Microsoft-Windows-MCCS-InternetMail

77 events across 1 channel

Event	Title	Channel	Sample
1	Error: Error Location: Location Line Number: Line_Number.	Operational	N
2	Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.	Operational	N
101	Invalid IMAP Server response: Server response = Prop_String.	Operational	N
102	Error selecting folder: Error_selecting_folder, Server response = Prop_String.	Operational	N
103	Prop_String authentication failed with mechanism Prop_String2.	Operational	N
104	Google: Force enable IMAP on the server side completed.	Operational	N
110	IMAP_IDLE: Execute Work invoked.	Operational	N
111	IMAP_IDLE: Cancel requested.	Operational	N
112	IMAP_IDLE: IDLE command sent	Operational	N
113	IMAP_IDLE: IDLE Entered.	Operational	N
114	IMAP_IDLE: DONE command sent	Operational	N
115	IMAP_IDLE: IDLE terminated	Operational	N
116	IMAP_IDLE: IDLE terminated with error Prop_Hex.	Operational	N
117	IMAP_IDLE: Execute Work returns	Operational	N
118	IMAP_IDLE: Server Update received.	Operational	N
119	IMAP_IDLE: Server Update received.	Operational	N
120	IMAP_IDLE: Server Update received.	Operational	N
121	IMAP_IDLE: Server Update received.	Operational	N
122	IMAP_IDLE: Server Update received.	Operational	N
123	IMAP_IDLE: Server Update received.	Operational	N
124	IMAP_IDLE: Processing Queued Updates.	Operational	N
125	IMAP_IDLE: Syncing New Messages	Operational	N
126	IMAP_IDLE: Processing Expunge	Operational	N
127	IMAP_IDLE: Processing Flag updates	Operational	N
128	IMAP_IDLE: Resetting sync handler object	Operational	N
200	InternetMailProvider: [Start Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_START] …	Operational	N
201	InternetMailProvider: [Stop Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_STOP] …	Operational	N
202	InternetMailProvider: [Start Marker] [SMTP_Init] …	Operational	N
203	InternetMailProvider: [Stop Marker] [SMTP_Init] …	Operational	N
204	InternetMailProvider: [Start Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_START] …	Operational	N
205	InternetMailProvider: [Stop Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_STOP] …	Operational	N
206	InternetMailProvider: [Start Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_START] …	Operational	N
207	InternetMailProvider: [Stop Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_STOP] …	Operational	N
208	InternetMailProvider: [Start Marker] [FdSS] …	Operational	N
209	InternetMailProvider: [Stop Marker] [FdSS] …	Operational	N
210	InternetMailProvider: [Start Marker] [FS] …	Operational	N
211	InternetMailProvider: [Stop Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_STOP] …	Operational	N
212	InternetMailProvider: [Start Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_START] …	Operational	N
213	InternetMailProvider: [Stop Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_STOP] …	Operational	N
220	InternetMailProvider: [Start Marker] [St_FM] …	Operational	N
221	InternetMailProvider: [Stop Marker] [St_FM] …	Operational	N
222	InternetMailProvider: [Start Marker] [St_PR] …	Operational	N
223	InternetMailProvider: [Stop Marker] [St_PR] …	Operational	N
226	InternetMailProvider: [Start Marker] [FFL] …	Operational	N
227	InternetMailProvider: [Stop Marker] [FFL] …	Operational	N
228	InternetMailProvider: [Start Marker] [SMTP_SM] …	Operational	N
229	InternetMailProvider: [Stop Marker] [SMTP_SM] …	Operational	N
230	InternetMailProvider: [Start Marker] [SMTP_FS] …	Operational	N
231	InternetMailProvider: [Stop Marker] [SMTP_FS] …	Operational	N
232	InternetMailProvider: [Start Marker] [SMTP_Conn] …	Operational	N
233	InternetMailProvider: [Stop Marker] [SMTP_Conn] …	Operational	N
234	InternetMailProvider: [Start Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_START] …	Operational	N
235	InternetMailProvider: [Stop Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_STOP] …	Operational	N
236	InternetMailProvider: [Start Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_START] …	Operational	N
237	InternetMailProvider: [Stop Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_STOP] …	Operational	N
238	InternetMailProvider: [Start Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_START] …	Operational	N
239	InternetMailProvider: [Stop Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_STOP] socket …	Operational	N
242	InternetMailProvider: [Start Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_START] …	Operational	N
243	InternetMailProvider: [Stop Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_STOP] …	Operational	N
248	InternetMailProvider: [Start Marker] [NW_HS] …	Operational	N
249	InternetMailProvider: [Stop Marker] [NW_HS] …	Operational	N
301	Sync result: {P1_HResult}; engine index: {P2_UInt32} severity: {P3_UInt32} retry …	Operational	N
311	InternetMail: Cancelling existing socket communication	Operational	N
401	Account Prop_String ImapIdle set PDC:Prop_Boolean.	Operational	N
402	Account Prop_String ImapIdle set CCT, SUCCEEDED:Prop_Boolean.	Operational	N
403	Account Prop_String ImapIdle Unset CCT, CCT allocated:Prop_Boolean.	Operational	N
451	IMAP folder validity updated to Prop_Uint.	Operational	N
461	IMAP Failed to fetch message with UID Prop_Uint.	Operational	N
462	IMAP Skip fetching message with UID Prop_Uint.	Operational	N
470	IMAP hdr fetch overflowed batch queue - catching up: acct=Prop_Guid …	Operational	N
471	IMAP msg fetch overflowed batch queue - catching up: acct=Prop_Guid …	Operational	N
481	Start AutoConfig	Operational	N
482	Start AutoConfig OEM Provider	Operational	N
483	Start AutoConfig Web Provider	Operational	N
484	Cancel AutoConfig	Operational	N
485	AutoConfig Provider result: AutoConfig_Provider_result.	Operational	N
501	DavSyncProvider: Stop syncing InternetMail account Prop_Guid content type: …	Operational	N

Event ID 1: Error: Error Location: Location Line Number: Line_Number.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Error: Error Location: Location Line Number: Line_Number.

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`Error`
`Location`
`Line_Number`
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 2: Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`Error_Propagated`
`Location`
`Line_Number`
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 101: Invalid IMAP Server response: Server response = Prop_String.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Invalid IMAP Server response: Server response = Prop_String.

Message #

Invalid IMAP Server response: Server response = %1

Fields #

Name	Description
`Prop_String` AnsiString

Event ID 102: Error selecting folder: Error_selecting_folder, Server response = Prop_String.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Error selecting folder: Error_selecting_folder, Server response = Prop_String.

Message #

Error selecting folder: %1, Server response = %2

Fields #

Name	Description
`Error_selecting_folder`
`Prop_String` AnsiString
`Prop_String2` AnsiString

Event ID 103: Prop_String authentication failed with mechanism Prop_String2.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Prop_String authentication failed with mechanism Prop_String2.

Message #

%1 authentication failed with mechanism %2

Fields #

Name	Description
`Prop_String` AnsiString
`Prop_String2` AnsiString

Event ID 104: Google: Force enable IMAP on the server side completed.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Google: Force enable IMAP on the server side completed. Result Prop_Hex.

Message #

Google: Force enable IMAP on the server side completed. Result %1

Fields #

Name	Description
`Prop_Hex` UInt32

Event ID 110: IMAP_IDLE: Execute Work invoked.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Execute Work invoked. Account Id = Prop_Hex.

Message #

IMAP_IDLE: Execute Work invoked. Account Id = %1

Fields #

Name	Description
`Prop_Hex` UInt32

Event ID 111: IMAP_IDLE: Cancel requested.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Cancel requested. Account Id = Prop_Hex.

Message #

IMAP_IDLE: Cancel requested. Account Id = %1

Fields #

Name	Description
`Prop_Hex` UInt32

Event ID 112: IMAP_IDLE: IDLE command sent

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: IDLE command sent.

Message #

IMAP_IDLE: IDLE command sent

Event ID 113: IMAP_IDLE: IDLE Entered.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: IDLE Entered. Waiting for server updates...

Message #

IMAP_IDLE: IDLE Entered. Waiting for server updates...

Event ID 114: IMAP_IDLE: DONE command sent

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: DONE command sent.

Message #

IMAP_IDLE: DONE command sent

Event ID 115: IMAP_IDLE: IDLE terminated

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: IDLE terminated.

Message #

IMAP_IDLE: IDLE terminated

Event ID 116: IMAP_IDLE: IDLE terminated with error Prop_Hex.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: IDLE terminated with error Prop_Hex.

Message #

IMAP_IDLE: IDLE terminated with error %1

Fields #

Name	Description
`Prop_Hex` UInt32

Event ID 117: IMAP_IDLE: Execute Work returns

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Execute Work returns.

Message #

IMAP_IDLE: Execute Work returns

Event ID 118: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. Type Prop_Uint.

Message #

IMAP_IDLE: Server Update received. Type %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 119: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. EXISTS Prop_Uint.

Message #

IMAP_IDLE: Server Update received. EXISTS %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 120: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. EXPUNGE Prop_Uint.

Message #

IMAP_IDLE: Server Update received. EXPUNGE %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 121: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. FLAG FETCH Prop_Uint1 Read? Prop_Uint2.

Message #

IMAP_IDLE: Server Update received. FLAG FETCH %1 Read? %2

Fields #

Name	Description
`Prop_Uint1` UInt32
`Prop_Uint2` UInt32

Event ID 122: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. OK.

Message #

IMAP_IDLE: Server Update received. OK

Event ID 123: IMAP_IDLE: Server Update received.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Server Update received. ERR / BAD.

Message #

IMAP_IDLE: Server Update received. ERR / BAD

Event ID 124: IMAP_IDLE: Processing Queued Updates.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Processing Queued Updates. Count Prop_Uint.

Message #

IMAP_IDLE: Processing Queued Updates. Count %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 125: IMAP_IDLE: Syncing New Messages

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Syncing New Messages.

Message #

IMAP_IDLE: Syncing New Messages

Event ID 126: IMAP_IDLE: Processing Expunge

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Processing Expunge.

Message #

IMAP_IDLE: Processing Expunge

Event ID 127: IMAP_IDLE: Processing Flag updates

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Processing Flag updates.

Message #

IMAP_IDLE: Processing Flag updates

Event ID 128: IMAP_IDLE: Resetting sync handler object

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP_IDLE: Resetting sync handler object.

Message #

IMAP_IDLE: Resetting sync handler object

Event ID 200: InternetMailProvider: [Start Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_START] Init the sync session and establish connection etc

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_INIT
Opcode: Start

Description

InternetMailProvider: [Start Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_START] Init the sync session and establish connection etc.

Message #

InternetMailProvider: [Start Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_START] Init the sync session and establish connection etc

Event ID 201: InternetMailProvider: [Stop Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_STOP] Init the sync session and establish connection etc

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_INIT
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_STOP] Init the sync session and establish connection etc.

Message #

InternetMailProvider: [Stop Marker] [Init] [PIPERF_TAG_SYNCSESSION_INIT_STOP] Init the sync session and establish connection etc

Event ID 202: InternetMailProvider: [Start Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_START] Init the sync session and establish connection etc

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPINIT
Opcode: Start

Description

InternetMailProvider: [Start Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_START] Init the sync session and establish connection etc.

Message #

InternetMailProvider: [Start Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_START] Init the sync session and establish connection etc

Event ID 203: InternetMailProvider: [Stop Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_STOP] Init the sync session and establish connection etc

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPINIT
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_STOP] Init the sync session and establish connection etc.

Message #

InternetMailProvider: [Stop Marker] [SMTP_Init] [PIPERF_TAG_SYNCSESSION_SMTPINIT_STOP] Init the sync session and establish connection etc

Event ID 204: InternetMailProvider: [Start Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_START] Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SYNC
Opcode: Start

Description

InternetMailProvider: [Start Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_START] Synchronize.

Message #

InternetMailProvider: [Start Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_START] Synchronize

Event ID 205: InternetMailProvider: [Stop Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_STOP] Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SYNC
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_STOP] Synchronize.

Message #

InternetMailProvider: [Stop Marker] [S] [PIPERF_TAG_SYNCSESSION_SYNC_STOP] Synchronize

Event ID 206: InternetMailProvider: [Start Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_START] Folder Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FDSYNC
Opcode: Start

Description

InternetMailProvider: [Start Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_START] Folder Synchronize.

Message #

InternetMailProvider: [Start Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_START] Folder Synchronize

Event ID 207: InternetMailProvider: [Stop Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_STOP] Folder Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FDSYNC
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_STOP] Folder Synchronize.

Message #

InternetMailProvider: [Stop Marker] [FdS] [PIPERF_TAG_SYNCSESSION_FDSYNC_STOP] Folder Synchronize

Event ID 208: InternetMailProvider: [Start Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_START] Sync folders with server

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER
Opcode: Start

Description

InternetMailProvider: [Start Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_START] Sync folders with server.

Message #

InternetMailProvider: [Start Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_START] Sync folders with server

Event ID 209: InternetMailProvider: [Stop Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_STOP] Sync folders with server

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_STOP] Sync folders with server.

Message #

InternetMailProvider: [Stop Marker] [FdSS] [PIPERF_TAG_SYNCSESSION_FDSYNCWITHSERVER_STOP] Sync folders with server

Event ID 210: InternetMailProvider: [Start Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_START] Full Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FULLSYNC
Opcode: Start

Description

InternetMailProvider: [Start Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_START] Full Synchronize.

Message #

InternetMailProvider: [Start Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_START] Full Synchronize

Event ID 211: InternetMailProvider: [Stop Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_STOP] Full Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FULLSYNC
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_STOP] Full Synchronize.

Message #

InternetMailProvider: [Stop Marker] [FS] [PIPERF_TAG_SYNCSESSION_FULLSYNC_STOP] Full Synchronize

Event ID 212: InternetMailProvider: [Start Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_START] Connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_CONNECT
Opcode: Start

Description

InternetMailProvider: [Start Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_START] Connect.

Message #

InternetMailProvider: [Start Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_START] Connect

Event ID 213: InternetMailProvider: [Stop Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_STOP] Connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_CONNECT
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_STOP] Connect.

Message #

InternetMailProvider: [Stop Marker] [C] [PIPERF_TAG_SYNCSESSION_CONNECT_STOP] Connect

Event ID 220: InternetMailProvider: [Start Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_START] fetch message

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FETCHMESSAGE
Opcode: Start

Description

InternetMailProvider: [Start Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_START] fetch message.

Message #

InternetMailProvider: [Start Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_START] fetch message

Event ID 221: InternetMailProvider: [Stop Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_STOP] fetch message

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FETCHMESSAGE
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_STOP] fetch message.

Message #

InternetMailProvider: [Stop Marker] [St_FM] [PIPERF_TAG_SYNCSESSION_FETCHMESSAGE_STOP] fetch message

Event ID 222: InternetMailProvider: [Start Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_START] post process received message

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_POSTRECV
Opcode: Start

Description

InternetMailProvider: [Start Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_START] post process received message.

Message #

InternetMailProvider: [Start Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_START] post process received message

Event ID 223: InternetMailProvider: [Stop Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_STOP] post process received message

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_POSTRECV
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_STOP] post process received message.

Message #

InternetMailProvider: [Stop Marker] [St_PR] [PIPERF_TAG_SYNCSESSION_POSTRECV_STOP] post process received message

Event ID 226: InternetMailProvider: [Start Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_START] fetch folder list

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST
Opcode: Start

Description

InternetMailProvider: [Start Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_START] fetch folder list.

Message #

InternetMailProvider: [Start Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_START] fetch folder list

Event ID 227: InternetMailProvider: [Stop Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_STOP] fetch folder list

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_STOP] fetch folder list.

Message #

InternetMailProvider: [Stop Marker] [FFL] [PIPERF_TAG_SYNCSESSION_FETCHFOLDERLIST_STOP] fetch folder list

Event ID 228: InternetMailProvider: [Start Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_START] send messages

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SENDMESSAGE
Opcode: Start

Description

InternetMailProvider: [Start Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_START] send messages.

Message #

InternetMailProvider: [Start Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_START] send messages

Event ID 229: InternetMailProvider: [Stop Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_STOP] send messages

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SENDMESSAGE
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_STOP] send messages.

Message #

InternetMailProvider: [Stop Marker] [SMTP_SM] [PIPERF_TAG_SYNCSESSION_SENDMESSAGE_STOP] send messages

Event ID 230: InternetMailProvider: [Start Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_START] Full Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC
Opcode: Start

Description

InternetMailProvider: [Start Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_START] Full Synchronize.

Message #

InternetMailProvider: [Start Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_START] Full Synchronize

Event ID 231: InternetMailProvider: [Stop Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_STOP] Full Synchronize

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_STOP] Full Synchronize.

Message #

InternetMailProvider: [Stop Marker] [SMTP_FS] [PIPERF_TAG_SYNCSESSION_SMTPFULLSYNC_STOP] Full Synchronize

Event ID 232: InternetMailProvider: [Start Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_START] Connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPCONNECT
Opcode: Start

Description

InternetMailProvider: [Start Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_START] Connect.

Message #

InternetMailProvider: [Start Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_START] Connect

Event ID 233: InternetMailProvider: [Stop Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_STOP] Connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SYNCSESSION_SMTPCONNECT
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_STOP] Connect.

Message #

InternetMailProvider: [Stop Marker] [SMTP_Conn] [PIPERF_TAG_SYNCSESSION_SMTPCONNECT_STOP] Connect

Event ID 234: InternetMailProvider: [Start Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_START] socket connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_CONNECT
Opcode: Start

Description

InternetMailProvider: [Start Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_START] socket connect.

Message #

InternetMailProvider: [Start Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_START] socket connect

Event ID 235: InternetMailProvider: [Stop Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_STOP] socket connect

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_CONNECT
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_STOP] socket connect.

Message #

InternetMailProvider: [Stop Marker] [NW_C] [PIPERF_TAG_SOCKET_CONNECT_STOP] socket connect

Event ID 236: InternetMailProvider: [Start Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_START] socket recv

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_RECEIVE
Opcode: Start

Description

InternetMailProvider: [Start Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_START] socket recv.

Message #

InternetMailProvider: [Start Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_START] socket recv

Event ID 237: InternetMailProvider: [Stop Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_STOP] socket recv

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_RECEIVE
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_STOP] socket recv.

Message #

InternetMailProvider: [Stop Marker] [NW_R] [PIPERF_TAG_SOCKET_RECEIVE_STOP] socket recv

Event ID 238: InternetMailProvider: [Start Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_START] socket send

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_SEND
Opcode: Start

Description

InternetMailProvider: [Start Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_START] socket send.

Message #

InternetMailProvider: [Start Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_START] socket send

Event ID 239: InternetMailProvider: [Stop Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_STOP] socket send

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_SEND
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_STOP] socket send.

Message #

InternetMailProvider: [Stop Marker] [NW_S] [PIPERF_TAG_SOCKET_SEND_STOP] socket send

Event ID 242: InternetMailProvider: [Start Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_START] socket close

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_CLOSE
Opcode: Start

Description

InternetMailProvider: [Start Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_START] socket close.

Message #

InternetMailProvider: [Start Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_START] socket close

Event ID 243: InternetMailProvider: [Stop Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_STOP] socket close

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_CLOSE
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_STOP] socket close.

Message #

InternetMailProvider: [Stop Marker] [NW_Clo] [PIPERF_TAG_SOCKET_CLOSE_STOP] socket close

Event ID 248: InternetMailProvider: [Start Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_START] socket perform ssl handshake

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE
Opcode: Start

Description

InternetMailProvider: [Start Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_START] socket perform ssl handshake.

Message #

InternetMailProvider: [Start Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_START] socket perform ssl handshake

Event ID 249: InternetMailProvider: [Stop Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_STOP] socket perform ssl handshake

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational
Task: PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE
Opcode: Stop

Description

InternetMailProvider: [Stop Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_STOP] socket perform ssl handshake.

Message #

InternetMailProvider: [Stop Marker] [NW_HS] [PIPERF_TAG_SOCKET_PERFORM_SSLHANDSHAKE_STOP] socket perform ssl handshake

Event ID 301: Sync result: {P1_HResult}; engine index: {P2_UInt32} severity: {P3_UInt32} retry level: {P4_UInt32}.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Sync result: {P1_HResult}; engine index: {P2_UInt32} severity: {P3_UInt32} retry level: {P4_UInt32}.

Message #

Sync result: {P1_HResult}; engine index: {P2_UInt32} severity: {P3_UInt32} retry level: {P4_UInt32}

Fields #

Name	Description
`P1_HResult`
`P2_UInt32`
`P3_UInt32`
`P4_UInt32`

Event ID 311: InternetMail: Cancelling existing socket communication

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

InternetMail: Cancelling existing socket communication.

Message #

InternetMail: Cancelling existing socket communication

Event ID 401: Account Prop_String ImapIdle set PDC:Prop_Boolean.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Account Prop_String ImapIdle set PDC:Prop_Boolean.

Message #

Account %1 ImapIdle set PDC:%2

Fields #

Name	Description
`Prop_String` UnicodeString
`Prop_Boolean` Boolean

Event ID 402: Account Prop_String ImapIdle set CCT, SUCCEEDED:Prop_Boolean.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Account Prop_String ImapIdle set CCT, SUCCEEDED:Prop_Boolean.

Message #

Account %1 ImapIdle set CCT, SUCCEEDED:%2

Fields #

Name	Description
`Prop_String` UnicodeString
`Prop_Boolean` Boolean

Event ID 403: Account Prop_String ImapIdle Unset CCT, CCT allocated:Prop_Boolean.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Account Prop_String ImapIdle Unset CCT, CCT allocated:Prop_Boolean.

Message #

Account %1 ImapIdle Unset CCT, CCT allocated:%2

Fields #

Name	Description
`Prop_String` UnicodeString
`Prop_Boolean` Boolean

Event ID 451: IMAP folder validity updated to Prop_Uint.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP folder validity updated to Prop_Uint.

Message #

IMAP folder validity updated to %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 461: IMAP Failed to fetch message with UID Prop_Uint.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP Failed to fetch message with UID Prop_Uint.

Message #

IMAP Failed to fetch message with UID %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 462: IMAP Skip fetching message with UID Prop_Uint.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP Skip fetching message with UID Prop_Uint.

Message #

IMAP Skip fetching message with UID %1

Fields #

Name	Description
`Prop_Uint` UInt32

Event ID 470: IMAP hdr fetch overflowed batch queue - catching up: acct=Prop_Guid max=Prop_Dword_1 bytes=Prop_Dword_2.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP hdr fetch overflowed batch queue - catching up: acct=Prop_Guid max=Prop_Dword_1 bytes=Prop_Dword_2.

Message #

IMAP hdr fetch overflowed batch queue - catching up: acct=%1 max=%2 bytes=%3

Fields #

Name	Description
`Prop_Guid` GUID
`Prop_Dword_1` UInt32
`Prop_Dword_2` UInt32

Event ID 471: IMAP msg fetch overflowed batch queue - catching up: acct=Prop_Guid max=Prop_Dword_1 msgs=Prop_Dword_2.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

IMAP msg fetch overflowed batch queue - catching up: acct=Prop_Guid max=Prop_Dword_1 msgs=Prop_Dword_2.

Message #

IMAP msg fetch overflowed batch queue - catching up: acct=%1 max=%2 msgs=%3

Fields #

Name	Description
`Prop_Guid` GUID
`Prop_Dword_1` UInt32
`Prop_Dword_2` UInt32

Event ID 481: Start AutoConfig

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Start AutoConfig.

Message #

Start AutoConfig

Event ID 482: Start AutoConfig OEM Provider

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Start AutoConfig OEM Provider.

Message #

Start AutoConfig OEM Provider

Event ID 483: Start AutoConfig Web Provider

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Start AutoConfig Web Provider.

Message #

Start AutoConfig Web Provider

Event ID 484: Cancel AutoConfig

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

Cancel AutoConfig.

Message #

Cancel AutoConfig

Event ID 485: AutoConfig Provider result: AutoConfig_Provider_result.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

AutoConfig Provider result: AutoConfig_Provider_result.

Message #

AutoConfig Provider result: %1.

Fields #

Name	Description
`AutoConfig_Provider_result`
`Prop_Hex` UInt32

Event ID 501: DavSyncProvider: Stop syncing InternetMail account Prop_Guid content type: Prop_HexInt32.

Provider: Microsoft-Windows-MCCS-InternetMail
Channel: Operational

Description

DavSyncProvider: Stop syncing InternetMail account Prop_Guid content type: Prop_HexInt32.

Message #

DavSyncProvider: Stop syncing InternetMail account %1 content type: %2.

Fields #

Name	Description
`Prop_Guid` GUID
`Prop_HexInt32` HexInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 618473bc-8eef-4868-adff-a1b640b06411

Defined in InternetMail.dll, which carries the event manifest.

Observed on:

Win11-26200.6584, schema read from the registered manifest, captured 2026-06-02

Downloads

Microsoft-Windows-MCCS-InternetMail registered manifest XML (in the Win11-26200.6584 manifest pack, 2.0 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)