Microsoft-Windows-MSMQTriggers

44 events across 1 channel

Event	Title	Channel	Sample
2200	Message Queuing Triggers started successfully	Operational	N
2201	Message Queuing Triggers initialization failed	Operational	N
2202	Message Queuing Triggers failed to create an instance of the Triggers …	Operational	N
2203	The trigger information cannot be retrieved from the trigger store in registry	Operational	N
2204	The information for the attached rule cannot be retrieved from the trigger store …	Operational	N
2205	Opening the queue param3 for peeking at or retrieving messages failed	Operational	N
2206	Opening an internal queue needed by the Triggers service failed	Operational	N
2207	An instance of a rule handler for the rule param3 with the ID param4 was not …	Operational	N
2208	The action or a condition parameter for the rule param3 with the ID param4 was …	Operational	N
2209	The action defined by the rule param3 with the ID param4 was not invoked	Operational	N
2210	Rule evaluation or execution failed for the transactional trigger param3 with …	Operational	N
2211	Message Queuing Triggers service stopped	Operational	N
2212	The queue param1 was not found	Operational	N
2213	At least one of the required dependencies was not found	Operational	N
2214	Unable to update EventLog information in registry for 'param1'	Operational	N
2215	The Triggers transactional component could not be registered in COM+	Operational	N
2216	Retrieving messages from a queue located on a remote pre-Windows XP computer is …	Operational	N
2217	The parameters of the rule param1 with the ID param2 are now valid	Operational	N
2218	The rules attached to the trigger param1 with the ID param2 are now valid	Operational	N
2219	The Triggers service has been set to run under the Network Service account, but …	Operational	N
2222	The change for the Triggers service to run under the Network Service account …	Operational	N
2223	Message Queuing Triggers initialization failed to complete in the configured …	Operational	N
1073744024	Message Queuing Triggers started successfully.	Operational	N
1073744035	Message Queuing Triggers service stopped.	Operational	N
1073744041	The parameters of the rule param1 with the ID param2 are now valid.	Operational	N
1073744042	The rules attached to the trigger param1 with the ID param2 are now valid.	Operational	N
1073744043	The Triggers service has been set to run under the Network Service account, but …	Operational	N
2147485870	The change for the Triggers service to run under the Network Service account …	Operational	N
3221227673	Message Queuing Triggers initialization failed.	Operational	N
3221227674	Message Queuing Triggers failed to create an instance of the Triggers …	Operational	N
3221227675	The trigger information cannot be retrieved from the trigger store in registry.	Operational	N
3221227676	The information for the attached rule cannot be retrieved from the trigger store …	Operational	N
3221227677	Opening the queue param3 for peeking at or retrieving messages failed.	Operational	N
3221227678	Opening an internal queue needed by the Triggers service failed.	Operational	N
3221227679	An instance of a rule handler for the rule param3 with the ID param4 was not …	Operational	N
3221227680	The action or a condition parameter for the rule param3 with the ID param4 was …	Operational	N
3221227681	The action defined by the rule param3 with the ID param4 was not invoked.	Operational	N
3221227682	Rule evaluation or execution failed for the transactional trigger param3 with …	Operational	N
3221227684	The queue param1 was not found.	Operational	N
3221227685	At least one of the required dependencies was not found.	Operational	N
3221227686	Unable to update EventLog information in registry for 'param1'.	Operational	N
3221227687	The Triggers transactional component could not be registered in COM+.	Operational	N
3221227688	Retrieving messages from a queue located on a remote pre-Windows XP computer is …	Operational	N
3221227695	Message Queuing Triggers initialization failed to complete in the configured …	Operational	N

Event ID 2200: Message Queuing Triggers started successfully

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2201: Message Queuing Triggers initialization failed

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2202: Message Queuing Triggers failed to create an instance of the Triggers Transactional object

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2203: The trigger information cannot be retrieved from the trigger store in registry

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2204: The information for the attached rule cannot be retrieved from the trigger store for trigger param1 (Trigger Name: param2)

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2205: Opening the queue param3 for peeking at or retrieving messages failed

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString

Event ID 2206: Opening an internal queue needed by the Triggers service failed

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2207: An instance of a rule handler for the rule param3 with the ID param4 was not created

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString

Event ID 2208: The action or a condition parameter for the rule param3 with the ID param4 was not parsed

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString

Event ID 2209: The action defined by the rule param3 with the ID param4 was not invoked

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString

Event ID 2210: Rule evaluation or execution failed for the transactional trigger param3 with the ID

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString
`param3` UnicodeString
`param4` UnicodeString

Event ID 2211: Message Queuing Triggers service stopped

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2212: The queue param1 was not found

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2213: At least one of the required dependencies was not found

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2214: Unable to update EventLog information in registry for 'param1'

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2215: The Triggers transactional component could not be registered in COM+

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2216: Retrieving messages from a queue located on a remote pre-Windows XP computer is not supported

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2217: The parameters of the rule param1 with the ID param2 are now valid

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2218: The rules attached to the trigger param1 with the ID param2 are now valid

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2219: The Triggers service has been set to run under the Network Service account, but this setting will take effect only after the Triggers service is restarted

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2222: The change for the Triggers service to run under the Network Service account will not take effect as long as the "Allow service to interact with desktop" check box is selected

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 2223: Message Queuing Triggers initialization failed to complete in the configured timeout

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Event ID 1073744024: Message Queuing Triggers started successfully.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Message Queuing Triggers started successfully.

Message #

Message Queuing Triggers started successfully.

Event ID 1073744035: Message Queuing Triggers service stopped.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Message Queuing Triggers service stopped.

Message #

Message Queuing Triggers service stopped.

Event ID 1073744041: The parameters of the rule param1 with the ID param2 are now valid.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The parameters of the rule with the ID are now valid. The rule was evaluated successfully, and the action defined by it was executed.

Message #

The parameters of the rule %1 with the ID %2 are now valid. The rule was evaluated successfully, and the action defined by it was executed.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073744042: The rules attached to the trigger param1 with the ID param2 are now valid.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The rules attached to the trigger with the ID are now valid. All the rules were evaluated successfully, and the actions defined by them were executed.

Message #

The rules attached to the trigger %1 with the ID %2 are now valid. All the rules were evaluated successfully, and the actions defined by them were executed.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073744043: The Triggers service has been set to run under the Network Service account, but this setting will take effect only after the Triggers service is re...

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The Triggers service has been set to run under the Network Service account, but this setting will take effect only after the Triggers service is restarted. If you want the Triggers service to continue to run under the Local Service account (the default for the previous version of Triggers), modify the logon settings for the Triggers service in Computer Management.

Message #

The Triggers service has been set to run under the Network Service account, but this setting will take effect only after the Triggers service is restarted.  If you want the Triggers service to continue to run under the Local Service account (the default for the previous version of Triggers), modify the logon settings  for the Triggers service in Computer Management.

Event ID 2147485870: The change for the Triggers service to run under the Network Service account will not take effect as long as the "Allow service to interact with de...

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The change for the Triggers service to run under the Network Service account will not take effect as long as the "Allow service to interact with desktop" check box is selected. To allow this change to take effect, clear the "Allow service to interact with desktop" check box on the Log On page of the Properties dialog box for Message Queuing Triggers in Computer Management and restart the service.

Message #

The change for the Triggers service to run under the Network Service account will not take effect as long as the "Allow service to interact with desktop" check box is selected.  To allow this change to take effect, clear the "Allow service to interact with desktop" check box on the Log On page of the Properties dialog box for Message Queuing Triggers in Computer Management and restart the service.

Event ID 3221227673: Message Queuing Triggers initialization failed.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Message Queuing Triggers initialization failed. Error.

Message #

Message Queuing Triggers initialization failed. Error %1: %2

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227674: Message Queuing Triggers failed to create an instance of the Triggers Transactional object.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Message Queuing Triggers failed to create an instance of the Triggers Transactional object. As a result, no transactional retrieval triggers can be invoked. Mqgentr.dll may not be registered or may not exist in the %SystemRoot%\System32 folder. Error param1: param2

Message #

Message Queuing Triggers failed to create an instance of the Triggers Transactional object. As a result, no transactional retrieval triggers can be invoked. Mqgentr.dll may not be registered or may not exist in the %SystemRoot%\System32 folder. Error %1: %2

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227675: The trigger information cannot be retrieved from the trigger store in registry.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The trigger information cannot be retrieved from the trigger store in registry. At least one trigger is nonfunctional.

Message #

The trigger information cannot be retrieved from the trigger store in registry. At least one trigger is nonfunctional.

Event ID 3221227676: The information for the attached rule cannot be retrieved from the trigger store for trigger param1 (Trigger Name: param2).

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The information for the attached rule cannot be retrieved from the trigger store for trigger (Trigger Name: ). The trigger is nonfunctional.

Message #

The information for the attached rule cannot be retrieved from the trigger store for trigger %1 (Trigger Name: %2). The trigger is nonfunctional.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227677: Opening the queue param3 for peeking at or retrieving messages failed.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Opening the queue param3 for peeking at or retrieving messages failed. Local users may not have been granted the Peek Message or Receive Message permission for this queue. The trigger param4 is nonfunctional. Error param1: param2

Message #

Opening the queue %3 for peeking at or retrieving messages failed. Local users may not have been granted the Peek Message or Receive Message permission for this queue. The trigger %4 is nonfunctional. Error %1: %2

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`

Event ID 3221227678: Opening an internal queue needed by the Triggers service failed.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Opening an internal queue needed by the Triggers service failed. The account under which the Triggers service is running may not have permissions to open this queue, or the queue may have been deleted. To solve this problem, uninstall and reinstall the Triggers service. Error param1: param2

Message #

Opening an internal queue needed by the Triggers service failed. The account under which the Triggers service is running may not have permissions to open this queue, or the queue may have been deleted. To solve this problem, uninstall and reinstall the Triggers service. Error %1: %2

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227679: An instance of a rule handler for the rule param3 with the ID param4 was not created.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

An instance of a rule handler for the rule param3 with the ID param4 was not created. The rule cannot be evaluated and executed. The MSMQTriggerObjects.MSMQRuleHandler class may not be registered, or your System folder does not contain mqtrig.dll. Error param1: param2

Message #

An instance of a rule handler for the rule %3 with the ID %4 was not created. The rule cannot be evaluated and executed. The MSMQTriggerObjects.MSMQRuleHandler class may not be registered, or your System folder does not contain mqtrig.dll. Error %1: %2

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`

Event ID 3221227680: The action or a condition parameter for the rule param3 with the ID param4 was not parsed.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The action or a condition parameter for the rule param3 with the ID param4 was not parsed. The rule cannot be evaluated and executed. You can remove the rule entry from the Triggers registry and recreate it using local computer management. Error param1: param2

Message #

The action or a condition parameter for the rule %3 with the ID %4 was not parsed. The rule cannot be evaluated and executed. You can remove the rule entry from the Triggers registry and recreate it using local computer management. Error %1: %2

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`

Event ID 3221227681: The action defined by the rule param3 with the ID param4 was not invoked.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The action defined by the rule with the ID was not invoked. The COM object may not be registered, or the executable file may not exist in your path. Error.

Message #

The action defined by the rule %3 with the ID %4 was not invoked. The COM object may not be registered, or the executable file may not exist in your path. Error %1: %2

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`

Event ID 3221227682: Rule evaluation or execution failed for the transactional trigger param3 with the ID param4.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Rule evaluation or execution failed for the transactional trigger with the ID . A rule condition or action parameter may be invalid, or the COM object invoked may not be registered correctly. Error.

Message #

Rule evaluation or execution failed for the transactional trigger %3 with the ID %4. A rule condition or action parameter may be invalid, or the COM object invoked may not be registered correctly. Error %1: %2

Fields #

Name	Description
`param1`
`param2`
`param3`
`param4`

Event ID 3221227684: The queue param1 was not found.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The queue was not found. It may have been deleted. The trigger associated with this queue is nonfunctional. Please use Computer Management to remove this trigger.

Message #

The queue %1 was not found. It may have been deleted. The trigger %2 associated with this queue is nonfunctional. Please use Computer Management to remove this trigger.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227685: At least one of the required dependencies was not found.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

At least one of the required dependencies was not found. Please verify that MSMQ Triggers resources are dependent on Message Queue resources.

Message #

At least one of the required dependencies was not found. Please verify that MSMQ Triggers resources are dependent on Message Queue resources.

Event ID 3221227686: Unable to update EventLog information in registry for 'param1'.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Unable to update EventLog information in registry for 'param1'.

Message #

Unable to update EventLog information in registry for '%1'.

Fields #

Name	Description
`param1`

Event ID 3221227687: The Triggers transactional component could not be registered in COM+.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

The Triggers transactional component could not be registered in COM+. Error.

Message #

The Triggers transactional component could not be registered in COM+. Error %1: %2

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227688: Retrieving messages from a queue located on a remote pre-Windows XP computer is not supported.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Retrieving messages from a queue located on a remote pre-Windows XP computer is not supported. All triggers associated with the queue are nonfunctional.

Message #

Retrieving messages from a queue located on a remote pre-Windows XP computer is not supported. All triggers associated with the queue %1 are nonfunctional.

Fields #

Name	Description
`param1`

Event ID 3221227695: Message Queuing Triggers initialization failed to complete in the configured timeout.

Provider: Microsoft-Windows-MSMQTriggers
Channel: Operational

Description

Message Queuing Triggers initialization failed to complete in the configured timeout..

Message #

Message Queuing Triggers initialization failed to complete in the configured timeout..

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 2787cc62-2654-4227-9b35-b53f838507ae

Defined in mqutil.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3207, captured 2026-06-02

Downloads

Microsoft-Windows-MSMQTriggers registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)