Microsoft-Windows-Privacy-Auditing-PermissiveLearningMode

Event	Title	Channel	Sample	Rule
2000	App AppPackageFamilyName running as user TargetUserSid was allowed access to …	Operational	N	N

Event ID 2000: App AppPackageFamilyName running as user TargetUserSid was allowed access to capability CapabilityName due to Permissive Learning Mode.

Channel: Operational
Task: AccessCheck

Description

App AppPackageFamilyName running as user TargetUserSid was allowed access to capability CapabilityName due to Permissive Learning Mode. App must manifest CapabilityName to function outside of Permissive Learning Mode.

Message #

App %4 running as user %1 was allowed access to capability %2 due to Permissive Learning Mode. App must manifest %2 to function outside of Permissive Learning Mode.

Fields #

Name	Description
`TargetUserSid` SID	SID of the target account.
`CapabilityName` UnicodeString
`CapabilitySid` SID
`AppPackageFamilyName` UnicodeString
`PackageSid` SID

Provenance

ETW provider GUID 811a1ddb-2e69-5f25-adc0-4b186170e760

Defined in CapabilityAccessManager.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB