detection.wiki

Microsoft-Windows-MCCS-SyncUtil

EventTitleChannelSampleRule
1Error: Error Location: Location Line Number: Line_Number.OperationalNN
2Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.OperationalNN
101Commsync:[Ctrl] [Prop_Dword] [Prop_StringA_1] Prop_StringA_2.OperationalNN
104Prop_String1Prop_String2Prop_String3 Prop_AnsiString.OperationalNN
121SyncUtil: [Start Marker] [SPERF_TAG_LOAD_XMLDOM_START] Start loading xml …OperationalNN
122SyncUtil: [Stop Marker] [SPERF_TAG_SYNC_ENGINE_STOP] Done loading xml …OperationalNN
202SyncUtil: MXSML Error code=P1_HexInt32.OperationalNN
203SyncUtil: MXSML Error reason=P1_UnicodeString.OperationalNN
204SyncUtil: MXSML Error url=P1_UnicodeString.OperationalNN
205SyncUtil: MXSML Error srcText=P1_UnicodeString.OperationalNN
206SyncUtil: MXSML Error offset=P1_Int32.OperationalNN
301SyncUtil: Account attempted to access SyncPersistentObjectManager when NULLOperationalNN
400Backup store {Prop_String1} {Prop_String2}.OperationalNN
401Restored store {Prop_String1} {Prop_String2}.OperationalNN
402Got HasFolderHierarchySynced state {Prop_Bool} for store.OperationalNN
403Restore store (Network source: {Prop_String1}; Account ID: {Prop_String2}); …OperationalNN
600Dormant Hint: ACTIVEOperationalNN
601Dormant Hint: DORMANTOperationalNN
750Total AUTD accounts count changed (previous count: {Prop_UINT1}; new count: …OperationalNN
751Saving fallback schedule for account {Prop_HEXINT1}.OperationalNN
752Demoting schedule for account {Prop_HEXINT1} (current schedule: {Prop_HEXINT2}; …OperationalNN
753Account {Prop_HEXINT1} schedule changed from {Prop_HEXINT2} to {Prop_HEXINT3}.OperationalNN
800Received OAuth token of type Prop_String1 expiring in Prop_FileTime1seconds.OperationalNN
801Received OAuth token of type {Prop_String1} expiring in {Prop_FileTime1}seconds.OperationalNN
802Received OAuth token of type Prop_String1 expiring in Prop_FileTime1seconds.OperationalNN
803The SSO Token request failed with status P1_Int32.OperationalNN
804The SSO request failed with a provider error (status: Prop_HexInt32, message: …OperationalNN
810Cred Vault: DeletePwd Called.OperationalNN

Event ID 1: Error: Error Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 2: Error Propagated: Error_Propagated Location: Location Line Number: Line_Number.

#
Channel
Operational

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

NameDescription
P1_HResult Int32
P2_String AnsiString
P3_UInt32 UInt32

Event ID 101: Commsync:[Ctrl] [Prop_Dword] [Prop_StringA_1] Prop_StringA_2.

#
Channel
Operational

Message #

Commsync:[Ctrl] [%1] [%2] %3

Fields #

NameDescription
Prop_Dword HexInt32
Prop_StringA_1 AnsiString
Prop_StringA_2 AnsiString

Event ID 104: Prop_String1Prop_String2Prop_String3 Prop_AnsiString.

#
Channel
Operational

Message #

%1%2%3 %4

Fields #

NameDescription
Prop_String1 UnicodeString
Prop_String2 UnicodeString
Prop_String3 UnicodeString
Prop_AnsiString AnsiString

Event ID 121: SyncUtil: [Start Marker] [SPERF_TAG_LOAD_XMLDOM_START] Start loading xml [P1_UnicodeString].

#
Channel
Operational
Task
SPERF_TAG_LOAD_XMLDOM
Opcode
Start

Message #

SyncUtil: [Start Marker] [SPERF_TAG_LOAD_XMLDOM_START] Start loading xml [%1]

Fields #

NameDescription
P1_UnicodeString UnicodeString

Event ID 122: SyncUtil: [Stop Marker] [SPERF_TAG_SYNC_ENGINE_STOP] Done loading xml [P1_UnicodeString].

#
Channel
Operational
Task
SPERF_TAG_LOAD_XMLDOM
Opcode
Stop

Message #

SyncUtil: [Stop Marker] [SPERF_TAG_SYNC_ENGINE_STOP] Done loading xml [%1]

Fields #

NameDescription
P1_UnicodeString UnicodeString

Event ID 202: SyncUtil: MXSML Error code=P1_HexInt32.

#
Channel
Operational

Message #

SyncUtil: MXSML Error code=%1

Fields #

NameDescription
P1_HexInt32 HexInt32

Event ID 203: SyncUtil: MXSML Error reason=P1_UnicodeString.

#
Channel
Operational

Message #

SyncUtil: MXSML Error reason=%1

Fields #

NameDescription
P1_UnicodeString UnicodeString

Event ID 204: SyncUtil: MXSML Error url=P1_UnicodeString.

#
Channel
Operational

Message #

SyncUtil: MXSML Error url=%1

Fields #

NameDescription
P1_UnicodeString UnicodeString

Event ID 205: SyncUtil: MXSML Error srcText=P1_UnicodeString.

#
Channel
Operational

Message #

SyncUtil: MXSML Error srcText=%1

Fields #

NameDescription
P1_UnicodeString UnicodeString

Event ID 206: SyncUtil: MXSML Error offset=P1_Int32.

#
Channel
Operational

Message #

SyncUtil: MXSML Error offset=%1

Fields #

NameDescription
P1_Int32 Int32

Event ID 301: SyncUtil: Account attempted to access SyncPersistentObjectManager when NULL

#
Channel
Operational

Event ID 400: Backup store {Prop_String1} {Prop_String2}.

#
Channel
Operational

Description

Backup store {Prop_String1} {Prop_String2}. Poom Props: {Prop_UINT1}; Poom Named Props: {Prop_UINT2}; Mapi Props: {Prop_UINT3}; Folders: {Prop_UINT4}.

Message #

Backup store {Prop_String1} {Prop_String2}.  Poom Props: {Prop_UINT1}; Poom Named Props: {Prop_UINT2}; Mapi Props: {Prop_UINT3}; Folders: {Prop_UINT4}

Fields #

NameDescription
Prop_String1
Prop_String2
Prop_UINT1
Prop_UINT2
Prop_UINT3
Prop_UINT4

Event ID 401: Restored store {Prop_String1} {Prop_String2}.

#
Channel
Operational

Description

Restored store {Prop_String1} {Prop_String2}. Restored: {Prop_Bool1}; Store found: {Prop_Bool2}; RestoreAllInfo: {Prop_Bool3}.

Message #

Restored store {Prop_String1} {Prop_String2}. Restored: {Prop_Bool1}; Store found: {Prop_Bool2}; RestoreAllInfo: {Prop_Bool3}

Fields #

NameDescription
Prop_String1
Prop_String2
Prop_Bool1
Prop_Bool2
Prop_Bool3

Event ID 402: Got HasFolderHierarchySynced state {Prop_Bool} for store.

#
Channel
Operational

Fields #

NameDescription
Prop_Bool

Event ID 403: Restore store (Network source: {Prop_String1}; Account ID: {Prop_String2}); forget: {Prop_Bool}.

#
Channel
Operational

Fields #

NameDescription
Prop_String1
Prop_String2
Prop_Bool

Event ID 600: Dormant Hint: ACTIVE

#
Channel
Operational

Event ID 601: Dormant Hint: DORMANT

#
Channel
Operational

Event ID 750: Total AUTD accounts count changed (previous count: {Prop_UINT1}; new count: {Prop_UINT2}; AUTD limit: {Prop_UINT3}).

#
Channel
Operational

Fields #

NameDescription
Prop_UINT1
Prop_UINT2
Prop_UINT3

Event ID 751: Saving fallback schedule for account {Prop_HEXINT1}.

#
Channel
Operational

Description

Saving fallback schedule for account {Prop_HEXINT1} (current schedule: {Prop_HEXINT2}; requested schedule {Prop_HEXINT2}; fallback schedule: {Prop_HEXINT4}; AUTD limit: {Prop_UINT1}).

Message #

Saving fallback schedule for account {Prop_HEXINT1} (current schedule: {Prop_HEXINT2}; requested schedule {Prop_HEXINT2}; fallback schedule: {Prop_HEXINT4}; AUTD limit: {Prop_UINT1}).

Fields #

NameDescription
Prop_HEXINT1
Prop_HEXINT2
Prop_HEXINT4
Prop_UINT1

Event ID 752: Demoting schedule for account {Prop_HEXINT1} (current schedule: {Prop_HEXINT2}; new schedule: {Prop_HEXINT3}; AUTD limit: {Prop_UINT1}).

#
Channel
Operational

Fields #

NameDescription
Prop_HEXINT1
Prop_HEXINT2
Prop_HEXINT3
Prop_UINT1

Event ID 753: Account {Prop_HEXINT1} schedule changed from {Prop_HEXINT2} to {Prop_HEXINT3}.

#
Channel
Operational

Fields #

NameDescription
Prop_HEXINT1
Prop_HEXINT2
Prop_HEXINT3

Event ID 800: Received OAuth token of type Prop_String1 expiring in Prop_FileTime1seconds.

#
Channel
Operational

Message #

Received OAuth token of type %1 expiring in %2seconds.

Fields #

NameDescription
Prop_String1 UnicodeString
Prop_FileTime1 FILETIME

Event ID 801: Received OAuth token of type {Prop_String1} expiring in {Prop_FileTime1}seconds.

#
Channel
Operational

Fields #

NameDescription
Prop_String1
Prop_FileTime1

Event ID 802: Received OAuth token of type Prop_String1 expiring in Prop_FileTime1seconds.

#
Channel
Operational

Message #

Received OAuth token of type %1 expiring in %2seconds.

Fields #

NameDescription
Prop_String1 UnicodeString
Prop_FileTime1 FILETIME

Event ID 803: The SSO Token request failed with status P1_Int32.

#
Channel
Operational

Message #

The SSO Token request failed with status %1

Fields #

NameDescription
P1_Int32 Int32

Event ID 804: The SSO request failed with a provider error (status: Prop_HexInt32, message: Prop_String).

#
Channel
Operational

Message #

The SSO request failed with a provider error (status: %1, message: %2)

Fields #

NameDescription
Prop_HexInt32 HexInt32
Prop_String UnicodeString

Event ID 810: Cred Vault: DeletePwd Called.

#
Channel
Operational

Description

Cred Vault: DeletePwd Called. Caller: UpdatePasswordForAccount, Partner P1_HexInt32.

Message #

Cred Vault: DeletePwd Called. Caller: UpdatePasswordForAccount, Partner %1

Fields #

NameDescription
P1_HexInt32 HexInt32

Provenance

ETW provider GUID dca074ce-547c-4595-ae90-56229b8e3bd9

Defined in SYNCUTIL.dll, which carries the event manifest.