detection.wiki

Microsoft-Windows-Program-Compatibility-Assistant

EventTitleChannelSampleRule
1task_0AnalyticNN
1Event ID 1CompatAfterUpgradeNN
3task_03AnalyticNN
3Event ID 3CompatAfterUpgradeNN
5task_05AnalyticNN
5Event ID 5CompatAfterUpgradeNN
8task_08AnalyticNN
8Event ID 8CompatAfterUpgradeNN
9task_09AnalyticNN
9Event ID 9CompatAfterUpgradeNN
10task_010AnalyticNN
10Event ID 10CompatAfterUpgradeNN
11task_011AnalyticNN
11Event ID 11CompatAfterUpgradeNN
12task_012AnalyticNN
12Event ID 12CompatAfterUpgradeNN
14task_014AnalyticNN
14Event ID 14CompatAfterUpgradeNN
15Binary data sent from PCA Diagnostic Module to PCA service for processingAnalytic, CompatAfterUpgradeNN
16PCA has finished monitoring an application: ExePath.Program-Compatibility-AssistantNN
17Exe: ResolverFiredEvent.ExePath ResolverName: ResolverFiredEvent.ResolverName.Program-Compatibility-AssistantYN
30The Program Compatibility Assistant was invoked to correct a compatibility …Program-Compatibility-AssistantNN
31The Program Compatibility Assistant was invoked to correct a compatibility …Program-Compatibility-AssistantNN
32The Program Compatibility Assistant was invoked due to an unsigned driver …Program-Compatibility-AssistantNN
101PCA Service startup begin.OperationalNN
102PCA Service startup finished.OperationalNN
103PCA Process Monitor begin.OperationalNN
104PCA Process Monitor finished.OperationalNN
105PCA Service initialization begin.OperationalNN
106PCA Service initialization finished.OperationalNN
107PCA Service initialization begin.OperationalNN
108PCA Service initialization finished.OperationalNN
200The Program Compatibility Assistant service was stopped successfully.Program-Compatibility-AssistantNN
201The Program Compatibility Assistant service started successfully.Program-Compatibility-AssistantNN
202The Program Compatibility Assistant service failed to initialize.Program-Compatibility-AssistantNN
203The Program Compatibility Assistant service failed to start.Program-Compatibility-AssistantNN
204The Program Compatibility Assistant service failed to stop.Program-Compatibility-AssistantNN
205The Program Compatibility Assistant service failed to perform the phase two …Program-Compatibility-AssistantNN
206The Program Compatibility Assistant service successfully performed phase two …Program-Compatibility-AssistantNN
1100Notified PCA service of status icon registration.AnalyticNN
1200PCA Trigger event:PCA_Trigger_event.AnalyticNN
1200PCA Trigger event:TriggerID.CompatAfterUpgradeNN
1234Exe: AppIdApplicationID.CompatAfterUpgradeNN

Event ID 1: task_0

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 1

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 3: task_03

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 3

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 5: task_05

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 5

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 8: task_08

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 8

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 9: task_09

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 9

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 10: task_010

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 10

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 11: task_011

#
Channel
Analytic

Fields #

NameDescription
DisplayNameSize
DisplayName
FullImagePathSize
FullImagePath
SessionId

Event ID 11

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
DisplayNameSize UInt32
DisplayName UnicodeString
FullImagePathSize UInt32
FullImagePath UnicodeString
SessionId UInt32

Event ID 12: task_012

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 12

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 14: task_014

#
Channel
Analytic

Fields #

NameDescription
ApplicationNameSize
ApplicationName
CommandLineSize
CommandLine
CurrentDirectorySize
CurrentDirectory
DllNameSize
DllName
InterfaceCLSID
SessionId
Flags

Event ID 14

#
Channel
CompatAfterUpgrade

Fields #

NameDescription
ApplicationNameSize UInt32
ApplicationName UnicodeString
CommandLineSize UInt32
CommandLine UnicodeString
CurrentDirectorySize UInt32
CurrentDirectory UnicodeString
DllNameSize UInt32
DllName UnicodeString
InterfaceCLSID GUID
SessionId UInt32
Flags UInt32

Event ID 15: Binary data sent from PCA Diagnostic Module to PCA service for processing

#
Channel
Analytic, CompatAfterUpgrade

Description

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Message #

Binary data sent from PCA Diagnostic Module to PCA service for processing. It is not meant to be human readable.

Fields #

NameDescription
TokenDataSize UInt32
TokenData Binary

Event ID 16: PCA has finished monitoring an application: ExePath.

#
Channel
Program-Compatibility-Assistant

Message #

PCA has finished monitoring an application: %1

The problems detected code is: %2

If this number is not 0, PCA observed some indications of compatibility problems.

For this application, the following dialog type was shown:%3

If this number is not 0, an actual dialog was shown offering possible fixes to suspected problems.

Fields #

NameDescription
ExePath UnicodeString
ResolverMap UInt64
DialogType UInt32

Event ID 17: Exe: ResolverFiredEvent.ExePath ResolverName: ResolverFiredEvent.ResolverName.

