Microsoft-Windows-OverlayFilter

Event	Title	Channel	Sample	Rule
24832	The filter failed to open the integrity file for FileNameBuffer (data source …	System	N	N
24833	The filter failed to validate block BlockNumber of length BlockLength from …	System	N	N
24834	The filter failed to validate a read from FileNameBuffer at file offset …	System	N	N
24835	The task is enumerating Volume volume.	System	N	N
24836	The task has failed to report integrity file generation completion to BitLocker.	System	N	N
24837	The task has created integrity file wimHashFile for file wimFile.	System	N	N
24838	The task has completed generation of integrity file wimHashFile for file …	System	N	N
24839	The task has deleted integrity file wimHashFile for file wimFile.	System	N	N
24840	The task is resuming generation of integrity file filename at file offset …	System	N	N
24841	The task has paused generation of integrity file filename at file offset offset.	System	N	N
24842	The task has failed to identify encryption/decryption state.	System	N	N
24843	The task has failed to generate integrity file wimHashFile for file wimFile.	System	N	N
24844	The task has failed to delete integrity file wimHashFile for file wimFile.	System	N	N
24845	The task has failed to read file at wimHashFile.	System	N	N
24846	The task has failed to write file at wimHashFile.	System	N	N
24847	The filter opened the integrity file for FileNameBuffer (data source …	System	N	N
24848	The filter did not open the integrity file for FileNameBuffer (data source …	System	N	N
24849	The task is generating integrity files	System	N	N
24850	The task is deleting integrity files	System	N	N

Event ID 24832: The filter failed to open the integrity file for FileNameBuffer (data source DataSourceId) with status Status.

Channel: System
Task: WIMintegrityverification
Opcode: IntegrityFileOpen

Message #

The filter failed to open the integrity file for %2 (data source %3) with status %4.

Fields #

Name	Description
`FileNameLength` UInt16
`FileNameBuffer` UnicodeString
`DataSourceId` Int64
`Status` HexInt32	NTSTATUS reference

Event ID 24833: The filter failed to validate block BlockNumber of length BlockLength from FileNameBuffer.

Channel: System
Task: WIMintegrityverification
Opcode: IntegrityBlockVerificationFailure

Message #

The filter failed to validate block %3 of length %4 from %2.

Fields #

Name	Description
`FileNameLength` UInt16
`FileNameBuffer` UnicodeString
`BlockNumber` UInt32
`BlockLength` UInt32

Event ID 24834: The filter failed to validate a read from FileNameBuffer at file offset FileOffset of length ReadSize.

Channel: System
Task: WIMintegrityverification
Opcode: IntegrityInvalidBlock

Message #

The filter failed to validate a read from %2 at file offset %3 of length %4.

Fields #

Name	Description
`FileNameLength` UInt16
`FileNameBuffer` UnicodeString
`FileOffset` Int64
`ReadSize` UInt32

Event ID 24835: The task is enumerating Volume volume.

Channel: System
Task: TheWindowsOverlayTask
Opcode: EnumVolume

Message #

The task is enumerating Volume %1

Fields #

Name	Description
`volume` UnicodeString

Event ID 24836: The task has failed to report integrity file generation completion to BitLocker.

Channel: System
Task: TheWindowsOverlayTask
Opcode: ReportHashGenerationToBitlockerError

Description

The task has failed to report integrity file generation completion to BitLocker. HRESULT = hr.

Message #

The task has failed to report integrity file generation completion to BitLocker. HRESULT = %1

Fields #

Name	Description
`hr` UInt32

Event ID 24837: The task has created integrity file wimHashFile for file wimFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: CreateHashFile

Message #

The task has created integrity file %1 for file %2

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString

Event ID 24838: The task has completed generation of integrity file wimHashFile for file wimFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: CompleteHashFile

Message #

The task has completed generation of integrity file %1 for file %2

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString

Event ID 24839: The task has deleted integrity file wimHashFile for file wimFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: DeleteHashFile

Message #

The task has deleted integrity file %1 for file %2

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString

Event ID 24840: The task is resuming generation of integrity file filename at file offset offset.

Channel: System
Task: TheWindowsOverlayTask
Opcode: ResumeHashFile

Message #

The task is resuming generation of integrity file %1 at file offset %2

Fields #

Name	Description
`filename` UnicodeString
`offset` UInt64

Event ID 24841: The task has paused generation of integrity file filename at file offset offset.

Channel: System
Task: TheWindowsOverlayTask
Opcode: PauseHashFile

Message #

The task has paused generation of integrity file %1 at file offset %2

Fields #

Name	Description
`filename` UnicodeString
`offset` UInt64

Event ID 24842: The task has failed to identify encryption/decryption state.

Channel: System
Task: TheWindowsOverlayTask
Opcode: ActionError

Description

The task has failed to identify encryption/decryption state. HRESULT = hr.

Message #

The task has failed to identify encryption/decryption state. HRESULT = %1

Fields #

Name	Description
`hr` UInt32

Event ID 24843: The task has failed to generate integrity file wimHashFile for file wimFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: GenerateHashFileError

Description

The task has failed to generate integrity file wimHashFile for file wimFile. HRESULT = hr.

Message #

The task has failed to generate integrity file %1 for file %2. HRESULT = %3

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString
`hr` Int32

Event ID 24844: The task has failed to delete integrity file wimHashFile for file wimFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: DeleteHashFileError

Description

The task has failed to delete integrity file wimHashFile for file wimFile. HRESULT = hr.

Message #

The task has failed to delete integrity file %1 for file %2. HRESULT = %3

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString
`hr` Int32

Event ID 24845: The task has failed to read file at wimHashFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: FileReadError

Description

The task has failed to read file at wimHashFile. HRESULT = hr.

Message #

The task has failed to read file at %1. HRESULT = %3

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString
`hr` Int32

Event ID 24846: The task has failed to write file at wimHashFile.

Channel: System
Task: TheWindowsOverlayTask
Opcode: FileWriteError

Description

The task has failed to write file at wimHashFile. HRESULT = hr.

Message #

The task has failed to write file at %1. HRESULT = %3

Fields #

Name	Description
`wimHashFile` UnicodeString
`wimFile` UnicodeString
`hr` Int32

Event ID 24847: The filter opened the integrity file for FileNameBuffer (data source DataSourceId).

Channel: System
Task: WIMintegrityverification
Opcode: IntegrityFileOpen

Message #

The filter opened the integrity file for %2 (data source %3).

Fields #

Name	Description
`FileNameLength` UInt16
`FileNameBuffer` UnicodeString
`DataSourceId` Int64

Event ID 24848: The filter did not open the integrity file for FileNameBuffer (data source DataSourceId) because it is not ready.

Channel: System
Task: WIMintegrityverification
Opcode: IntegrityFileOpen

Message #

The filter did not open the integrity file for %2 (data source %3) because it is not ready.

Fields #

Name	Description
`FileNameLength` UInt16
`FileNameBuffer` UnicodeString
`DataSourceId` Int64

Event ID 24849: The task is generating integrity files

Channel: System
Task: TheWindowsOverlayTask
Opcode: ActionGenerateHashes

Event ID 24850: The task is deleting integrity files

Channel: System
Task: TheWindowsOverlayTask
Opcode: ActionDeleteHashes

Provenance

ETW provider GUID 46c78e5c-a213-46a8-8a6b-622f6916201d

Defined in wof.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB