Microsoft-Windows-International

Event	Title	Channel	Sample	Rule
1001	The NLS operation failed because the registry key {RegistryKey} cannot be …	Operational	N	N
1002	The NLS operation failed because the registry key {RegistryKey} cannot be …	Operational	N	N
1003	NLS codepage operation failed for the codepage {CodePage} because the file …	Operational	N	N
1004	NLS codepage operation failed for the codepage {CodePage} because the file …	Operational	N	N
1005	NLS operation failed for {LocaleName} locale because the file …	Operational	N	N
1006	NLS operation failed for {LocaleName} locale because the file …	Operational	N	N
1500	Group Policy has prevented process number {ProcessId} ({ProdessName}) from …	Operational	N	N
1502	Group Policy has prevented the user from changing their user locale to …	Operational	N	N
1503	Group Policy does not allow custom user locales for standards and formats.	Operational	N	N
2000	NLS operation recreated the registry key {RegistryKey}.	Operational	N	N
3000	Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; …	Operational	N	N
3001	Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; …	Operational	N	N
3002	Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) …	Operational	N	N
3003	The system updated the locale '{LocaleName}' with flag {Flags}.	Operational	N	N
10000	The user tried to apply an unattended XML file ({FileName}) in an unsupported …	Operational	N	N
10003	The user locale '{LocaleName}' (specified by the UserLocale element) is not a …	Operational	N	N
10004	Unsupported alternate sort '{LocaleName}'.	Operational	N	N
10005	'.	Operational	N	N
10007	Internal error while changing System locale (specified by the SystemLocale …	Operational	N	N
10008	Error while changing keyboard/input method for '{LocaleName}'.	Operational	N	N
10009	Error while changing location preference (geoid): {Value}.	Operational	N	N
10010	Failed to change UI Language to '{LocaleName}'.	Operational	N	N
10011	Failed to change UI Language fallback order to '{LocaleName}'.	Operational	N	N
10012	The user tried to apply an unattended XML file {FileName}; but the file does not …	Operational	N	N
10013	Error while the user changed setting '{LCType}' with value '{Value}' for the …	Operational	N	N
10014	The selected calendar '{String};' (specified by the Calendar element) is not a …	Operational	N	N
10015	The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax …	Operational	N	N
10111	The user does not have permission to change the TwoDigitYearMax setting	Operational	N	N
10221	Failed when calling internal function.	Operational	N	N
13000	The user changed their user locale (specified by the UserLocale element) to …	Operational	N	N
13001	The user reset all customizations for their user locale '{LocaleName}' …	Operational	N	N
13002	The user changed their user locale setting '{LCType}' (specified by the …	Operational	N	N
13004	The user changed their alternate sort to '{LocaleName}'.	Operational	N	N
13005	The user changed their calendar to '{String}'.	Operational	N	N
13006	The user changed their TwoDigitYearMax to {String}.	Operational	N	N
13007	The user changed their location preference (geoid) to {Value}.	Operational	N	N
13008	The system locale (specified by the SystemLocale element) was changed to …	Operational	N	N
13011	The user has changed their UI Language to '{LocaleName}'.	Operational	N	N
13012	The user has changed their UI Language fallback order to '{LocaleName}'.	Operational	N	N

Event ID 1001: The NLS operation failed because the registry key {RegistryKey} cannot be opened.

Channel: Operational

Description

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Error code is {ErrorCode}. Error message: {Message}.

Message #

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Error code is {ErrorCode}. Error message: {Message}

Fields #

Name	Description
`RegistryKey`
`ErrorCode`
`Message`

Event ID 1002: The NLS operation failed because the registry key {RegistryKey} cannot be opened.

Channel: Operational

Description

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Status code is {StatusCode}.

Message #

The NLS operation failed because the registry key {RegistryKey} cannot be opened. Status code is {StatusCode}.

Fields #

Name	Description
`RegistryKey`
`StatusCode`	NTSTATUS reference

Event ID 1003: NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing.

Channel: Operational

Description

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing. To correct this error; replace this file or repair your Windows installation.

Message #

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is missing.  To correct this error; replace this file or repair your Windows installation.

Fields #

Name	Description
`CodePage`
`FileName`

Event ID 1004: NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted.

Channel: Operational

Description

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted. To correct this error; replace this file or repair your Windows installation.

Message #

NLS codepage operation failed for the codepage {CodePage} because the file {FileName} is corrupted. To correct this error; replace this file or repair your Windows installation.

Fields #

Name	Description
`CodePage`
`FileName`

Event ID 1005: NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.

Channel: Operational

Description

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is missing. To fix this problem; reinstall this custom locale.

Message #

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is missing.  To fix this problem; reinstall this custom locale.

Fields #

Name	Description
`LocaleName`
`WinDir`

Event ID 1006: NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.

Channel: Operational

Description

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is corrupted. To fix this problem; reinstall this custom locale.

Message #

NLS operation failed for {LocaleName} locale because the file {WinDir}\globalization\{LocaleName}.nlp is corrupted.  To fix this problem; reinstall this custom locale.

Fields #

Name	Description
`LocaleName`
`WinDir`

Event ID 1500: Group Policy has prevented process number {ProcessId} ({ProdessName}) from changing the standards and format information for the user.

Channel: Operational

Fields #

Name	Description
`ProcessId`
`ProdessName`

Event ID 1502: Group Policy has prevented the user from changing their user locale to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 1503: Group Policy does not allow custom user locales for standards and formats.

Channel: Operational

Description

Group Policy does not allow custom user locales for standards and formats. The user was unable to select '{LocaleName}' as their user locale.

Message #

Group Policy does not allow custom user locales for standards and formats. The user was unable to select '{LocaleName}' as their user locale.

Fields #

Name	Description
`LocaleName`

Event ID 2000: NLS operation recreated the registry key {RegistryKey}.

Channel: Operational

Fields #

Name	Description
`RegistryKey`

Event ID 3000: Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; {LCType}; '{lpLCData}') successfully.

Channel: Operational

Message #

Process number {ProcessId} ({ProdessName}) called SetLocaleInfo({Locale}; {LCType}; '{lpLCData}')  successfully.

Fields #

Name	Description
`ProcessId`
`ProdessName`
`Locale`
`LCType`
`lpLCData`

Event ID 3001: Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; {Calendar}; {CalType}; '{lpLCalData}') successfully.

Channel: Operational

Message #

Process number {ProcessId} ({ProdessName}) called SetCalendarInfo({Locale}; {Calendar}; {CalType}; '{lpLCalData}')  successfully.

Fields #

Name	Description
`ProcessId`
`ProdessName`
`Locale`
`Calendar`
`CalType`
`lpLCalData`

Event ID 3002: Process number {ProcessId} ({ProdessName}) called SetUserGeoID({GeoId}) successfully.

Channel: Operational

Fields #

Name	Description
`ProcessId`
`ProdessName`
`GeoId`

Event ID 3003: The system updated the locale '{LocaleName}' with flag {Flags}.

Channel: Operational

Description

The system updated the locale '{LocaleName}' with flag {Flags}. Process number {ProcessId} ({ProdessName}). Return code is {ReturnCode}.

Message #

The system updated the locale '{LocaleName}' with flag {Flags}. Process number {ProcessId} ({ProdessName}). Return code is {ReturnCode}.

Fields #

Name	Description
`LocaleName`
`Flags`
`ProcessId`
`ProdessName`
`ReturnCode`

Event ID 10000: The user tried to apply an unattended XML file ({FileName}) in an unsupported format.

Channel: Operational

Description

The user tried to apply an unattended XML file ({FileName}) in an unsupported format. Reason: {Reason} (Line {LineNumber}). The system has not been changed.

Message #

The user tried to apply an unattended XML file ({FileName}) in an unsupported format. Reason: {Reason} (Line {LineNumber}). The system has not been changed.

Fields #

Name	Description
`FileName`
`Reason`
`LineNumber`

Event ID 10003: The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system.

Channel: Operational

Description

The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system. The user locale was not changed.

Message #

The user locale '{LocaleName}' (specified by the UserLocale element) is not a supported locale name or is not installed on the system. The user locale was not changed.

Fields #

Name	Description
`LocaleName`

Event ID 10004: Unsupported alternate sort '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 10005: '.

Channel: Operational

Description

'{AltSort}' is not a supported sort order for locale '{Locale}'.

Message #

'{AltSort}' is not a supported sort order for locale '{Locale}'.

Fields #

Name	Description
`AltSort`
`Locale`

Event ID 10007: Internal error while changing System locale (specified by the SystemLocale element).

Channel: Operational

Event ID 10008: Error while changing keyboard/input method for '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 10009: Error while changing location preference (geoid): {Value}.

Channel: Operational

Message #

Error while changing location preference (geoid): {Value}. This error may be caused by an unsupported location preference (geoid) or a Group Policy restriction. Error code is {Win32ErrorCode}. Error message: {Win32ErrorMessage}

Fields #

Name	Description
`Value`
`Win32ErrorCode`
`Win32ErrorMessage`

Event ID 10010: Failed to change UI Language to '{LocaleName}'.

Channel: Operational

Description

Failed to change UI Language to '{LocaleName}'. Status code is: {StatusCode}.

Message #

Failed to change UI Language to '{LocaleName}'. Status code is: {StatusCode}.

Fields #

Name	Description
`LocaleName`
`StatusCode`	NTSTATUS reference

Event ID 10011: Failed to change UI Language fallback order to '{LocaleName}'.

Channel: Operational

Description

Failed to change UI Language fallback order to '{LocaleName}'. Status code is: {StatusCode}.

Message #

Failed to change UI Language fallback order to '{LocaleName}'. Status code is: {StatusCode}.

Fields #

Name	Description
`LocaleName`
`StatusCode`	NTSTATUS reference

Event ID 10012: The user tried to apply an unattended XML file {FileName}; but the file does not exist.

Channel: Operational

Fields #

Name	Description
`FileName`

Event ID 10013: Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale.

Channel: Operational

Description

Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale. Error code is: {Win32ErrorCode}. Error message: {Win32ErrorMessage}.

Message #

Error while the user changed setting '{LCType}' with value '{Value}' for the current user locale. Error code is: {Win32ErrorCode}. Error message: {Win32ErrorMessage}

Fields #

Name	Description
`LCType`
`Value`
`Win32ErrorCode`
`Win32ErrorMessage`

Event ID 10014: The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar.

Channel: Operational

Description

The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar. The user locale was not changed.

Message #

The selected calendar '{String};' (specified by the Calendar element) is not a supported calendar. The user locale was not changed.

Fields #

Name	Description
`String`

Event ID 10015: The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value.

Channel: Operational

Description

The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value. The user locale was not changed.

Message #

The selected TwoDigitYearMax '{String};' (specified by the TwoDigitYearMax element) is not a supported value. The user locale was not changed.

Fields #

Name	Description
`String`

Event ID 10111: The user does not have permission to change the TwoDigitYearMax setting

Channel: Operational

Event ID 10221: Failed when calling internal function.

Channel: Operational

Description

Failed when calling internal function. Error code is: {StatusCode}.

Message #

Failed when calling internal function. Error code is: {StatusCode}

Fields #

Name	Description
`StatusCode`	NTSTATUS reference

Event ID 13000: The user changed their user locale (specified by the UserLocale element) to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 13001: The user reset all customizations for their user locale '{LocaleName}' (specified by the UserLocale element) to the system default.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 13002: The user changed their user locale setting '{LCType}' (specified by the UserLocale element) to '{Value}'.

Channel: Operational

Fields #

Name	Description
`LCType`
`Value`

Event ID 13004: The user changed their alternate sort to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 13005: The user changed their calendar to '{String}'.

Channel: Operational

Fields #

Name	Description
`String`

Event ID 13006: The user changed their TwoDigitYearMax to {String}.

Channel: Operational

Fields #

Name	Description
`String`

Event ID 13007: The user changed their location preference (geoid) to {Value}.

Channel: Operational

Fields #

Name	Description
`Value`

Event ID 13008: The system locale (specified by the SystemLocale element) was changed to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 13011: The user has changed their UI Language to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`

Event ID 13012: The user has changed their UI Language fallback order to '{LocaleName}'.

Channel: Operational

Fields #

Name	Description
`LocaleName`