#
Channel
Program-Compatibility-Assistant
Level
Informational

Description

Exe: ExePath ResolverName: ResolverName

Message #

Exe: %1

ResolverName: %2

Fields #

NameDescription
ExePath
ResolverName

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Program-Compatibility-Assistant",
    "guid": "4CB314DF-C11F-47D7-9C04-65FB0051561B",
    "event_source_name": "",
    "event_id": 17,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T02:02:45.055790+00:00",
    "event_record_id": 42,
    "correlation": {},
    "execution": {
      "process_id": 5756,
      "thread_id": 8424
    },
    "channel": "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "ResolverFiredEvent": {
      "ExePath": "C:\\Program Files (x86)\\OpenOffice 4\\program\\soffice.exe",
      "ResolverName": "DetectorShim_KernelDriver"
    }
  },
  "message": ""
}

References #

Event ID 30: The Program Compatibility Assistant was invoked to correct a compatibility problem.

#
Channel
Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6

Fields #

NameDescription
ApplicationName UnicodeString
ApplicationVersion UnicodeString
ExecutablePath UnicodeString
ScenarioId UnicodeString
UserAction UnicodeString
CompatibilityLayer UnicodeString

Event ID 31: The Program Compatibility Assistant was invoked to correct a compatibility problem.

#
Channel
Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Message #

The Program Compatibility Assistant was invoked to correct a compatibility problem. Information about the application is below.

Application name: %1
Application version: %2
Executable path: %3
Scenario ID: %4
User action: %5
Compatibility layer: %6
Deprecated component: %7

Fields #

NameDescription
ApplicationName UnicodeString
ApplicationVersion UnicodeString
ExecutablePath UnicodeString
ScenarioId UnicodeString
UserAction UnicodeString
CompatibilityLayer UnicodeString
DeprecatedComponent UnicodeString

Event ID 32: The Program Compatibility Assistant was invoked due to an unsigned driver install.

#
Channel
Program-Compatibility-Assistant

Description

The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below. Driver: DriverName Service: ServiceName Publisher: PublisherName Location: DriverPath Version: DriverVersion This driver is unavailable and the program that uses this driver might not work correctly.

Message #

The Program Compatibility Assistant was invoked due to an unsigned driver install. This version of Windows requires all drivers to have a valid digital signature. Information about the driver is below.

Driver: %1
Service: %2
Publisher: %3
Location: %4
Version: %5

This driver is unavailable and the program that uses this driver might not work correctly.

Fields #

NameDescription
DriverName UnicodeString
ServiceName UnicodeString
PublisherName UnicodeString
DriverPath UnicodeString
DriverVersion UnicodeString

Event ID 101: PCA Service startup begin.

#
Channel
Operational
Task
PCA_ServiceStartup
Opcode
Start

Event ID 102: PCA Service startup finished.

#
Channel
Operational
Task
PCA_ServiceStartup
Opcode
Stop

Event ID 103: PCA Process Monitor begin.

#
Channel
Operational
Task
PCA_MonitorProcess
Opcode
Start

Event ID 104: PCA Process Monitor finished.

#
Channel
Operational
Task
PCA_MonitorProcess
Opcode
Stop

Event ID 105: PCA Service initialization begin.

#
Channel
Operational
Task
PCA_ServiceInitialize
Opcode
Start

Event ID 106: PCA Service initialization finished.

#
Channel
Operational
Task
PCA_ServiceInitialize
Opcode
Stop

Event ID 107: PCA Service initialization begin.

#
Channel
Operational
Task
PCA_ServiceShutdown
Opcode
Start

Event ID 108: PCA Service initialization finished.

#
Channel
Operational
Task
PCA_ServiceShutdown
Opcode
Stop

Event ID 200: The Program Compatibility Assistant service was stopped successfully.

#
Channel
Program-Compatibility-Assistant

Event ID 201: The Program Compatibility Assistant service started successfully.

#
Channel
Program-Compatibility-Assistant

Event ID 202: The Program Compatibility Assistant service failed to initialize.

#
Channel
Program-Compatibility-Assistant

Event ID 203: The Program Compatibility Assistant service failed to start.

#
Channel
Program-Compatibility-Assistant

Event ID 204: The Program Compatibility Assistant service failed to stop.

#
Channel
Program-Compatibility-Assistant

Event ID 205: The Program Compatibility Assistant service failed to perform the phase two initialization.

#
Channel
Program-Compatibility-Assistant

Event ID 206: The Program Compatibility Assistant service successfully performed phase two initialization.

#
Channel
Program-Compatibility-Assistant

Event ID 1100: Notified PCA service of status icon registration.

#
Channel
Analytic

Event ID 1200: PCA Trigger event:PCA_Trigger_event.

#
Channel
Analytic

Message #

PCA Trigger event:%1

Fields #

NameDescription
TriggerID
ExtraDataSize
ExtraData

Event ID 1200: PCA Trigger event:TriggerID.

#
Channel
CompatAfterUpgrade

Message #

PCA Trigger event:%1

Fields #

NameDescription
TriggerID UInt32
ExtraDataSize UInt32
ExtraData Binary

Event ID 1234: Exe: AppIdApplicationID.

#
Channel
CompatAfterUpgrade

Message #

Exe: AppId%1

Uptime %2

Fields #

NameDescription
ApplicationID UnicodeString
Uptime UInt32

Provenance

ETW provider GUID 4cb314df-c11f-47d7-9c04-65fb0051561b

Defined in pcaevts.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB