRequested
#Event ID 2170: Picker_CachedFileUpdater_UIRequested2170
#Event ID 2171: Picker_CachedFileUpdater_UIRequested2171
#Event ID 2172: Picker_CachedFileUpdater_FileUpdateRequested
#Event ID 2173: Picker_CachedFileUpdater_FileUpdateRequested2173
#Event ID 2174: Picker_CachedFileUpdater_FileUpdateRequest
#Event ID 2175: Picker_CachedFileUpdater_FileUpdateRequest2175
#Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
Event ID 2176: Picker_CachedFileUpdater_FileUpdateRequest2176
#Event ID 2177: Picker_CachedFileUpdater_FileUpdateRequestStart
#Fields #
| Name | Description |
|---|---|
ContentId UnicodeString |
Event ID 2178: Picker_CachedFileUpdater_FileUpdateRequestStop
#Fields #
| Name | Description |
|---|---|
Status UInt32 | NTSTATUS reference |
Event ID 2179: Picker_FileSavePickerUI_FileNameChanged
#Fields #
| Name | Description |
|---|---|
FileName UnicodeString |
Event ID 2180: Picker_FileSavePickerUI_TargetFileRequest
#Event ID 2184: Picker_FileOpenPickerUI_ClosingStart
#Event ID 2185: Picker_FileOpenPickerUI_ClosingStop
#Event ID 2200: SharingManager_InitSharingStart
#Event ID 2202: SharingManager_GetSharableItemCountStart
#Event ID 2203: SharingManager_GetSharableItemCountStop
#Fields #
| Name | Description |
|---|---|
AppItemCount UInt32 | |
TotalItemCount UInt32 | |
Result UInt32 |
Event ID 2204: SharingManager_GetSharableItemDescriptionStart
#Fields #
| Name | Description |
|---|---|
Index UInt32 | |
AppItemCount UInt32 |
Event ID 2206: SharingManager_GetSharableItemDataStart
#Fields #
| Name | Description |
|---|---|
Index UInt32 | |
AppItemCount UInt32 |
Event ID 2208: SharingManager_SelectSharableItemStart
#Fields #
| Name | Description |
|---|---|
Index UInt32 | |
AppItemCount UInt32 |
Event ID 2214: SharingManager_GetQuickShareTargetCountStart
#Event ID 2218: SharingManager_ActivateTargetStart
#Event ID 2222: SharingTargetCallback_DoneTransferStart
#Event ID 2224: QuickShareTargetList_SaveQuickShareTargetStart
#Event ID 2226: SharingTargetAppList_QueryTargetsStart
#Event ID 2228: QuickShareTargetList_QueryTargetsStart
#Event ID 2238: Share_InitUIStart
#Event ID 2239: Share_InitUIStop
#Event ID 2240: Share_TransitionContentStart
#Event ID 2241: Share_TransitionContentStop
#Event ID 2244: Share_RunningSharesToView
#Event ID 2245: Share_ViewToRunningShares
#Event ID 2246: PerfTrack_Share_ShowFlowStart
#Event ID 2250: Share_ShowFetchProgressStart
#Event ID 2251: Share_ShowFetchProgressStop
#Event ID 2252: Share_RunningShareEntry
#Event ID 2253: Share_RunningShareEntry2253
#Event ID 2254: SharingManager_GetSharableItemDisplayInfoStart
#Fields #
| Name | Description |
|---|---|
Index UInt32 | |
AppItemCount UInt32 |
Event ID 2256: Share_TransitionViewStart
#Event ID 2257: Share_TransitionViewStop
#Event ID 2258: PerfTrack_Share_InvokeToApplistShownStart
#Event ID 2262: SharingManager_RetrievePackageFamilyNameStart
#Event ID 2264: SharingManager_RetrieveSquare30x30LogoStart
#Event ID 2266: SharingManager_RetrieveLogoBackgroundColorStart
#Event ID 2268: SharingManager_RetrieveSourceAppNameStart
#Event ID 2270: SharingManager_RetrieveAppListingUriStart
#Event ID 2305: Launcher_Apps_HideStart
#Event ID 2306: Launcher_Apps_HideStop
#Event ID 2313: Launcher_OnSearchStart
#Event ID 2314: Launcher_OnSearchStop
#Event ID 2315: Launcher_Apps_ViewChangeStart
#Fields #
| Name | Description |
|---|---|
ViewFromGuid UnicodeString | |
ViewToGuid UnicodeString |
Event ID 2316: Launcher_Apps_ViewChangeStop
#Event ID 2324: Launcher_Apps_SwitchToAllAppsViewFromStart
#Event ID 2325: Launcher_Apps_SwitchToAllAppsViewFromStartStop
#Fields #
| Name | Description |
|---|---|
RenderedTileCount UInt32 | |
RealizedTileCount UInt32 |
Event ID 2326: PerfTrack_DesktopToLauncherTransitionStart
#Event ID 2327: PerfTrack_DesktopToLauncherTransitionStop
#Fields #
| Name | Description |
|---|---|
NumOfVisibleTiles UInt32 |
Event ID 2335: Launcher_ScenarioStart
#Fields #
| Name | Description |
|---|---|
ScenarioId UInt32 | |
ScenarioName UnicodeString |
Event ID 2336: Launcher_ScenarioStop
#Fields #
| Name | Description |
|---|---|
ScenarioId UInt32 | |
ScenarioName UnicodeString |
Event ID 2356: Launcher_OrientationChangeStart
#Event ID 2357: Launcher_OrientationChangeStop
#Event ID 2361: Launcher_Dismiss_Explicit_ToDesktopStart
#Event ID 2363: Launcher_Dismiss_Explicit_ToImmersiveModeStart
#Event ID 2364: Launcher_Dismiss_Explicit_ToImmersiveModeStop
#Fields #
| Name | Description |
|---|---|
HowDismissed UInt32 | |
AppName UnicodeString | |
PackageName UnicodeString |
Event ID 2365: Launcher_Show_FromImmersiveModeStart
#Event ID 2366: Launcher_Show_FromImmersiveModeStop
#Event ID 2368: Launcher_Apps_SwitchToStartViewFromAllAppsViewStart
#Event ID 2369: Launcher_Apps_SwitchToStartViewFromAllAppsViewStop
#Event ID 2373: PerfTrack_AppSearch_ViewCompleteStart
#Event ID 2374: PerfTrack_AppSearch_ViewCompleteStop
#Event ID 2382: PerfTrack_AppSearch_ViewCompleteStop2382
#Event ID 2451: PerfTrack_PLM_SuspendApplicationStop_V1
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString | |
Packed_Hi_RequestedTimeoutExtensionMs16_Flags11_Crashed1_Throttled1_EnforceTimeout1_IsChild1_TimedOut1_Lo UInt32 | |
Packed_Hi_ModeSwitchesToUnthrottledCount2_IoOpportunityTime100Ms10_CpuReadyTime100Ms10_CpuRunningTime100Ms10_Lo UInt32 |
Event ID 2453: PLM_UserLogoff
#Event ID 2454: PLM_ConnectedStandby
#Event ID 2464: PerfTrack_PLM_ResumeApplicationStop_V1
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString | |
PackedResumeDurationsMs_HiWordAppLoWordPackage UInt32 | |
Flags UInt32 |
Event ID 2468: PLM_MemoryPolicy
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
Reason UInt32 | |
HiFlags_LoAppCount UInt32 | |
HiThreshold_LoCurrentMetric UInt32 | |
SumOfPrivateWsOrSumOfSwapUsageOrPrivateModifiedSize UInt32 |
Event ID 2472: PerfTrack_PLM_ResumeApplication
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
ResumeReason UInt32 |
Event ID 2473: PLM_ApplicationStateChange
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
OldState UInt32 | |
NewState UInt32 |
Event ID 2474: PLM_PSM_WakeCounterChange
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
UserRequest UInt32 | |
ExecutionRequest UInt32 | |
KernelRequest UInt32 |
Event ID 2480: PLM_TerminateApp_APIStart
#Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | |
Flags UInt32 |
Event ID 2481: PLM_TerminateApp_APIStop
#Fields #
| Name | Description |
|---|---|
AppUserModelId UnicodeString | |
PendingTaskCompletions UInt32 | |
DeferredTerminate Boolean | |
Result UInt32 |
Event ID 2484: Package PsmKey was terminated because it took too long to suspend.
#Event ID 2485: Package {PsmKey} was terminated due to low system resources.
#Fields #
| Name | Description |
|---|---|
PsmKey |
Event ID 2486: App PsmKey did not launch within its allotted time.
#Event ID 2491: PLM_TaskCompletion
#Fields #
| Name | Description |
|---|---|
TaskCompletionType UInt32 | |
PackageFullName UnicodeString |
Event ID 2492: PLM_TaskCompletion2492
#Fields #
| Name | Description |
|---|---|
TaskCompletionType UInt32 | |
PackageFullName UnicodeString |
Event ID 2493: PLM_ConnectedStandby2493
#Event ID 2494: PLM_ConnectedStandby2494
#Event ID 2495: PLM_ConnectedStandby2495
#Fields #
| Name | Description |
|---|---|
PresentNonBlockingTaskCompletions UInt32 |
Event ID 2500: UserTile_Flyout_LaunchStart
#Event ID 2501: UserTile_Flyout_LaunchStop
#Event ID 2504: PerfTrack_UserSwitchingStart
#Event ID 2601: Settings_SettingsLaunchStart
#Event ID 2602: Settings_SettingsLaunchStop
#Event ID 2607: Settings_SettingsLoadAppWidgetsBGStart
#Event ID 2609: Settings_SettingsLoadAppWidgetsBGStop
#Event ID 2611: Settings_SettingsLoadAppElementsStart
#Event ID 2612: Settings_SettingsLoadAppElementsStop
#Event ID 2614: Settings_PermissionsLaunchStart
#Event ID 2615: Settings_PermissionsLaunchStop
#Event ID 2617: Settings_PermissionsLoadItemsStart
#Event ID 2619: Settings_PermissionsLoadItemsStop
#Event ID 2625: Settings_SettingsFlowStart
#Event ID 2626: Settings_SettingsFlowStop
#Event ID 2631: Settings_SettingsLifetimeStart
#Event ID 2632: Settings_SettingsLifetimeStop
#Event ID 2634: Settings_PermissionsLifetimeStart
#Event ID 2635: Settings_PermissionsLifetimeStop
#Event ID 2667: Settings_HotkeyInvoke
#Event ID 2682: Settings_Launch_PermissionsStart
#Event ID 2683: Settings_Launch_PermissionsStop
#Event ID 2685: Settings_Launch_RateAndReviewStart
#Event ID 2686: Settings_Launch_RateAndReviewStop
#Event ID 2688: Settings_Flow_Broker_ShowStart
#Event ID 2691: Settings_Launch_AccountsStart
#Event ID 2692: Settings_Launch_AccountsStop
#Event ID 2694: Settings_Launch_PrivacyPolicyStart
#Event ID 2695: Settings_Launch_PrivacyPolicyStop
#Event ID 2801: The template requested by a tile notification has failed to parse.
#Event ID 2802: The template requested by a tile notification does not exist.
#Event ID 2803: The content of a tile notification does not match the chosen template.
#Event ID 2806: TileUI_TileActivatedEvent_Fired
#Fields #
| Name | Description |
|---|---|
ApplicationId UnicodeString | |
ActivationParameters UnicodeString |
Event ID 2820: A new notification has arrived for a tile.
#Event ID 2823: The image could not be loaded because it is not a PNG or JPEG
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 2824: The image could not be loaded because it is too large
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 2825: The image could not be loaded because the provided path does not exist
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 2826: The image that was loaded is incorrect given the current DPI and/or theme
#Event ID 2827: The image could not be loaded because the protocol handler used is invalid
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 2828: A notification for this tile expired while it was visible
#Event ID 2829: Tile_ImageLoad_Success
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
NotificationID UInt32 |
Event ID 2836: TileUI_CrossSlide
#Event ID 2838: The processing of a tile notification has failed.
#Event ID 2839: A tile notification has been marked as known bad and will never be processed again.
#Event ID 2850: A tile has attempted to load an image off disk.
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
EncodedFilePath UnicodeString |
Event ID 2924: TDBN_AudioFlyout_DisplayStart
#Event ID 2930: TDBN_AudioFlyout_DisplayStop
#Event ID 3000: Failed to register for licensing policy change event.
#Event ID 3002: Failed to load the genuine licensing image.
#Event ID 3003: Failed to blend the genuine licensing image.
#Event ID 3004: Failed to render the watermark.
#Event ID 3005: Failed to get genuine status.
#Event ID 3103: AutoPlay_Prompt_ShowStart
#Event ID 3106: AutoPlay_DialogThreadStop
#Event ID 3107: AutoPlay_DialogNoContentThreadStart
#Event ID 3113: AutoPlay_Calculate_Response_TimeStart
#Event ID 3152: AutoPlay_Volume_NthConnect_ToUI
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3153: AutoPlay_Volume_NthConnect_ToDefaultLaunch
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3154: AutoPlay_Device_FirstConnect_ToUI
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3155: AutoPlay_Device_FirstConnect_ToDefaultLaunch
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3156: AutoPlay_Device_NthConnect_ToUI
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3157: AutoPlay_Device_NthConnect_ToDefaultLaunch
#Fields #
| Name | Description |
|---|---|
Duration UInt32 | |
DeviceHardwareID UnicodeString | |
Manufacturer UnicodeString | |
ModelName UnicodeString | |
PrimaryCategory UnicodeString |
Event ID 3201: EdgeUi_Invoke_Continuous_Commit
#Event ID 3202: EdgeUi_Invoke_Continuous_Cancel
#Event ID 3206: EdgeUi_Inputs_Layout_Complete
#Event ID 4007: AssociationLaunch_ServerInitializationStart
#Event ID 4008: AssociationLaunch_ServerInitializationStop
#Event ID 4015: Windows.
#Event ID 4016: Windows.
#Description
Windows.System.Launcher.LaunchFileAsync failed because the launched file has no file extension.
Message #
Event ID 4017: Windows.
#Description
Windows.System.Launcher.LaunchFileAsync failed because the current group policy settings prohibit launching desktop programs through this API.
Message #
Event ID 4018: Windows.
#Event ID 4019: Windows.
#Description
Windows.System.Launcher.LaunchUriAsync failed because the current group policy settings prohibit launching desktop programs through this API.
Message #
Event ID 4020: Windows.
#Event ID 4021: Windows.
#Description
Windows.System.Launcher.LaunchUriAsync failed because file URI has no file extension.
Message #
Event ID 4022: Windows.
#Event ID 4023: Windows.
#Event ID 4024: Windows.
#Event ID 4300: The Monitor Manager is adding a new display with identity {MonitorIdentity}.
#Fields #
| Name | Description |
|---|---|
MonitorIdentity |
Event ID 4301: The Monitor Manager is adding a new display with identity {MonitorIdentity}.
#Fields #
| Name | Description |
|---|---|
MonitorIdentity |
Event ID 4302: The Monitor Manager is adding a new display with identity MonitorIdentity.
#Event ID 4303: The Monitor Manager is adding a new display with identity {MonitorIdentity}.
#Fields #
| Name | Description |
|---|---|
MonitorIdentity |
Event ID 4312: The Monitor Manager is handling a display change notification.
#Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 |
Event ID 4313: The Monitor Manager is handling a display change notification.
#Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 |
Event ID 4314: The Monitor Manager is handling a display change notification.
#Event ID 4315: The Monitor Manager is handling a display change notification.
#Event ID 4316: An object is being connected to the Monitor MonitorIdentity.
#Event ID 4317: An object is being connected to the Monitor MonitorIdentity.
#Event ID 4318: The Monitor manager is reconciling monitors
#Event ID 4319: The Monitor manager is reconciling monitors
#Event ID 4320: The Monnitor Manager could not create a monitor identity.
#Event ID 4325: ImmersiveMonitorCreatePerMonitorComponents
#Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 | |
HMonitor Pointer | |
Left UInt32 | |
Top UInt32 |
Event ID 4326: ImmersiveMonitorDestroyPerMonitorComponents
#Fields #
| Name | Description |
|---|---|
MonitorIdentity UInt32 | |
HMonitor Pointer | |
Left UInt32 | |
Top UInt32 |
Event ID 4636: The tile cache has run out of room in its header.
#Event ID 4637: The tile cache cannot expand because the hard disk is full.
#Event ID 4668: The tile cache has suffered a CRC failure for this entry's data region.
#Fields #
| Name | Description |
|---|---|
EntryID UInt32 |
Event ID 4669: The tile cache has suffered a CRC failure for this entry's entry/header region.
#Fields #
| Name | Description |
|---|---|
EntryID UInt32 |
Event ID 4672: A reordering of the tile cache file has failed.
#Event ID 4673: A reordering of the tile logo cache file has failed.
#Event ID 4676: The Optimize Start menu cache files task has been requested due to a layout change.
#Event ID 5901: PerfTrack_AppActivation_ActivateStart_V1
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageMoniker UnicodeString | |
SqmableContractID UnicodeString | |
ExeName UnicodeString | |
PreviousExecutionState UInt32 | |
Opportunistic UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5901,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 7644,
"thread_id": 8564
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:36.594Z",
"version": 0
},
"event_data": {
"AppID": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
"ExeName": "SystemSettings.exe",
"Opportunistic": 1,
"PackageMoniker": "windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy",
"PreviousExecutionState": 0,
"SqmableContractID": "Windows.Protocol"
},
"message": ""
}
Event ID 5902: PerfTrack_AppActivation_ActivateStop_V1
#Fields #
| Name | Description |
|---|---|
AppID UnicodeString | |
PackageMoniker UnicodeString | |
SqmableContractID UnicodeString | |
ExeName UnicodeString | |
PreviousExecutionState UInt32 | |
Opportunistic UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5902,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 7644,
"thread_id": 8564
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:34.614Z",
"version": 0
},
"event_data": {
"AppID": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
"ExeName": "SystemSettings.exe",
"Opportunistic": 1,
"PackageMoniker": "windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy",
"PreviousExecutionState": 0,
"SqmableContractID": "Windows.Protocol"
},
"message": ""
}
Event ID 5903: AppActivation_ActivateApplicationForContractStart
#Event ID 5904: AppActivation_ActivateApplicationForContractStop
#Event ID 5905: AppActivation_ActivateApplicationForContractByAppIDStart
#Event ID 5906: AppActivation_ActivateApplicationForContractByAppIDStop
#Event ID 5907: AppActivation_ActivateExtensionForContractStart
#Fields #
| Name | Description |
|---|---|
ActivationOptions UInt32 |
Event ID 5915: AppActivation_RPCTimeoutSet
#Event ID 5919: AppActivation_PackageActivationSettings
#Fields #
| Name | Description |
|---|---|
PackageActivationSettings UInt32 |
Event ID 5921: AppActivation_ErrorDialogDisplayed
#Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ErrorCode UInt32 | |
DialogId GUID |
Event ID 5922: AppActivation_ErrorDialogDismissed
#Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ErrorCode UInt32 | |
DialogId GUID | |
DismissMethod UInt32 |
Event ID 5924: AppActivation_RPCTimeout
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
TimeOutPeriod UInt32 |
Event ID 5928: AppActivation_RPCTimeout_WaitStop
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
WaitSignal UInt32 |
Event ID 5929: AppActivation_ActivateApplicationForComponentUIByAUMIDStart
#Event ID 5930: AppActivation_ActivateApplicationForComponentUIByAUMIDStop
#Event ID 5950: The app AppId was activated for the ContractId contract successfully.
#Event ID 5951: The app AppId is not registered for the ContractId contract or is not installed.
#Event ID 5952: The app AppId has more than one extension registered for the ContractId contract.
#Event ID 5953: The app AppId's package family (ContractId) has more than one package installed.
#Event ID 5954: The app AppId could not be activated for the ContractId contract because UAC is disabled.
#Event ID 5955: The app AppId could not be activated for the ContractId contract because the current user is an Administrator with a full token.
#Event ID 5956: Activation of the app AppId for the ContractId contract was blocked because the activation attempt occurred in an elevated context.
#Event ID 5957: The app {AppId} could not be activated for the {ContractId} contract because the current screen resolution is below 1024x768.
#Fields #
| Name | Description |
|---|---|
AppId | |
ContractId |
Event ID 5958: The app AppId could not be activated for the ContractId contract because Desktop Composition is disabled.
#Event ID 5959: Activation of the app AppId for the ContractId contract timed out.
#Event ID 5961: Activation for AppId failed.
#Description
Activation for AppId failed. Error code: ErrorCode. Activation phase: PhaseFlags.
Message #
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ErrorCode Int32 | 1 failed. Error code. |
PhaseFlags UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Immersive-Shell",
"guid": "315A8872-923E-4EA2-9889-33CD4754BF64",
"event_source_name": "",
"event_id": 5961,
"version": 0,
"level": 2,
"task": 5961,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2023-10-25T22:11:30.700709+00:00",
"event_record_id": 5,
"correlation": {
"ActivityID": "028F2288-078F-0000-DBA0-8F028F07DA01"
},
"execution": {
"process_id": 4820,
"thread_id": 4516
},
"channel": "Microsoft-Windows-TWinUI/Operational",
"computer": "WinDevEval",
"security": {
"user_id": "S-1-5-21-2533829718-189860685-2477588761-500"
}
},
"event_data": {
"AppId": "Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy!App",
"ErrorCode": -2144927141,
"PhaseFlags": 34
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5962: Activation of the app failed with error: ErrorCode.
#Event ID 5963: Activation of the app AppId for the ContractId contract was blocked by policy.
#Event ID 5964: The app AppId could not be activated for the ContractId contract because the app manager is not running.
#Event ID 5965: AppActivation_AppSpinupStep
#Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ErrorCode UInt32 |
Event ID 5966: AppActivation_AppSpinupStep5966
#Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ErrorCode UInt32 |
Event ID 5967: AppActivation_AppSpinupStep5967
#Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ProcessId UInt32 |
Event ID 5970: Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with application binary FailedBinary.
#Description
Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with application binary FailedBinary. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with. Reinstall the application to fix this issue.
Message #
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ErrorCode UInt32 | |
FailedBinary UnicodeString |
Event ID 5971: Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with Windows binary FailedBinary.
#Description
Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with Windows binary FailedBinary. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with. Refresh your PC to fix this issue.
Message #
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ErrorCode UInt32 | |
FailedBinary UnicodeString |
Event ID 5972: Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with binary FailedBinary.
#Description
Activation of the app AppId for the ContractId contract was blocked with error ErrorCode because of an issue with binary FailedBinary. This could be because the binary is unsigned, contains an untrusted signature, or has been corrupted or tampered with. See http://go.microsoft.com/fwlink/?LinkID=246710 for more information.
Message #
Fields #
| Name | Description |
|---|---|
AppId UnicodeString | |
ContractId UnicodeString | |
ErrorCode UInt32 | |
FailedBinary UnicodeString |
Event ID 5973: Activation of app AppId failed with error: ErrorCode See the Microsoft-Windows-TWinUI/Operational log for additional information.
#Event ID 5974: Activation of the app AppId for the ContractId contract was blocked because of a temporary issue with its license.
#Event ID 5975: Activation of the app AppId for the ContractId contract was blocked because its package is being updated.
#Event ID 5976: Activation of the app AppId for the ContractId contract was blocked because its trial license has expired.
#Event ID 5977: PerfTrack_ModernApp_LaunchVisibleCompleteStart
#Fields #
| Name | Description |
|---|---|
Reserved UInt32 | |
MatchKey UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5977,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 7644,
"thread_id": 8564
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:26.702Z",
"version": 0
},
"event_data": {
"MatchKey": "windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy+microsoft.windows.immersivecontrolpanel",
"Reserved": 0
},
"message": ""
}
Event ID 5978: PerfTrack_ModernApp_LaunchResponsiveStart
#Fields #
| Name | Description |
|---|---|
aamActivationId UInt64 | |
AppId UnicodeString | |
MatchKey UnicodeString |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5978,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 7644,
"thread_id": 8564
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:26.702Z",
"version": 0
},
"event_data": {
"AppId": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
"MatchKey": "windows.immersivecontrolpanel_10.0.6.1000_neutral_neutral_cw5n1h2txyewy+microsoft.windows.immersivecontrolpanel",
"aamActivationId": 284
},
"message": ""
}
Event ID 5979: PerfTrack_ModernApp_ResumeVisibleCompleteStart
#Fields #
| Name | Description |
|---|---|
Reserved UInt32 | |
MatchKey UnicodeString |
Event ID 5980: PerfTrack_ModernApp_ResumeResponsiveStart
#Fields #
| Name | Description |
|---|---|
Reserved UInt32 | |
MatchKey UnicodeString |
Event ID 5981: PerfTrack_ModernApp_ResizeVisibleCompleteStart
#Fields #
| Name | Description |
|---|---|
Reserved UInt32 | |
ViewId UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5981,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 10300
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:29.053Z",
"version": 0
},
"event_data": {
"Reserved": 0,
"ViewId": 4294967295
},
"message": ""
}
Event ID 5982: PerfTrack_ModernApp_ResizeResponsiveStart
#Fields #
| Name | Description |
|---|---|
Reserved UInt32 | |
ViewId UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 5982,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 10300
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:29.053Z",
"version": 0
},
"event_data": {
"Reserved": 0,
"ViewId": 4294967295
},
"message": ""
}
Event ID 5983: Activation of the app AppId for the ContractId contract failed during verifcation and initialization with ErrorCode.
#Event ID 5984: Activation of the app AppId for the ContractId contract failed during activation initialization with ErrorCode.
#Event ID 5985: ActivateApplicationForContractByAppIdAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 5986: ActivateApplicationForContractByExtensionIdAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 5987: ActivateApplicationForContractByAppIdAsUserWithHostReturnsApp of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 5988: ActivateApplicationForContractByAcidAsUserWithHost of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 5989: ActivateApplicationForComponentUIByAUMID of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 5990: Activation via contract helper of the app AppId for the ContractId contract failed with ErrorCode.
#Event ID 6200: Docking Service: GetAvailable called.
#Event ID 6201: Docking Service: GetAvailable called.
#Event ID 6202: Docking Service: ReserveDockingSpace called.
#Event ID 6203: Docking Service: ReserveDockingSpace called.
#Event ID 6204: Docking Service: DockWindow called.
#Event ID 6205: Docking Service: DockWindow called.
#Event ID 6206: Docking Service: UndockWindow called.
#Event ID 6207: Docking Service: UndockWindow called.
#Event ID 6208: Docking Service: Handling work area / resolution changes.
#Event ID 6209: Docking Service: Handling work area / resolution changes.
#Event ID 6253: SplashScreen_ImageLoadStop
#Event ID 6256: SplashScreen_ActivationStart
#Event ID 6257: SplashScreen_ActivationStop
#Event ID 6400: AppList_PopulateElementWithExtensionTilesStart
#Event ID 6401: AppList_PopulateElementWithExtensionTilesStop
#Event ID 6402: AppList_CreateExtensionListStart
#Event ID 6403: AppList_CreateExtensionListStop
#Event ID 6404: AppList_GetFilteredAndSortedExtensionListStart
#Event ID 6405: AppList_GetFilteredAndSortedExtensionListStop
#Event ID 6406: AppList_PinItemStart
#Event ID 6407: AppList_PinItemStop
#Event ID 6408: AppList_UnpinItemStart
#Event ID 6409: AppList_UnpinItemStop
#Event ID 6410: AppList_HideItemStart
#Event ID 6411: AppList_HideItemStop
#Event ID 6412: AppList_UnhideItemStart
#Event ID 6413: AppList_UnhideItemStop
#Event ID 6501: Setting for AppId: AppUserModelID has been changed to SettingValue from Permissions View.
#Event ID 6502: Setting for AppId: AppUserModelID has enabled = SettingValue in Permissions View.
#Event ID 6503: Setting for AppId: AppUserModelID is supported in Permissions View?
#Event ID 6505: Global Toast Setting has changed to {SettingValue} from setting flyout.
#Fields #
| Name | Description |
|---|---|
SettingValue |
Event ID 6506: Setting Sync Scheduled for Package: PackageFamilyName on behalf of AppUserModelId: AppUserModelID.
#Event ID 6510: User Session Toast Manager has sent Display Message to Lock Screen for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6511: User Session Toast Manager has sent Cancel Message to Lock Screen for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6512: User Session Toast Manager has received Activate Message from Lock Screen for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6513: User Session Toast Manager has received Dismiss Message from Lock Screen for Notification Id: {NotificationId} Is Decayed?
#Event ID 6514: User Session Toast Manager has received Pause Message from Lock Screen for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6515: User Session Toast Manager has received Selection Message from Lock Screen for Notification Id: {NotificationId} IsSelected?
#Event ID 6516: User Session Toast Manager has received Frozen Message from Lock Screen.
#Event ID 6521: Lock Screen Toast Manager has received a display toast message for Notification Id: {NotificationId} Is Long Duration?
#Event ID 6522: Lock Screen Toast Manager has received a cancel message for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6523: Lock Screen Toast Manager has received frozen message from Lock Screen.
#Event ID 6525: Lock Screen Toast Manager has sent selection message to Lock Screen for Notification Id: {NotificationId} Is Selected?
#Event ID 6526: Lock Screen Toast Manager has sent dismissed message to Lock Screen for Notification Id: {NotificationId}.
#Event ID 6527: Lock Screen Toast Manager has sent pause message to Lock Screen for Notification Id: {NotificationId}.
#Fields #
| Name | Description |
|---|---|
NotificationId |
Event ID 6529: Notifications Settings Charm Widget has closed its context menu with result {MenuOption}.
#Fields #
| Name | Description |
|---|---|
MenuOption |
Event ID 6530: Notifications Settings Charm Widget has updated its UI to state {MenuOption}.
#Fields #
| Name | Description |
|---|---|
MenuOption |
Event ID 6531: Toast Dropped due to Quiet Hours.
#Event ID 6601: ConnectCharm_PrintStart
#Fields #
| Name | Description |
|---|---|
SessionID UInt32 | |
DeviceInstanceID UnicodeString |
Event ID 6612: ConnectCharm_PlayStop
#Fields #
| Name | Description |
|---|---|
DeviceInstanceID UnicodeString | |
Connected Boolean |
Event ID 6621: ConnectCharm_ProjectStart
#Event ID 6622: ConnectCharm_ProjectStop
#Event ID 6631: ConnectCharm_ProximitySendDisplayUiStart
#Event ID 6636: ConnectCharm_ProximitySendSupportCheckStart
#Event ID 6637: ConnectCharm_ProximitySendSupportCheckStop
#Event ID 6644: ConnectCharm_PrintSourceEvaluateStart
#Event ID 6647: ConnectCharm_PlaytoSourceEvaluateStart
#Event ID 6650: ConnectCharm_DisplayUI_EndToEndStart
#Event ID 6653: ConnectCharm_DisplayHierarchyUIStart
#Event ID 6654: ConnectCharm_DisplayHierarchyUIStop
#Event ID 6690: The request for a Print Task timed out for application AppId.
#Event ID 6691: The request for a Play Source timed out for application AppId.
#Event ID 6720: ImmersiveOpenWithUI_CreateAndShowStart
#Event ID 6721: ImmersiveOpenWithUI_CreateAndShowStop
#Event ID 6723: ImmersiveOpenWithUI_InvokeApp
#Event ID 6820: LockScreen_AddInvokedStart
#Event ID 6822: LockScreen_AddOperationStart
#Event ID 6824: LockScreen_AddDialogDisplayedStart
#Event ID 6825: LockScreen_AddDialogDisplayedStop
#Event ID 6826: LockScreen_AddContentionFlyoutDisplayedStart
#Event ID 6828: task_0
#Event ID 6844: SecondaryTile_FlyoutFlipViewButtonPressStart
#Event ID 6845: SecondaryTile_FlyoutFlipViewButtonPressStop
#Event ID 6850: Checking secondary tile roaming quota.
#Event ID 6851: Finished checking secondary tile roaming quota with HRESULT HRESULT, quota Quota bytes, current usage CurrentUsage bytes.
#Event ID 6852: Enforcing secondary tile roaming quota - need to reduce BytesToReduce bytes.
#Event ID 6853: Finished enforcing secondary tile roaming quota with HRESULT HRESULT, reclaimed BytesReclaimed bytes.
#Event ID 6854: SecondaryTileQuota_EnforceQuota
#Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | |
Path UnicodeString | |
Size UInt32 | |
Visible Boolean |
Event ID 6855: SecondaryTileQuota_CleanupOrphanFilesStart
#Fields #
| Name | Description |
|---|---|
NumOrphanFiles UInt32 |
Event ID 6856: SecondaryTileQuota_CleanupOrphanFilesStop
#Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | |
BytesReclaimed UInt32 |
Event ID 6857: SecondaryTileQuota_CleanupOrphanFiles
#Fields #
| Name | Description |
|---|---|
HRESULT UInt32 | |
Path UnicodeString | |
Size UInt32 | |
Visible Boolean |
Event ID 7039: Launcher_Apps_SwitchToAllAppsViewFromSearchStart
#Event ID 7040: Launcher_Apps_SwitchToAllAppsViewFromSearchStop
#Fields #
| Name | Description |
|---|---|
RenderedTileCount UInt32 | |
RealizedTileCount UInt32 |
Event ID 7130: LockscreenApplications_LoadPopupStart
#Event ID 7131: LockscreenApplications_LoadPopupStop
#Event ID 7150: Entering SetUseConnectedSearch API.
#Event ID 7151: Entering SetLocationAwareness API.
#Event ID 7152: Entering SetSafeSearch API.
#Event ID 7153: Entering DeleteOnlineSearchHistory API.
#Event ID 7154: Entering DeleteLocalSearchHistory API.
#Event ID 7155: Exiting DeleteOnlineHistory API - HRESULT: 0xErrorResult.
#Event ID 7156: Exiting DeleteLocalHistory API - HRESULT: 0xErrorResult.
#Event ID 7157: Exiting SetUseConnectedSearch API - ChangeTo: ChangeTo.
#Event ID 7158: Exiting SetLocationAwareness API - ChangeTo: ChangeTo.
#Event ID 7159: Exiting SetSafeSearch API - ChangeTo: ChangeTo.
#Event ID 7160: Entering LogDetailArrowClick API call.
#Event ID 7162: Entering LogDetailArrowClick background worker.
#Event ID 7163: Exiting LogDetailArrowClick background worker.
#Event ID 7164: Entering LogAttributionClick API call.
#Event ID 7166: Entering LogAttributionClick background worker.
#Event ID 7167: Exiting LogAttributionClick background worker.
#Event ID 7168: Detail Arrow Click Properties JSON Payload serialized - Payload: JSON.
#Event ID 7169: Attribution Click Properties JSON Payload serialized - Payload: JSON.
#Event ID 7170: Details Visibility JSON Payload serialized - Payload: JSON.
#Event ID 7171: Attribution Visibility JSON Payload serialized - Payload: JSON.
#Event ID 7172: App Bar Click JSON Payload serialized - Payload: JSON.
#Event ID 7173: Detail Arrow Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId, Arrow Direction: ArrowDirection.
#Event ID 7174: Detail View Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, IsVisible?
#Event ID 7175: Attribution Overlay Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId.
#Event ID 7176: Attribution Overlay Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, IsVisible?
#Event ID 7177: App Bar Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Telemetry Id: TargetId, Command Id: CommandId.
#Event ID 7178: Entering LogDetailsViewVisibility API call.
#Event ID 7180: Entering LogDetailsViewVisibility background worker.
#Event ID 7181: Exiting LogDetailsViewVisibility background worker.
#Event ID 7182: Entering LogAttributionVisibility API call.
#Event ID 7184: Entering LogAttributionVisibility background worker.
#Event ID 7185: Exiting LogAttributionVisibility background worker.
#Event ID 7186: Entering LogAppBarClick API call.
#Event ID 7188: Entering LogAppBarClick background worker.
#Event ID 7189: Exiting LogAppBarClick background worker.
#Event ID 7190: Local Suggestion JSON Payload serialized - Payload: JSON.
#Event ID 7191: Perf Ping JSON Payload serialized - Payload: JSON.
#Event ID 7192: Entering GetInstrumenationForDirectQuery API call.
#Event ID 7193: Exiting GetInstrumenationForDirectQuery API call.
#Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 |
Event ID 7194: Direct Query Instrumentation Processing Complete - Error Code: Result, Partial Query: PartialQuery, Number of Suggestions Shown: SelectedPosition, Max Query Length With Sugges...
#Description
Direct Query Instrumentation Processing Complete - Error Code: Result, Partial Query: PartialQuery, Number of Suggestions Shown: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrumentation Payload: Payload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
PartialQuery UnicodeString | |
SelectedPosition UInt32 | |
MaxQueryLengthWithSuggestion UInt32 | |
Payload UnicodeString |
Event ID 7195: Entering LogParsingError API call.
#Event ID 7197: Entering LogParsingError background worker.
#Event ID 7198: Exiting LogParsingError background worker.
#Event ID 7199: Parsing Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
#Event ID 7200: Active Impression GUID has been set - Operation Error Code: Result, Impression GUID: ImpressionGUID.
#Event ID 7202: ConnectedSearch_ServiceLoadStop
#Event ID 7203: ConnectedSearch_ServiceLoad
#Event ID 7204: Instrumentation Payload dropped because Impression Guid was not set - Dropped Instrumentation API: DroppedAPIcall.
#Event ID 7205: Entering LogWebResultClick API call.
#Event ID 7207: Entering LogWebResultClick background worker.
#Event ID 7208: Exiting LogWebResultClick background worker.
#Event ID 7209: Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Target ID: TargetId, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewpo...
#Description
Click Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Target ID: TargetId, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
TargetId UnicodeString | |
InputMethod UInt32 | |
FirstItemId UnicodeString | |
LastItemId UnicodeString | |
ViewportFlags UInt32 |
Event ID 7210: Click Event JSON Serialization Complete - Input Method: InputMethod, Timestamp: ViewMode, IsLandscape: Timestamp, JSON: JSON.
#Event ID 7211: Instrumentation Event Enqueued for Upload - Impression GUID: ImpressionGUID, Timestamp: Timestamp, HRESULT: ErrorCode, Url: Url, HBT: HBT.
#Event ID 7212: Instrumentation Event Dequeued for Upload - Impression GUID: ImpressionGUID, Timestamp: Timestamp, JSON: JSON.
#Event ID 7213: Instrumentation Payload uploaded - POST Payload: Body, Query String: QueryString Error Code: Result.
#Event ID 7214: Connection Established to Instrumentation Endpoint - Endpoint Id: EndpointCode, Host Name: Hostname, Object Name: ObjectName, User Agent: UserAgent.
#Event ID 7215: Upload Request sent to Instrumentation Endpoint - HTTP Response Code: HTTPResponseCode, HTTP Request Headers: HTTPHeaders, HTTP Post Payload: HTTPPostPayload.
#Event ID 7216: Authentication has started
#Event ID 7217: Authentication has stopped
#Event ID 7218: Authentication has succeeded
#Event ID 7219: Authentication failed - Error Code: 0xErrorResult.
#Event ID 7221: HTTP Request failed - Error Code: 0xErrorResult.
#Event ID 7222: Entering LogLocalResultClick API call.
#Event ID 7224: Entering LogLocalResultClick background worker.
#Event ID 7225: Exiting LogLocalResultClick background worker.
#Event ID 7226: Entering LogScroll API call.
#Event ID 7228: Entering LogScroll background worker.
#Event ID 7229: Exiting LogScroll background worker.
#Event ID 7232: Entering LogWebLayoutChange API call.
#Event ID 7234: Entering LogWebLayoutChange background worker.
#Event ID 7235: Exiting LogWebLayoutChange background worker.
#Event ID 7236: Entering LogLocalLayoutChange API call.
#Event ID 7238: Entering LogLocalLayoutChange background worker.
#Event ID 7239: Exiting LogLocalLayoutChange background worker.
#Event ID 7241: Entering LogAppVisibilityChange API call.
#Event ID 7243: Entering LogAppVisibilityChange background worker.
#Event ID 7244: Exiting LogAppVisibilityChange background worker.
#Event ID 7245: Entering LogAppResize API call.
#Event ID 7247: Entering LogAppResize background worker.
#Event ID 7248: Exiting LogAppResizeChange background worker.
#Event ID 7249: Scroll Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Scroll Direction: ScrollDirection, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastI...
#Description
Scroll Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Scroll Direction: ScrollDirection, Input Method: InputMethod, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
ScrollDirection UInt32 | |
InputMethod UInt32 | |
FirstItemId UnicodeString | |
LastItemId UnicodeString | |
ViewportFlags UInt32 |
Event ID 7250: App Visibility Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, New Visibility State: NewVisibilityState.
#Event ID 7251: App Resize Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Orientation: Orientation, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportF...
#Description
App Resize Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Orientation: Orientation, First Item ID: FirstItemId, Last Item ID: LastItemId, Viewport Flags: ViewportFlags.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
Orientation UInt32 | |
FirstItemId UnicodeString | |
LastItemId UnicodeString | |
ViewportFlags UInt32 |
Event ID 7252: Web Layout Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Telemetry Id affected: TelemetryId.
#Event ID 7253: Local Layout Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Item Type: ResultType.
#Event ID 7254: CI.
#Event ID 7255: CI.
#Event ID 7256: CI.
#Event ID 7257: L.
#Event ID 7258: UnAuthentication has started
#Event ID 7259: UnAuthentication has stopped
#Event ID 7261: UnAuthentication failed - Error Code: 0xErrorResult.
#Event ID 7262: UnAuthentication has succeeded: all cookies are cleared
#Event ID 7263: Authentication failed in getting the token- Error Code: 0xErrorResult.
#Event ID 7264: Entering LogHttpError API call.
#Event ID 7266: Entering LogHttpError background worker.
#Event ID 7267: Exiting LogHttpError background worker.
#Event ID 7268: HTTP Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Url: Url, Error HBT: HBT.
#Event ID 7270: Entering LogSuggestion API call.
#Event ID 7272: Entering LogSuggestion background worker.
#Event ID 7273: Exiting LogSuggestion background worker.
#Event ID 7274: Suggestion Event Processing Complete - Error Code: Result, Partial Query: PartialQuery, Selected Position: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrume...
#Description
Suggestion Event Processing Complete - Error Code: Result, Partial Query: PartialQuery, Selected Position: SelectedPosition, Max Query Length With Suggestion: MaxQueryLengthWithSuggestion, Instrumentation Payload: Payload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
PartialQuery UnicodeString | |
SelectedPosition UInt32 | |
MaxQueryLengthWithSuggestion UInt32 | |
Payload UnicodeString |
Event ID 7276: CI.
#Event ID 7277: Entering LogPerfPing API call.
#Event ID 7279: Entering LogPerfPing background worker.
#Event ID 7280: Exiting LogPerfPing background worker.
#Event ID 7282: Perf Ping Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Data Center: DataCenter, Was Abandoned?
#Description
Perf Ping Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Data Center: DataCenter, Was Abandoned?: IsAbandoned. JSON Payload: JSONPayload.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
DataCenter UnicodeString | |
IsAbandoned Boolean | |
JSONPayload UnicodeString |
Event ID 7283: Entering LogPerfRequestStart API call.
#Event ID 7285: Entering LogPerfResponseReceived API call.
#Event ID 7287: Template download starting - Query String: QueryString, Impression GUID: ImpressionGUID.
#Event ID 7288: Template download finished - Query String: QueryString, Impression GUID: ImpressionGUID, HRESULT: ErrorCode.
#Event ID 7289: Downloaded template written to disk - Template ID: TemplateId.
#Event ID 7290: Error Instrumentation Retry Timer has been scheduled
#Event ID 7291: Error Instrumentation Retry Timer Callback has been fired
#Event ID 7292: Error Instrumentation Event(s) have been dropped after a maximum number of retries
#Event ID 7293: Error Instrumentation Event has been dropped due to error overflow.
#Fields #
| Name | Description |
|---|---|
ImpressionGUID UnicodeString | |
Timestamp UInt64 | |
ErrorCode UInt32 | |
Url UnicodeString | |
HBT UnicodeString |
Event ID 7380: WallpaperBackground_SceneInitializationStart
#Fields #
| Name | Description |
|---|---|
Left Int32 | |
Top Int32 | |
Right Int32 | |
Bottom Int32 |
Event ID 7400: Template Fallback JSON Payload serialized - Payload: JSON.
#Event ID 7401: Entering LogTemplateFallback API call.
#Event ID 7403: Entering LogTemplateFallback background worker.
#Event ID 7404: Exiting LogTemplateFallback background worker.
#Event ID 7405: Template Fallback Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Fallback Telemetry ID: TelemetryID.
#Event ID 7406: Entering LogTemplateError API call.
#Event ID 7408: Entering LogTemplateError background worker.
#Event ID 7409: Exiting LogTemplateError background worker.
#Event ID 7410: Template Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Template ID: Url, Error Telem...
#Description
Template Error Event Processing Complete - Operation Error Code: Result, Impression GUID: ImpressionGUID, Logged Error Code: ErrorCode, Error Template ID: Url, Error Telemetry ID: HBT.
Message #
Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
ErrorCode UInt32 | |
Url UnicodeString | |
HBT UnicodeString |
Event ID 7411: Entering SetSearchOnMeteredConnection API.
#Event ID 7412: Entering SetShareHistory API.
#Event ID 7413: Exiting SetSearchOnMeteredConnection API - ChangeTo: ChangeTo.
#Event ID 7414: Exiting SetShareHistory API - ChangeTo: ChangeTo.
#Event ID 7415: App Install State Event Processing Complete - Error Code: Result, Impression GUID: ImpressionGUID, Layout Action: LayoutAction, Telemetry Id affected: TelemetryId.
#Event ID 7416: Starting Image Downloader Pre-Fetch Task for Impression GUID: ImpressionGUID.
#Event ID 7417: Completed Image Downloader Pre-Fetch Task for Impression GUID: ImpressionGUID with HRESULT: Result.
#Event ID 7418: Starting Image Downloader Deferred Pre-Fetch Task.
#Event ID 7419: Completed Image Downloader Deferred Pre-Fetch Task with HRESULT: Result.
#Event ID 7420: Starting Image Download for URL: URL.
#Event ID 7421: Completed Image Download for URL: URL with HRESULT: Result.
#Event ID 7422: Entering LogPerfRequestSent API call.
#Event ID 7424: Entering LogPerfRenderComplete API call.
#Event ID 7426: Entering LogPerfImagesComplete API call.
#Event ID 7428: Entering LogPerfAbandoned API call.
#Event ID 7430: Perftrack_ConnectedSearch_ImageDownloadStart
#Event ID 7431: Perftrack_ConnectedSearch_ImageDownloadStop
#Event ID 7432: ConnectedSearch_DomainRedirection
#Fields #
| Name | Description |
|---|---|
ChangeTo UnicodeString | |
ErrorResult UInt32 |
Event ID 7433: ConnectedSearch_DomainRedirection7433
#Event ID 7434: ConnectedSearch_LogTemplateRequestInfoPayload
#Fields #
| Name | Description |
|---|---|
JSON UnicodeString |
Event ID 7435: ConnectedSearch_LogTemplateRequestInfoStart
#Event ID 7437: ConnectedSearch_LogTemplateRequestInfoBGStart
#Event ID 7438: ConnectedSearch_LogTemplateRequestInfoBGStop
#Event ID 7439: ConnectedSearch_LogTemplateRequestInfo
#Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString | |
TelemetryID UnicodeString |
Event ID 7440: ConnectedSearch_BadSignature
#Fields #
| Name | Description |
|---|---|
Path UnicodeString | |
Validation Boolean |
Event ID 7441: ConnectedSearch_BadCertificate
#Fields #
| Name | Description |
|---|---|
Path UnicodeString | |
Validation Boolean |
Event ID 7445: ConnectedSearch_LoadTemplateStop
#Fields #
| Name | Description |
|---|---|
Path UnicodeString | |
Result UInt32 |
Event ID 7446: ConnectedSearch_BlockingTemplateDownloadStart
#Event ID 7447: ConnectedSearch_BlockingTemplateDownloadStop
#Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 |
Event ID 7448: ConnectedSearch_LogPerfTemplateRequestStart
#Event ID 7451: ConnectedSearch_LogPerfImagesLoading
#Event ID 7452: ConnectedSearch_LogPrefetchImagesCompleteStart
#Event ID 7453: ConnectedSearch_LogPrefetchImagesCompleteStop
#Fields #
| Name | Description |
|---|---|
ErrorResult UInt32 |
Event ID 7454: ConnectedSearch_LogPerfColdStart
#Event ID 7455: ConnectedSearch_Settings_MeteredConnection7455
#Event ID 7456: ConnectedSearch_Settings_MeteredConnection7456
#Fields #
| Name | Description |
|---|---|
ChangeTo UInt32 | |
ErrorResult UInt32 |
Event ID 7457: ConnectedSearch_SetTracingData
#Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString |
Event ID 7459: Perftrack_ConnectedSearch_PageLoadWithImagesStart
#Event ID 7460: Perftrack_ConnectedSearch_PageLoadWithImagesStop
#Fields #
| Name | Description |
|---|---|
Scope UnicodeString |
Event ID 7461: Perftrack_ConnectedSearch_PageLoadWithImagesStop7461
#Fields #
| Name | Description |
|---|---|
Scope UnicodeString |
Event ID 7462: ConnectedSearch_SetScope
#Fields #
| Name | Description |
|---|---|
Result UInt32 | |
ImpressionGUID UnicodeString |
Event ID 7701: ImmersiveApplicationManagerForegroundBoost
#Fields #
| Name | Description |
|---|---|
ApplicationWindow Pointer | |
PID UInt32 | |
AppID UnicodeString | |
PriorityForeground Boolean | |
SystemWindow Pointer |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 7701,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 9788
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:39.795Z",
"version": 0
},
"event_data": {
"AppID": "windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel",
"ApplicationWindow": "0x2098E",
"PID": 15220,
"PriorityForeground": true,
"SystemWindow": "0x2098E"
},
"message": ""
}
Event ID 8002: ActionsFramework_Contacts_MRU_InitializeStart
#Event ID 8003: ActionsFramework_Contacts_MRU_InitializeStop
#Event ID 8005: ActionsFramework_Contacts_MRU_UpdateStart
#Event ID 8006: ActionsFramework_Contacts_MRU_UpdateStop
#Event ID 8009: The operation to add an appointment failed with ReportedError.
#Event ID 8010: The operation to remove an appointment failed with ReportedError.
#Event ID 8011: A desktop app or a Windows Store app that's not running in the foreground called ShowContactCard; which returned HRESULT: {HRESULT}.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8012: ShowContactCard: indexer query failed with HRESULT {HRESULT}.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8013: ShowContactCard: initializing contact card failed with HRESULT {HRESULT}.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8014: ShowContactCard: populating contact card failed with HRESULT {HRESULT}.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8015: ShowContactCard re-mapped internal failure code {HRESULT} to S_OK before it returned.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8016: Found a contact (ContactId = {ContactId}) with an invalid property (PropertyKey = {PropertyKey}; PropertyValue = {PropertyValue}) in the indexer.
#Fields #
| Name | Description |
|---|---|
ContactId | |
PropertyKey | |
PropertyValue |
Event ID 8023: ContactCard failed to download and render the user thumbnail and the HRESULT is {HRESULT}.
#Fields #
| Name | Description |
|---|---|
HRESULT |
Event ID 8024: {NumberOfContacts} contacts are found for contact Id {ContactId}.
#Event ID 8025: Appointment action ActionType failed with HRESULT HRESULT.
#Event ID 8027: The operation to replace an appointment failed with ReportedError.
#Event ID 8028: ContactManager_InitializeActionControlsStart
#Event ID 8029: ContactManager_InitializeActionControlsStop
#Event ID 8030: ContactsProvider_QueryContactServiceInformationStart
#Event ID 8031: ContactsProvider_QueryContactServiceInformationStop
#Event ID 8205: BackStackMusicPlay_Invoke_MusicSuggestion
#Fields #
| Name | Description |
|---|---|
PackageId UnicodeString | |
ActivatableClassId UnicodeString | |
Verb UnicodeString |
Event ID 8211: BackStackMusicPlay_Proffer_Data_Source_Service
#Event ID 8213: BackStackMusicPlay_Revoke_Data_Source_Service
#Event ID 8218: BackStackMusicPlay_Playback_Session_Changed
#Event ID 8220: BackStackMusicPlay_Playback_Started
#Event ID 9950: TWinUICreateInstance_SxS
#Fields #
| Name | Description |
|---|---|
CallerModule UnicodeString | |
ObjectModule UnicodeString | |
CLSID UnicodeString |
Event ID 9951: DllGetClassObject_SxS
#Fields #
| Name | Description |
|---|---|
SxSModule UnicodeString | |
CLSID UnicodeString |
Event ID 10000: WindowLayoutChangeStart
#Fields #
| Name | Description |
|---|---|
hWnd UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-TWinUI/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 10000,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 8992,
"thread_id": 10300
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-Immersive-Shell",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 16:24:29.053Z",
"version": 0
},
"event_data": {
"hWnd": 0
},
"message": ""
}
Event ID 11110: PLM_TerminateApp
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString | |
Flags UInt32 | |
TerminateReason UInt32 |
Event ID 11118: PerfTrack_PLM_ResumeApplication_EndToEndStart
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString |
Event ID 11119: PerfTrack_PLM_ResumeApplication_EndToEndStop
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
PackageFullName UnicodeString | |
AppUserModelId UnicodeString | |
PackedResumeDurationsMs_HiWordAppLoWordPackage UInt32 | |
Flags UInt32 |
Event ID 11120: PLM_ExecutionReasonStart
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
ExecutionReason UInt32 |
Event ID 11121: PLM_ExecutionReasonStop
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
ExecutionReason UInt32 |
Event ID 11122: PLM_ExecutionReason
#Fields #
| Name | Description |
|---|---|
PsmKey UnicodeString | |
ExecutionReason UInt32 |
Event ID 11201: Accounts_LoadAppWidgetsStart
#Event ID 11203: Accounts_LoadAppWidgetsStop
#Event ID 11212: Accounts_GetProviderCommands
#Fields #
| Name | Description |
|---|---|
ProviderDisplayName UnicodeString |
Event ID 11213: Accounts_GetAccountCommands
#Fields #
| Name | Description |
|---|---|
ProviderDisplayName UnicodeString | |
AccountName UnicodeString |
Event ID 11214: Accounts_GetCredentialCommands
#Fields #
| Name | Description |
|---|---|
Resource UnicodeString | |
Identity UnicodeString |
Event ID 11301: LockScreenCallBroker_StartCallStart
#Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | |
AppID UnicodeString | |
AppArguments UnicodeString |
Event ID 11302: LockScreenCallBroker_StartCallStop
#Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | |
AppID UnicodeString | |
AppArguments UnicodeString |
Event ID 11303: LockScreenCallBroker_EndCallStart
#Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | |
DeadlineHigh UInt32 | |
DeadlineLow UInt32 |
Event ID 11304: LockScreenCallBroker_EndCallStop
#Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | |
DeadlineHigh UInt32 | |
DeadlineLow UInt32 |
Event ID 11305: LockScreenCallBroker_AppLaunched
#Fields #
| Name | Description |
|---|---|
ConnectionGUID GUID | |
AppID UnicodeString | |
AppArguments UnicodeString | |
AppAlreadyRunning Boolean |
Provenance
ETW provider GUID 315a8872-923e-4ea2-9889-33cd4754bf64
Defined in twinui.appcore.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB