Microsoft-Windows-ModernDeployment-Diagnostics-Provider
Event ID 100: Autopilot policy [Message1] not found.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 100,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:02.188508+00:00",
"event_record_id": 28,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 3512
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "ZtdCorrelationId"
},
"message": ""
}
Event ID 101: AutopilotGetPolicyDwordByName succeeded: policy name = Message1; policy value = Int1.
#Event ID 102: AutopilotGetPolicyDwordByName error: policy name = Message1; HRESULT = HRESULT.
#Event ID 103: AutopilotGetPolicyStringByName succeeded: policy name = Message1; policy value = Message2.
#Event ID 104: AutopilotGetPolicyStringByName error: policy name = Message1; HRESULT = HRESULT.
#Event ID 105: AutopilotDisable succeeded.
#Event ID 106: AutopilotDisable error: HRESULT = HRESULT.
#Event ID 108: AutopilotIsDisabled error: HRESULT = HRESULT.
#Event ID 109: AutopilotGetOobeSettingsOverride succeeded: OOBE setting = Message1; state = Message2.
#Event ID 110: AutopilotGetOobeSettingsOverride error: OOBE setting = Message1; HRESULT = HRESULT.
#Event ID 111: AutopilotRetrieveSettings succeeded.
#Event ID 112: AutopilotRetrieveSettings error: HRESULT = HRESULT.
#Event ID 113: Autopilot reported the DLL was unloaded while there were Int1 outstanding calls.
#Event ID 114: AutopilotRetrieveSettings was skipped because this version of Windows does not support Azure Active Directory join.
#Event ID 115: Autopilot discovery failed to find a valid MDM.
#Event ID 116: Autopilot Device ESP Domain Controller override was not set.
#Event ID 117: Autopilot Device ESP Domain Controller override was set by state UInt1.
#Event ID 118: Autopilot task to detect hardware change started.
#Event ID 119: Autopilot task to detect hardware change finished successfully.
#Event ID 120: Autopilot task to detect hardware change failed.
#Event ID 121: Autopilot task to detect hardware change finished successfully.
#Description
Autopilot task to detect hardware change finished successfully. No change was detected.
Message #
Event ID 122: Autopilot task to detect hardware change finished successfully.
#Description
Autopilot task to detect hardware change finished successfully. A change was detected and reported.
Message #
Event ID 123: Autopilot task to detect hardware change was aborted or cancelled before completion.
#Event ID 124: Autopilot starting to disable task: Message1.
#Event ID 125: Autopilot successfully disabled task: Autopilot_successfully_disabled_task.
#Event ID 126: Autopilot failed to disable task.
#Event ID 127: Autopilot starting to enable task: Message1.
#Event ID 128: Autopilot successfully enabled task: Autopilot_successfully_enabled_task.
#Event ID 129: Autopilot failed to enable task.
#Event ID 130: Autopilot hardware remediation report failed.
#Event ID 131: Autopilot hardware remediation must wait before reporting again.
#Event ID 132: Autopilot hardware remediation failed to process response.
#Event ID 133: Autopilot hardware remediation failed to read cached hardware.
#Event ID 134: Autopilot hardware remediation failed to write cached hardware.
#Event ID 150: AutopilotManager started the MSA service for TPM attestation identity.
#Event ID 151: AutopilotManager started the TPM maintenance task to update TPM attestation.
#Event ID 152: AutopilotManager reported TPM maintenance task is complete.
#Event ID 153: AutopilotManager reported the state changed from InitialState to UpdateState.
#Message #
Fields #
| Name | Description |
|---|---|
InitialState UInt32 | |
UpdateState UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 153,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:06.069716+00:00",
"event_record_id": 29,
"correlation": {
"ActivityID": "C5B1AF6E-270C-4D62-8042-94BEA2A2BA55"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"InitialState": 0,
"UpdateState": 1
},
"message": ""
}
Event ID 154: AutopilotManager failed to start MSA service.
#Event ID 155: AutopilotManager failed to start TPM task.
#Event ID 156: AutopilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required.
#Description
AutopilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required. Autopilot cannot proceed.
Message #
Event ID 157: AutopilotManager reported that TPM attestation lasted UInt1 microseconds.
#Event ID 158: AutopilotManager reported that TPM enhanced diagnostics logging was enabled for UInt1 providers.
#Event ID 160: AutopilotRetrieveSettings beginning acquisition.
#Event ID 161: AutopilotManager retrieve settings succeeded.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 161,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.264631+00:00",
"event_record_id": 8,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 162: AutopilotManager determined download is not required and the device is not provisioned.
#Description
AutopilotManager determined download is not required and the device is not provisioned. Clean or reset the device to change this.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 162,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:31.162906+00:00",
"event_record_id": 14,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 163: AutopilotManager determined download is not required and the device is already provisioned.
#Description
AutopilotManager determined download is not required and the device is already provisioned. Clean or reset the device to change this.
Message #
Event ID 164: AutopilotManager determined Internet is available to attempt policy download.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 164,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:25.048353+00:00",
"event_record_id": 5,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 165: AutopilotManager determined Internet is not available; policy download will queue when available.
#Event ID 166: AutopilotManager reported Internet is now available.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 166,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:25.038727+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 167: AutopilotManager reported Internet is still not available.
#Event ID 168: AutopilotManager reported MSA TPM device identity was updated.
#Event ID 169: AutopilotManager set TPM identity confirmed.
#Event ID 170: AutopilotManager reported that Autopilot profile download is now complete.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 170,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2026-03-09T18:21:06.070120+00:00",
"event_record_id": 30,
"correlation": {
"ActivityID": "C5B1AF6E-270C-4D62-8042-94BEA2A2BA55"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 171: AutopilotManager failed to set TPM identity confirmed.
#Event ID 172: AutopilotManager failed to set Autopilot profile as available.
#Event ID 173: AutopilotManager failed to register for network availability.
#Event ID 174: AutopilotManager failed to register for device identity availability.
#Event ID 175: AutopilotManager failed to register for device identity task update.
#Event ID 176: MSA TPM keystate has been updated.
#Event ID 177: Configuring TPM for attestation.
#Event ID 178: AutopilotManager began device enrollment with internal state Int1.
#Event ID 179: AutopilotManager began device enrollment phase State.
#Event ID 180: AutopilotManager failed during device enrollment phase State.
#Event ID 181: AutopilotManager completed device enrollment phase State.
#Event ID 182: AutopilotManager reported that the retry timer event was set to UInt1 milliseconds.
#Event ID 183: AutopilotManager reported that the retry timer event occurred
#Event ID 184: AutopilotManager failed to register for MSA keystate update availability.
#Event ID 185: AutopilotManager failed to retrieve settings.
#Event ID 186: AutopilotManager TPM configuration already in progress.
#Event ID 187: AutopilotManager TPM configuration occurred before retry timer ready.
#Event ID 189: Configuring TPM exceeded maximum number of attempts.
#Event ID 190: Windows AIK certificate enrollment task was triggered.
#Event ID 191: Windows TPM maintenance task is being skipped since AIK certificate is already present.
#Event ID 192: Autopilot device enrollment failed with error HRESULT = HRESULT.
#Event ID 193: Autopilot manager is attempting profile download retry.
#Event ID 194: Autopilot manager will re-attempt the download after UInt1 milliseconds.
#Event ID 195: AutopilotManager began device unenrollment
#Event ID 196: AutopilotManager completed device unenrollment.
#Event ID 197: AutopilotManager failed device unenrollment.
#Event ID 200: Windows AIK object could not be loaded.
#Event ID 201: Windows AIK key not found by name.
#Event ID 202: Windows AIK certificate download failed.
#Event ID 203: Windows AIK alternative load failed.
#Event ID 204: Windows AIK certificate request did not result in a new certificate.
#Event ID 205: Windows AIK certificate request succeeded and a new certificate is available.
#Event ID 206: Windows AIK key could not be opened.
#Event ID 207: Windows AIK key failed certificate request.
#Event ID 208: Windows EK certificate is present.
#Event ID 209: Windows EK certificate is not present.
#Event ID 210: Windows AIK key was found even though the Windows EK certificate is not present.
#Description
Windows AIK key was found even though the Windows EK certificate is not present. Attempting to re-initialize the TPM task.
Message #
Event ID 211: AutopilotManager reported that a TPM was required but the TPM failed an attestation capability check.
#Event ID 212: AutopilotManager reported the TPM returned the following for known vulnerabilities: HRESULT = HRESULT.
#Event ID 213: AutopilotManager reported the TPM returned the following for Key attestation capability: HRESULT = HRESULT.
#Event ID 250: AutopilotManager started AIK certificate acquisition task.
#Event ID 251: AutopilotManager reported AIK certificate acquisition task returned HRESULT = Elapsed_time.
#Event ID 252: AutopilotManager reported AIK key was located.
#Event ID 253: AutopilotManager reported AIK certificate was located.
#Event ID 254: AutopilotManager reported AIK certificate was not located.
#Event ID 285: AutopilotManager is determining whether device has internet access.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 285,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:24.908119+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 286: AutopilotManager is determining Autopilot profile availability.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 286,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:31.162893+00:00",
"event_record_id": 13,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 287: Tracking resource type Message1.
#Event ID 288: Tracking resource type Message1.
#Event ID 289: Tracking resource type Message1.
#Event ID 290: Tracking resource type Message1.
#Event ID 291: Tracking resource type Message1.
#Event ID 292: Tracking resource type Message1.
#Event ID 293: Tracking resource type Message1.
#Event ID 294: Tracking resource type Message1.
#Event ID 295: Tracking resource type Message1.
#Event ID 296: Tracking resource type Message1.
#Event ID 297: Tracking resource type Message1.
#Event ID 298: Tracking resource type Message1.
#Event ID 299: Tracking resource type Message1.
#Event ID 300: AutopilotManager device enrollment reported an initialization failure.
#Event ID 301: AutopilotManager device enrollment reported a blocking failure.
#Event ID 302: AutopilotManager device enrollment failed during stage State with error HRESULT.
#Event ID 303: AutopilotManager device enrollment succeeded.
#Event ID 310: Autopilot configuration file path: Autopilot_configuration_file_path.
#Event ID 311: Failed to load Autopilot configuration file, HRESULT = HRESULT.
#Event ID 312: Failed to parse Autopilot configuration file, HRESULT = HRESULT.
#Event ID 313: Invalid ZtdCorrelationId found in Autopilot configuration file, HRESULT = HRESULT.
#Event ID 314: AutopilotManager reported that the Autopilot profile data could not be downloaded.
#Description
AutopilotManager reported that the Autopilot profile data could not be downloaded. Any Autopilot settings will not be used and the device will not be managed.
Message #
Event ID 315: AutopilotManager failed to record the setting for Autopilot device not managed, HRESULT = HRESULT.
#Event ID 316: AutopilotSync: Starting sync sessions for SyncType: UInt1.
#Event ID 317: AutopilotSync: Ending sync sessions for SyncType: UInt1.
#Event ID 318: AutopilotSync: Attempted sync session.
#Event ID 319: AutopilotSync: Skipped sync session.
#Event ID 320: AutopilotSync: Using user SID: AutopilotSync_Using_user_SID.
#Event ID 321: AutopilotSync: Current sync session.
#Event ID 350: Autopilot for Surface Hub encountered bad override data.
#Event ID 351: Autopilot for Surface Hub override succeeded.
#Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Event ID 352: Autopilot for Surface Hub failed to configure properties.
#Event ID 353: Autopilot for Surface Hub failed to apply properties.
#Event ID 354: Autopilot for Surface Hub applied properties successfully
#Event ID 355: Autopilot for Surface Hub failed to validate a property.
#Event ID 356: Autopilot for Surface Hub failed to execute the Csp successfully.
#Event ID 357: Autopilot for Surface Hub validated and applied properties successfully
#Event ID 358: Autopilot for Surface Hub failed to apply the device account successfully.
#Event ID 400: Autopilot Initial Provisioning reported a change in connection status.
#Event ID 401: Autopilot Initial Provisioning heartbeat occurred.
#Event ID 402: Autopilot Initial Provisioning detected a network state change.
#Event ID 403: Autopilot Provisioning change.
#Event ID 404: Autopilot Provisioning change started.
#Event ID 405: Autopilot Provisioning change succeeded.
#Event ID 406: Autopilot Provisioning change failed.
#Event ID 407: Autopilot Provisioning change failed with unspecified error.
#Event ID 408: Autopilot Provisioning reported a warning occurred.
#Event ID 410: Device preparation page settings were loaded successfully.
#Event ID 411: Unexpected error: a device preparation page setting value could not be loaded/converted.
#Event ID 412: Agent download completed.
#Event ID 413: Agent download notification complete.
#Event ID 414: Agent download notification handler changed.
#Description
Agent download notification handler changed. Callback was added.
Message #
Event ID 415: Agent download notification handler changed.
#Description
Agent download notification handler changed. Callback was removed.
Message #
Event ID 416: Agent download was triggered.
#Event ID 417: A duplicate deployment workload with this id already exists.
#Event ID 418: A duplicate deployment workload batch with this id already exists.
#Event ID 419: Runtime activation of a device preparation class failed due to invalid mode.
#Event ID 500: Invalid data specified in Autopilot policy override configuration.
#Event ID 501: AutopilotManager failed to load Json for HRESULT.
#Event ID 502: AutopilotManager failed to clear for HRESULT.
#Event ID 503: AutopilotManager failed to delete Json for HRESULT.
#Event ID 504: AutopilotManager deleted configuration file Message1.
#Event ID 505: AutopilotManager loaded configuration file Message1.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 505,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:02.141371+00:00",
"event_record_id": 17,
"correlation": {
"ActivityID": "78324F2B-4F77-4BDB-AD31-1593143E4213"
},
"execution": {
"process_id": 4888,
"thread_id": 9948
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "AutopilotDDSZTDFile.json"
},
"message": ""
}
Event ID 506: AutopilotManager failed to expand path for Message1.
#Event ID 507: AutopilotManager explictly disabled TPM required due to registry setting.
#Event ID 508: AutopilotManager explictly enabled TPM required due to registry setting.
#Event ID 509: AutopilotManager enabled TPM requirement due to WhiteGlove policy value UInt1.
#Event ID 700: Autopilot downloader failed to load override registsry data for Message1.
#Event ID 701: Autopilot downloader did not save new profile information because the new profile was empty.
#Event ID 702: Autopilot downloader saved the new profile to Message1.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 702,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.256412+00:00",
"event_record_id": 7,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6520
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc\\AutopilotDDSZTDFile.json"
},
"message": ""
}
Event ID 703: Autopilot downloader retrieved a new profile for Message1.
#Event ID 704: Autopilot downloader retrieved an empty profile for Message1.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 704,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:27.255925+00:00",
"event_record_id": 6,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6520
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "DdsZtdPolicyManager"
},
"message": ""
}
Event ID 705: Autopilot downloader cleared the local profile for Message1.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 705,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 4611686018427387904,
"time_created": "2025-12-31T19:33:24.392812+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "DdsZtdPolicyManager"
},
"message": ""
}
Event ID 706: Autopilot downloader failed to download profile for HRESULT.
#Event ID 707: Autopilot downloader failed to download profile for HRESULT.
#Event ID 708: Autopilot downloader failed to extract additional error details from response.
#Event ID 709: Autopilot failed to download data.
#Event ID 710: Autopilot failed to acquire a device ticket for target URL Message1.
#Event ID 711: Autopilot downloader failed to parse target URL.
#Event ID 712: Autopilot downloader failed to convert time Message1.
#Event ID 713: Autopilot downloader will use MSA Pre-production environment.
#Description
Autopilot downloader will use MSA Pre-production environment. This will result in Autopilot failures if production device identities were used.
Message #
Event ID 714: Autopilot downloader reported a failure acquiring the MSA device ticket.
#Description
Autopilot downloader reported a failure acquiring the MSA device ticket. This most likely occurred because MSA and CXH environments do not match (production versus PPE).
Message #
Event ID 750: Autopilot downloader reported a failure acquiring the MSA device ticket due to certificate errors.
#Description
Autopilot downloader reported a failure acquiring the MSA device ticket due to certificate errors. This may be caused by the wrong clock time on the machine so a forced time sync will be attempted.
Message #
Event ID 751: Autopilot downloader reported time sync succeeded.
#Event ID 752: Autopilot downloader reported time sync failed with error = HRESULT.
#Event ID 753: Autopilot downloader reported that the machine clock is too far off the server time and a forced time sync will be attempted.
#Event ID 1000: Management service starting.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1000,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:01.066409+00:00",
"event_record_id": 14,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1001: Management service started.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1001,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:02.125001+00:00",
"event_record_id": 16,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1002: Management service failed to start.
#Event ID 1003: Management service failed to register.
#Event ID 1004: Management service shutdown.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1004,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:21.532518+00:00",
"event_record_id": 18,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1005: Management service WIL error was reported.
#Event ID 1006: Management service call Message1 is deprecated!
#Event ID 1007: Management service cleared the local Autopilot cached state.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1007,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:24.564324+00:00",
"event_record_id": 6,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6752
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": ""
}
Event ID 1008: Management service failed to clear the local Autopilot cached state.
#Event ID 1009: Management InProc Objects WIL error was reported.
#Event ID 1100: Management service will use Message1 for persisted storage.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1100,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2026-03-09T18:21:01.074751+00:00",
"event_record_id": 15,
"correlation": {},
"execution": {
"process_id": 4888,
"thread_id": 4516
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "LAB-WIN11",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1101: Management service did not find Message1.
#Description
Management service did not find Message1. Attempting to create it.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1101,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:20.250928+00:00",
"event_record_id": 3,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6792
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1102: Management service created Message1.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
"guid": "BAB3AD92-FB96-5902-450B-B8421BDEC7BD",
"event_source_name": "",
"event_id": 1102,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 1152921504606846976,
"time_created": "2025-12-31T19:33:20.251448+00:00",
"event_record_id": 4,
"correlation": {},
"execution": {
"process_id": 6772,
"thread_id": 6792
},
"channel": "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService",
"computer": "WIN11-22H2-X64",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "C:\\Windows\\ServiceState\\wmansvc"
},
"message": ""
}
Event ID 1103: Management service found ProcMon.
#Description
Management service found ProcMon.exe for startup profiling.
Message #
Event ID 1104: Management service determined ProcMon.
#Description
Management service determined ProcMon.exe startup profiling is not enabled in the registry.
Message #
Event ID 1105: Management service determined ProcMon.
#Description
Management service determined ProcMon.exe startup profiling is enabled in the registry.
Message #
Event ID 1106: Management service is beginning ProcMon.
#Description
Management service is beginning ProcMon.exe startup profiling.
Message #
Event ID 1107: Management service is began ProcMon.
#Description
Management service is began ProcMon.exe startup profiling.
Message #
Event ID 1108: Management service is stopping ProcMon.
#Description
Management service is stopping ProcMon.exe startup profiling.
Message #
Event ID 1109: Management service has stopped ProcMon.
#Description
Management service has stopped ProcMon.exe startup profiling.
Message #
Event ID 1500: [Unit Tests] This is a test event string.
#Event ID 1501: [Unit Tests] This is a test CXH event string.
#Event ID 1502: [Unit Tests] This is a test Resource event string.
#Event ID 1503: Failed to export logs for ETW channel 'Message1'.
#Event ID 1504: ETW decoder failed to read next block of events.
#Event ID 1505: Abstraction of exported ETW record failed.
#Event ID 1506: An error occurred while extracting the registry value for diagnostic data 'Message1'.
#Event ID 1507: Expected channel 'Message1' could not be found in the EtwProcessingData JSON object.
#Event ID 1508: Expected EtwProcessingData entry corresponding to event 'Message1' could not be found.
#Event ID 1509: Expected diagnostic data 'Message1' could not be found.
#Event ID 1510: CXH event was malformed.
#Event ID 1511: Expected required diagnostic data 'Message1' from the extracted data list was missing some expected data.
#Event ID 1512: The API executed all actions successfully.
#Event ID 1513: The API encountered an error at state 'FailedApiState'.
#Event ID 1514: The expected key 'Message1' was not found in the 'Message2' map.
#Event ID 1515: The expected diagnostic data 'Message1' was missing.
#Event ID 1516: Resource event was malformed.
#Event ID 1517: CXH event was missing data.
#Event ID 1518: The API is entering the 'Message1' state.
#Event ID 1519: The API completed the 'Message1' state successfully.
#Event ID 1520: The API successfully retrieved the serialized JSON from the 'Message1' file.
#Event ID 1521: The API successfully deserialized the 'Message1' file JSON string.
#Event ID 1522: The API successfully aggregated the source data.
#Event ID 1523: The 'Message1' concurrent worker has begun.
#Event ID 1524: The 'Message1' concurrent worker completed successfully.
#Event ID 1525: An exception occurred while processing diagnostic data.
#Event ID 1526: Diagnostic extraction failed.
#Event ID 1527: The localized string for 'Message1' could not be loaded.
#Event ID 1700: MDM Alert sync session: FeatureName: MDM_Alert_sync_session_FeatureName, IsCompleted: IsCompleted, SessionState: SessionState, SyncSessionId: SyncSessionId, EnrollmentId: EnrollmentId.
#Provenance
ETW provider GUID bab3ad92-fb96-5902-450b-b8421bdec7bd
Defined in autopilotdiag.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB