Microsoft-Windows-RemoteAccess-MgmtClient

231 events across 3 channels

Event	Title	Channel	Sample
100	Event ID 100	Operational	N
100	Started reverting the configuration.	Operational	N
101	Event ID 101	Operational	N
101	Finished reverting the configuration.	Operational	N
102	Event ID 102	Operational	N
102	Started exporting the VPN profile.	Operational	N
103	Event ID 103	Operational	N
103	Finished exporting the VPN profile.	Operational	N
104	Event ID 104	Operational	N
104	Started enabling VPN.	Operational	N
105	Event ID 105	Operational	N
105	Finished enabling VPN.	Operational	N
106	Event ID 106	Operational	N
106	Started disabling VPN.	Operational	N
107	Event ID 107	Operational	N
107	Finished disabling VPN.	Operational	N
108	Event ID 108	Operational	N
108	Started the Enable DirectAccess Wizard.	Operational	N
109	Event ID 109	Operational	N
109	Finished the Enable DirectAccess Wizard.	Operational	N
110	Event ID 110	Operational	N
110	Started generating report.	Operational	N
111	Event ID 111	Operational	N
111	Finished generating report.	Operational	N
112	Event ID 112	Operational	N
112	Started the Add Application Server Wizard.	Operational	N
113	Event ID 113	Operational	N
113	Finished the Add Application Server Wizard.	Operational	N
114	Event ID 114	Operational	N
114	Started configuring the refresh interval.	Operational	N
115	Event ID 115	Operational	N
115	Finished configuring the refresh interval.	Operational	N
116	Event ID 116	Operational	N
116	Started disconnecting VPN clients.	Operational	N
117	Event ID 117	Operational	N
117	Finished disconnecting VPN clients.	Operational	N
118	Event ID 118	Operational	N
118	Started loading the accounting configuration.	Operational	N
119	Event ID 119	Operational	N
119	Finished loading the accounting configuration.	Operational	N
120	Event ID 120	Operational	N
120	Started enabling VPN site-to-site.	Operational	N
121	Event ID 121	Operational	N
121	Finished enabling VPN site-to-site.	Operational	N
122	Event ID 122	Operational	N
122	Started disabling site-to-site VPN.	Operational	N
123	Event ID 123	Operational	N
123	Finished disabling site-to-site VPN.	Operational	N
124	Event ID 124	Operational	N
124	Started updating internal resources accessed by clients (Reporting page events).	Operational	N
125	Event ID 125	Operational	N
125	Finished updating internal resources accessed by clients (Reporting page …	Operational	N
200	Event ID 200	Operational	N
200	Started the Remote Access Server Setup Wizard.	Operational	N
201	Event ID 201	Operational	N
201	Finished the Remote Access Server Setup Wizard.	Operational	N
202	Event ID 202	Operational	N
202	Started the DirectAccess Client Setup Wizard.	Operational	N
203	Event ID 203	Operational	N
203	Finished the DirectAccess Client Setup Wizard.	Operational	N
204	Event ID 204	Operational	N
204	Started the Infrastructure Server Setup Wizard.	Operational	N
205	Event ID 205	Operational	N
205	Finished the Infrastructure Server Setup Wizard.	Operational	N
206	Event ID 206	Operational	N
206	Started automatic discovery of management servers.	Operational	N
207	Event ID 207	Operational	N
207	Finished automatic discovery of management servers.	Operational	N
208	One or more CA servers defined for OTP no longer exist: InvalidCAServers.	Operational	N
300	Event ID 300	Operational	N
300	Started loading remote client details.	Operational	N
301	Event ID 301	Operational	N
301	Finished loading remote client details	Operational	N
302	Event ID 302	Operational	N
302	Started refreshing monitoring data.	Operational	N
303	Event ID 303	Operational	N
303	Finished refreshing monitoring data.	Operational	N
304	Event ID 304	Operational	N
304	Started updating internal resources accessed by clients (Monitoring page …	Operational	N
305	Event ID 305	Operational	N
305	Finished updating internal resources accessed by clients (Monitoring page …	Operational	N
306	Event ID 306	Operational	N
306	Started loading the Operations Status page.	Operational	N
307	Event ID 307	Operational	N
307	Finished loading the Operations Status page.	Operational	N
308	Event ID 308	Operational	N
308	Started loading performance counters.	Operational	N
309	Event ID 309	Operational	N
309	Finished loading performance counters.	Operational	N
310	Event ID 310	Operational	N
310	Started loading reporting.	Operational	N
311	Event ID 311	Operational	N
311	Finished loading reporting.	Operational	N
401	Event ID 401	Operational	N
401	Started applying accounting configuration settings	Operational	N
402	Event ID 402	Operational	N
402	Finished applying accounting configuration settings.	Operational	N
403	Event ID 403	Operational	N
403	Started clearing the inbox accounting store.	Operational	N
404	Event ID 404	Operational	N
404	Finished clearing the inbox accounting store.	Operational	N
900	Started applying the configuration.	Operational	N
901	Finished applying the configuration successfully.	Operational	N
902	Applying the configuration failed.	Operational	N
903	Event ID 903	Operational	N
903	Started a change in the workspace.	Operational	N
904	Event ID 904	Operational	N
904	Finished a change in the workspace.	Operational	N
905	Event ID 905	Operational	N
905	Started the DirectAccess prerequisites check.	Operational	N
906	Event ID 906	Operational	N
906	Finished the DirectAccess prerequisites check successfully.	Operational	N
907	Event ID 907	Operational	N
907	Finished the DirectAccess prerequisites check.	Operational	N
10001	Prerequisite checks failed.	Operational	N
10002	Prerequisite checks succeeded with warnings.	Operational	N
10003	Prequisite checks succeeded.	Operational	N
10004	DirectAccess has been configured for DAInstallType using a Kerberos proxy.	Operational	N
10005	The IP address or name to which remote clients connect is ConnectToAddress.	Operational	N
10006	The network location server is located on NLSLocation.	Operational	N
10007	A NodeType GPO (GPOName) was created.	Operational	N
10008	The NodeType GPO GPOName was removed from the Remote Access deployment.	Operational	N
10009	SGType security group (SGList) was added to the Remote Access deployment.	Operational	N
10010	SGType security group (SGList) was removed from the Remote Access deployment.	Operational	N
10011	DAConfiguration has been enabled for Remote Access.	Operational	N
10012	DAConfiguration has been disabled for Remote Access.	Operational	N
10013	Client authentication method: AuthType.	Operational	N
10014	PrefixType prefix: Prefix.	Operational	N
10015	Management servers added to the Remote Access deployment.	Operational	N
10016	Management servers removed from the Remote Access deployment.	Operational	N
10017	An NRPT entry has been added.	Operational	N
10018	An NRPT entry has been removed.	Operational	N
10019	VPN has been installed.	Operational	N
10020	VPN authentication method: VPNAuthType.	Operational	N
10021	VPN IP address assignment type: Addressassignmenttype.	Operational	N
10022	A VPN static IP address pool was added.	Operational	N
10023	A VPN static IP address pool was removed.	Operational	N
10024	A RADIUS server for Purpose was added.	Operational	N
10025	A RADIUS server for Purpose was removed.	Operational	N
10026	RemoteAccessType has been uninstalled.	Operational	N
10027	A load balanced cluster deployment has been enabled.	Operational	N
10028	A load balanced cluster deployment has been disabled.	Operational	N
10029	Load balancing method: RALBType.	Operational	N
10030	RemoteAccessServerName has been added to the load balanced cluster.	Operational	N
10031	RemoteAccessServerName has been removed from the load balanced cluster.	Operational	N
10032	Application servers were added to security group SGName.	Operational	N
10033	Application servers were removed from security group SGName.	Operational	N
10034	Connection method for application servers: AppServerConnectionType.	Operational	N
10035	Accounting: RAActionType.	Operational	N
10036	Data from FromDate to EndDate was deleted from the accounting store.	Operational	N
10037	Data since FromDate was deleted from the accounting store.	Operational	N
10038	The accounting store was cleared.	Operational	N
10039	Accounting store size: StoreLimit.	Operational	N
10040	User UserNameIP was disconnected.	Operational	N
10041	GPO GroupPolicyobjectName cannot be GroupPolicyobjectAction.	Operational	N
10042	Registry settings cannot be configured for GPO GroupPolicyobjectName.	Operational	N
10043	IPsec rule IPsecRuleName cannot be created.	Operational	N
10044	Firewall rule FirewallRuleName cannot be created.	Operational	N
10045	Firewall rule FirewallRuleName cannot be updated.	Operational	N
10046	GPO GroupPolicyobjectNameorId cannot be loaded.	Operational	N
10047	Security filtering for GPO GroupPolicyobjectName cannot be modified.	Operational	N
10048	OTP authentication has been enabled.	Operational	N
10049	OTP authentication has been disabled.	Operational	N
10050	Server ComputerName has been enabled as the first entry point in the multisite …	Operational	N
10051	Server ComputerName cannot be enabled as the first entry point in the multisite …	Operational	N
10052	Server ComputerName has been removed as an entry point from the multisite …	Operational	N
10053	Server ComputerName cannot be removed as an entry point from the multisite …	Operational	N
10054	Manual entry point selection has been enabled in the multisite deployment.	Operational	N
10055	Manual entry point selection cannot be enabled in the multisite deployment.	Operational	N
10056	Manual entry point selection has been disabled in the multisite deployment.	Operational	N
10057	Manual entry point selection cannot be disabled in the multisite deployment.	Operational	N
10058	The global load balancing FQDN is set to GlobalLoadBalancingFQDN.	Operational	N
10059	The global load balancing FQDN cannot be set to GlobalLoadBalancingFQDN.	Operational	N
10062	The multisite deployment name is EnterpriseName.	Operational	N
10063	The multisite deployment name cannot be set to EnterpriseName.	Operational	N
10064	Domain controller DomainControllerName has been associated with entry point …	Operational	N
10065	Domain controller DomainControllerName cannot be associated with entry point …	Operational	N
10066	Entry point EntrypointName has been added to the multisite deployment.	Operational	N
10067	Entry point EntrypointName cannot be added to the multisite deployment.	Operational	N
10068	The global load balancing IP address of entry point EntrypointName is set to …	Operational	N
10069	The global load balancing IP address of entry point EntrypointName cannot be set …	Operational	N
10070	Entry point EntrypointName has been removed from the multisite deployment.	Operational	N
10071	Entry point EntrypointName cannot be removed from the multisite deployment.	Operational	N
10072	The deployment mode has been changed to DAInstallType.	Operational	N
10073	The root certificate for IPsec has been changed to RootCert.	Operational	N
10074	The name of entry point CurrentEntryPointName has been changed to …	Operational	N
10075	The name of entry point CurrentEntryPointName cannot be changed to …	Operational	N
20001	BGP router added.	Config	N
20001	Event ID 20001	Operational	N
20002	BGP router added for routing domain Arg1.	Config	N
20002	Event ID 20002	Operational	N
20003	BGP router removed.	Config	N
20003	Event ID 20003	Operational	N
20004	BGP router removed for routing domain Arg1.	Config	N
20004	Event ID 20004	Operational	N
20005	Configuration changed for BGP router.	Config	N
20005	Event ID 20005	Operational	N
20006	Configuration changed for BGP router of routing domain Arg1.	Config	N
20006	Event ID 20006	Operational	N
20007	BGP peer Arg1 added.	Config	N
20007	Event ID 20007	Operational	N
20008	BGP peer Arg1 added for routing domain Arg2.	Config	N
20008	Event ID 20008	Operational	N
20009	BGP peer Arg1 removed.	Config	N
20009	Event ID 20009	Operational	N
20010	BGP peer Arg1 removed for routing domain Arg2.	Config	N
20010	Event ID 20010	Operational	N
20011	Configuration changed for BGP peer Arg1.	Config	N
20011	Event ID 20011	Operational	N
20012	Configuration changed for BGP peer Arg1 of routing domain Arg2.	Config	N
20012	Event ID 20012	Operational	N
20013	Operation mode changed from Arg1 to Arg2 for peer Arg3.	Config	N
20013	Event ID 20013	Operational	N
20014	Operation mode changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.	Config	N
20014	Event ID 20014	Operational	N
20015	Peering type changed from Arg1 to Arg2 for peer Arg3.	Config	N
20015	Event ID 20015	Operational	N
20016	Peering type changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.	Config	N
20016	Event ID 20016	Operational	N
20017	BGP route flap dampening enabled.	Config	N
20017	Event ID 20017	Operational	N
20018	BGP route flap dampening enabled for routing domain Arg1.	Config	N
20018	Event ID 20018	Operational	N
20019	BGP route flap dampening configuration changed.	Config	N
20019	Event ID 20019	Operational	N
20020	BGP route flap dampening configuration changed for routing domain Arg1.	Config	N
20020	Event ID 20020	Operational	N
20021	BGP route flap dampening disabled.	Config	N
20021	Event ID 20021	Operational	N
20022	BGP route flap dampening disabled for routing domain Arg1.	Config	N
20022	Event ID 20022	Operational	N

Event ID 100

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started reverting the configuration.

Event ID 100: Started reverting the configuration.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started reverting the configuration.

Message #

Started reverting the configuration.

Event ID 101

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished reverting the configuration.

Fields #

Name	Description
`result` Boolean

Event ID 101: Finished reverting the configuration.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished reverting the configuration.

Message #

Finished reverting the configuration.

Fields #

Name	Description
`result` Boolean

Event ID 102

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started exporting the VPN profile.

Event ID 102: Started exporting the VPN profile.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started exporting the VPN profile.

Message #

Started exporting the VPN profile.

Event ID 103

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished exporting the VPN profile.

Fields #

Name	Description
`result` Boolean

Event ID 103: Finished exporting the VPN profile.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished exporting the VPN profile.

Message #

Finished exporting the VPN profile.

Fields #

Name	Description
`result` Boolean

Event ID 104

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started enabling VPN.

Event ID 104: Started enabling VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started enabling VPN.

Message #

Started enabling VPN.

Event ID 105

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished enabling VPN.

Fields #

Name	Description
`result` Boolean

Event ID 105: Finished enabling VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished enabling VPN.

Message #

Finished enabling VPN.

Fields #

Name	Description
`result` Boolean

Event ID 106

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disabling VPN.

Event ID 106: Started disabling VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disabling VPN.

Message #

Started disabling VPN.

Event ID 107

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disabling VPN.

Fields #

Name	Description
`result` Boolean

Event ID 107: Finished disabling VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disabling VPN.

Message #

Finished disabling VPN.

Fields #

Name	Description
`result` Boolean

Event ID 108

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started the Enable DirectAccess Wizard.

Event ID 108: Started the Enable DirectAccess Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started the Enable DirectAccess Wizard.

Message #

Started the Enable DirectAccess Wizard.

Event ID 109

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished the Enable DirectAccess Wizard.

Fields #

Name	Description
`result` Boolean

Event ID 109: Finished the Enable DirectAccess Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished the Enable DirectAccess Wizard.

Message #

Finished the Enable DirectAccess Wizard.

Fields #

Name	Description
`result` Boolean

Event ID 110

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started generating report.

Event ID 110: Started generating report.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started generating report.

Message #

Started generating report.

Event ID 111

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished generating report.

Event ID 111: Finished generating report.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished generating report.

Message #

Finished generating report.

Event ID 112

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started the Add Application Server Wizard.

Event ID 112: Started the Add Application Server Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started the Add Application Server Wizard.

Message #

Started the Add Application Server Wizard.

Event ID 113

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished the Add Application Server Wizard.

Fields #

Name	Description
`result` Boolean

Event ID 113: Finished the Add Application Server Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished the Add Application Server Wizard.

Message #

Finished the Add Application Server Wizard.

Fields #

Name	Description
`result` Boolean

Event ID 114

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started configuring the refresh interval.

Event ID 114: Started configuring the refresh interval.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started configuring the refresh interval.

Message #

Started configuring the refresh interval.

Event ID 115

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished configuring the refresh interval.

Event ID 115: Finished configuring the refresh interval.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished configuring the refresh interval.

Message #

Finished configuring the refresh interval.

Event ID 116

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disconnecting VPN clients.

Event ID 116: Started disconnecting VPN clients.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disconnecting VPN clients.

Message #

Started disconnecting VPN clients.

Event ID 117

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disconnecting VPN clients.

Event ID 117: Finished disconnecting VPN clients.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disconnecting VPN clients.

Message #

Finished disconnecting VPN clients.

Event ID 118

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started loading the accounting configuration.

Event ID 118: Started loading the accounting configuration.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started loading the accounting configuration.

Message #

Started loading the accounting configuration.

Event ID 119

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished loading the accounting configuration.

Event ID 119: Finished loading the accounting configuration.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished loading the accounting configuration.

Message #

Finished loading the accounting configuration.

Event ID 120

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started enabling VPN site-to-site.

Event ID 120: Started enabling VPN site-to-site.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started enabling VPN site-to-site.

Message #

Started enabling VPN site-to-site.

Event ID 121

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished enabling VPN site-to-site.

Fields #

Name	Description
`result` Boolean

Event ID 121: Finished enabling VPN site-to-site.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished enabling VPN site-to-site.

Message #

Finished enabling VPN site-to-site.

Fields #

Name	Description
`result` Boolean

Event ID 122

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disabling site-to-site VPN.

Event ID 122: Started disabling site-to-site VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started disabling site-to-site VPN.

Message #

Started disabling site-to-site VPN.

Event ID 123

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disabling site-to-site VPN.

Fields #

Name	Description
`result` Boolean

Event ID 123: Finished disabling site-to-site VPN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished disabling site-to-site VPN.

Message #

Finished disabling site-to-site VPN.

Fields #

Name	Description
`result` Boolean

Event ID 124

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started updating internal resources accessed by clients (Reporting page events).

Event ID 124: Started updating internal resources accessed by clients (Reporting page events).

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started updating internal resources accessed by clients (Reporting page events).

Message #

Started updating internal resources accessed by clients (Reporting page events).

Event ID 125

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished updating internal resources accessed by clients (Reporting page events).

Event ID 125: Finished updating internal resources accessed by clients (Reporting page events).

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished updating internal resources accessed by clients (Reporting page events).

Message #

Finished updating internal resources accessed by clients (Reporting page events).

Event ID 200

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the Remote Access Server Setup Wizard.

Event ID 200: Started the Remote Access Server Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the Remote Access Server Setup Wizard.

Message #

Started the Remote Access Server Setup Wizard.

Event ID 201

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the Remote Access Server Setup Wizard.

Event ID 201: Finished the Remote Access Server Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the Remote Access Server Setup Wizard.

Message #

Finished the Remote Access Server Setup Wizard.

Event ID 202

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the DirectAccess Client Setup Wizard.

Event ID 202: Started the DirectAccess Client Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the DirectAccess Client Setup Wizard.

Message #

Started the DirectAccess Client Setup Wizard.

Event ID 203

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the DirectAccess Client Setup Wizard.

Event ID 203: Finished the DirectAccess Client Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the DirectAccess Client Setup Wizard.

Message #

Finished the DirectAccess Client Setup Wizard.

Event ID 204

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the Infrastructure Server Setup Wizard.

Event ID 204: Started the Infrastructure Server Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started the Infrastructure Server Setup Wizard.

Message #

Started the Infrastructure Server Setup Wizard.

Event ID 205

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the Infrastructure Server Setup Wizard.

Event ID 205: Finished the Infrastructure Server Setup Wizard.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished the Infrastructure Server Setup Wizard.

Message #

Finished the Infrastructure Server Setup Wizard.

Event ID 206

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started automatic discovery of management servers.

Event ID 206: Started automatic discovery of management servers.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Start

Description

Started automatic discovery of management servers.

Message #

Started automatic discovery of management servers.

Event ID 207

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished automatic discovery of management servers.

Fields #

Name	Description
`Result` Boolean

Event ID 207: Finished automatic discovery of management servers.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleConfigurationTask
Opcode: Stop

Description

Finished automatic discovery of management servers.

Message #

Finished automatic discovery of management servers.

Fields #

Name	Description
`Result` Boolean

Event ID 208: One or more CA servers defined for OTP no longer exist: InvalidCAServers.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

One or more CA servers defined for OTP no longer exist: InvalidCAServers.

Message #

One or more CA servers defined for OTP no longer exist: %1.

Fields #

Name	Description
`InvalidCAServers` UnicodeString

Event ID 300

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading remote client details.

Event ID 300: Started loading remote client details.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading remote client details.

Message #

Started loading remote client details.

Event ID 301

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading remote client details.

Event ID 301: Finished loading remote client details

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading remote client details.

Message #

Finished loading remote client details

Event ID 302

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started refreshing monitoring data.

Event ID 302: Started refreshing monitoring data.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started refreshing monitoring data.

Message #

Started refreshing monitoring data.

Event ID 303

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished refreshing monitoring data.

Event ID 303: Finished refreshing monitoring data.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished refreshing monitoring data.

Message #

Finished refreshing monitoring data.

Event ID 304

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started updating internal resources accessed by clients (Monitoring page events).

Event ID 304: Started updating internal resources accessed by clients (Monitoring page events).

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started updating internal resources accessed by clients (Monitoring page events).

Message #

Started updating internal resources accessed by clients (Monitoring page events).

Event ID 305

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished updating internal resources accessed by clients (Monitoring page events).

Event ID 305: Finished updating internal resources accessed by clients (Monitoring page events).

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished updating internal resources accessed by clients (Monitoring page events).

Message #

Finished updating internal resources accessed by clients (Monitoring page events).

Event ID 306

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading the Operations Status page.

Event ID 306: Started loading the Operations Status page.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading the Operations Status page.

Message #

Started loading the Operations Status page.

Event ID 307

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading the Operations Status page.

Event ID 307: Finished loading the Operations Status page.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading the Operations Status page.

Message #

Finished loading the Operations Status page.

Event ID 308

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading performance counters.

Event ID 308: Started loading performance counters.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading performance counters.

Message #

Started loading performance counters.

Event ID 309

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading performance counters.

Event ID 309: Finished loading performance counters.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading performance counters.

Message #

Finished loading performance counters.

Event ID 310

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading reporting.

Event ID 310: Started loading reporting.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Start

Description

Started loading reporting.

Message #

Started loading reporting.

Event ID 311

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading reporting.

Event ID 311: Finished loading reporting.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleMonitoringTask
Opcode: Stop

Description

Finished loading reporting.

Message #

Finished loading reporting.

Event ID 401

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started applying accounting configuration settings.

Event ID 401: Started applying accounting configuration settings

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started applying accounting configuration settings.

Message #

Started applying accounting configuration settings

Event ID 402

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished applying accounting configuration settings.

Event ID 402: Finished applying accounting configuration settings.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished applying accounting configuration settings.

Message #

Finished applying accounting configuration settings.

Event ID 403

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started clearing the inbox accounting store.

Event ID 403: Started clearing the inbox accounting store.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Start

Description

Started clearing the inbox accounting store.

Message #

Started clearing the inbox accounting store.

Event ID 404

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished clearing the inbox accounting store.

Event ID 404: Finished clearing the inbox accounting store.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: RemoteAccessConsoleActionTask
Opcode: Stop

Description

Finished clearing the inbox accounting store.

Message #

Finished clearing the inbox accounting store.

Event ID 900: Started applying the configuration.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Start

Description

Started applying the configuration.

Message #

Started applying the configuration.

Event ID 901: Finished applying the configuration successfully.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished applying the configuration successfully.

Message #

Finished applying the configuration successfully.

Event ID 902: Applying the configuration failed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Applying the configuration failed.

Message #

Applying the configuration failed.

Event ID 903

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Start

Description

Started a change in the workspace.

Fields #

Name	Description
`OldWorkspace` UnicodeString
`NewWorkspace` UnicodeString

Event ID 903: Started a change in the workspace.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Start

Description

Started a change in the workspace.

Message #

Started a change in the workspace.

Fields #

Name	Description
`OldWorkspace` UnicodeString
`NewWorkspace` UnicodeString

Event ID 904

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished a change in the workspace.

Fields #

Name	Description
`OldWorkspace` UnicodeString
`NewWorkspace` UnicodeString

Event ID 904: Finished a change in the workspace.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished a change in the workspace.

Message #

Finished a change in the workspace.

Fields #

Name	Description
`OldWorkspace` UnicodeString
`NewWorkspace` UnicodeString

Event ID 905

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Start

Description

Started the DirectAccess prerequisites check.

Event ID 905: Started the DirectAccess prerequisites check.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Start

Description

Started the DirectAccess prerequisites check.

Message #

Started the DirectAccess prerequisites check.

Event ID 906

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished the DirectAccess prerequisites check successfully.

Event ID 906: Finished the DirectAccess prerequisites check successfully.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished the DirectAccess prerequisites check successfully.

Message #

Finished the DirectAccess prerequisites check successfully.

Event ID 907

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished the DirectAccess prerequisites check. Some or all prerequisites failed.

Event ID 907: Finished the DirectAccess prerequisites check.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Opcode: Stop

Description

Finished the DirectAccess prerequisites check. Some or all prerequisites failed.

Message #

Finished the DirectAccess prerequisites check. Some or all prerequisites failed.

Event ID 10001: Prerequisite checks failed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Prerequisite checks failed. Details.

Message #

Prerequisite checks failed. Details: 
%1.

Fields #

Name	Description
`FailureList` UnicodeString
`ServerName` UnicodeString

Event ID 10002: Prerequisite checks succeeded with warnings.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Prerequisite checks succeeded with warnings.

Message #

Prerequisite checks succeeded with warnings: 
%1.

Fields #

Name	Description
`WarningList` UnicodeString
`ServerName` UnicodeString

Event ID 10003: Prequisite checks succeeded.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Prequisite checks succeeded.

Message #

Prequisite checks succeeded.

Fields #

Name	Description
`ServerName` UnicodeString

Event ID 10004: DirectAccess has been configured for DAInstallType using a Kerberos proxy.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Message #

DirectAccess has been configured for %1 using a Kerberos proxy. Internal adapter: %2. External adapter: %3. The client GPO will be applied to mobile computers in the current domain. The server has been deployed %4.

Fields #

Name	Description
`DAInstallType` UInt32
`InternalInterface` UnicodeString
`InternetInterface` UnicodeString
`Topology` UInt32
`ServerName` UnicodeString

Event ID 10005: The IP address or name to which remote clients connect is ConnectToAddress.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The IP address or name to which remote clients connect is ConnectToAddress.

Message #

The IP address or name to which remote clients connect is %1.

Fields #

Name	Description
`ConnectToAddress` UnicodeString
`ServerName` UnicodeString

Event ID 10006: The network location server is located on NLSLocation.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The network location server is located on NLSLocation.

Message #

The network location server is located on %1.

Fields #

Name	Description
`NLSLocation` UInt32
`NLSCertificateName` UnicodeString
`NLSurl` UnicodeString
`ServerName` UnicodeString

Event ID 10007: A NodeType GPO (GPOName) was created.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A NodeType GPO (GPOName) was created.

Message #

A %1 GPO (%2) was created.

Fields #

Name	Description
`NodeType` UInt32
`GPOName` UnicodeString

Event ID 10008: The NodeType GPO GPOName was removed from the Remote Access deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The NodeType GPO GPOName was removed from the Remote Access deployment.

Message #

The %1 GPO %2 was removed from the Remote Access deployment.

Fields #

Name	Description
`NodeType` UInt32
`GPOName` UnicodeString

Event ID 10009: SGType security group (SGList) was added to the Remote Access deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

SGType security group (SGList) was added to the Remote Access deployment.

Message #

%1 security group (%2) was added to the Remote Access deployment.

Fields #

Name	Description
`SGType` UInt32
`SGList` UnicodeString
`ServerName` UnicodeString

Event ID 10010: SGType security group (SGList) was removed from the Remote Access deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

SGType security group (SGList) was removed from the Remote Access deployment.

Message #

%1 security group (%2) was removed from the Remote Access deployment.

Fields #

Name	Description
`SGType` UInt32
`SGList` UnicodeString
`ServerName` UnicodeString

Event ID 10011: DAConfiguration has been enabled for Remote Access.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

DAConfiguration has been enabled for Remote Access.

Message #

%1 has been enabled for Remote Access.

Fields #

Name	Description
`DAConfiguration` UInt32
`ServerName` UnicodeString

Event ID 10012: DAConfiguration has been disabled for Remote Access.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

DAConfiguration has been disabled for Remote Access.

Message #

%1 has been disabled for Remote Access.

Fields #

Name	Description
`DAConfiguration` UInt32
`ServerName` UnicodeString

Event ID 10013: Client authentication method: AuthType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Client authentication method: AuthType.

Message #

Client authentication method: %1.

Fields #

Name	Description
`AuthType` UInt32
`RootCert` UnicodeString
`Intermediatecertused` Boolean
`ServerName` UnicodeString

Event ID 10014: PrefixType prefix: Prefix.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Message #

%1 prefix: %2.

Fields #

Name	Description
`PrefixType` UInt32
`Prefix` UnicodeString
`ServerName` UnicodeString

Event ID 10015: Management servers added to the Remote Access deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Management servers added to the Remote Access deployment.

Message #

Management servers added to the Remote Access deployment: 
%1.

Fields #

Name	Description
`Mgmtserverlist` UnicodeString
`ServerName` UnicodeString

Event ID 10016: Management servers removed from the Remote Access deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Management servers removed from the Remote Access deployment.

Message #

Management servers removed from the Remote Access deployment: 
%1.

Fields #

Name	Description
`Mgmtserverlist` UnicodeString
`ServerName` UnicodeString

Event ID 10017: An NRPT entry has been added.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

An NRPT entry has been added.

Message #

An NRPT entry has been added.

Fields #

Name	Description
`DnsSuffix` UnicodeString
`DnsAddresses` UnicodeString
`Webproxyserver` UnicodeString
`ServerName` UnicodeString

Event ID 10018: An NRPT entry has been removed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

An NRPT entry has been removed.

Message #

An NRPT entry has been removed.

Fields #

Name	Description
`DnsSuffix` UnicodeString
`DnsAddresses` UnicodeString
`Webproxyserver` UnicodeString
`ServerName` UnicodeString

Event ID 10019: VPN has been installed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

VPN has been installed.

Message #

VPN has been installed.

Fields #

Name	Description
`MsgAuth` UnicodeString
`ServerName` UnicodeString

Event ID 10020: VPN authentication method: VPNAuthType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

VPN authentication method: VPNAuthType.

Message #

VPN authentication method: %1.

Fields #

Name	Description
`VPNAuthType` UInt32
`ServerName` UnicodeString

Event ID 10021: VPN IP address assignment type: Addressassignmenttype.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

VPN IP address assignment type: Addressassignmenttype.

Message #

VPN IP address assignment type: %1.

Fields #

Name	Description
`Addressassignmenttype` UInt32
`ServerName` UnicodeString

Event ID 10022: A VPN static IP address pool was added.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A VPN static IP address pool was added.

Message #

A VPN static IP address pool was added.

Fields #

Name	Description
`StartAddress` UnicodeString
`EndAddress` UnicodeString
`ServerName` UnicodeString

Event ID 10023: A VPN static IP address pool was removed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A VPN static IP address pool was removed.

Message #

A VPN static IP address pool was removed.

Fields #

Name	Description
`StartAddress` UnicodeString
`EndAddress` UnicodeString
`ServerName` UnicodeString

Event ID 10024: A RADIUS server for Purpose was added.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A RADIUS server for Purpose was added.

Message #

A RADIUS server for %1 was added.

Fields #

Name	Description
`Purpose` UInt32
`RadiusPort` UInt32
`RadiusScore` UInt32
`Radiusserveraddress` UnicodeString
`Radiustimeout` UInt32
`ServerName` UnicodeString

Event ID 10025: A RADIUS server for Purpose was removed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A RADIUS server for Purpose was removed.

Message #

A RADIUS server for %1 was removed.

Fields #

Name	Description
`Purpose` UInt32
`RadiusPort` UInt32
`RadiusScore` UInt32
`Radiusserveraddress` UnicodeString
`Radiustimeout` UInt32
`ServerName` UnicodeString

Event ID 10026: RemoteAccessType has been uninstalled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

RemoteAccessType has been uninstalled.

Message #

%1 has been uninstalled.

Fields #

Name	Description
`RemoteAccessType` UInt32
`ServerName` UnicodeString

Event ID 10027: A load balanced cluster deployment has been enabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A load balanced cluster deployment has been enabled.

Message #

A load balanced cluster deployment has been enabled.

Fields #

Name	Description
`InternalVIPs` UnicodeString
`InternalDIPs` UnicodeString
`InternetVIPs` UnicodeString
`InternetDIPs` UnicodeString
`ServerName` UnicodeString

Event ID 10028: A load balanced cluster deployment has been disabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

A load balanced cluster deployment has been disabled.

Message #

A load balanced cluster deployment has been disabled.

Fields #

Name	Description
`ServerName` UnicodeString

Event ID 10029: Load balancing method: RALBType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Load balancing method: RALBType.

Message #

Load balancing method: %1.

Fields #

Name	Description
`RALBType` UInt32
`ServerName` UnicodeString

Event ID 10030: RemoteAccessServerName has been added to the load balanced cluster.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

RemoteAccessServerName has been added to the load balanced cluster.

Message #

%1 has been added to the load balanced cluster.

Fields #

Name	Description
`RemoteAccessServerName` UnicodeString
`InternalVIPs` UnicodeString
`InternalDIPs` UnicodeString
`InternetVIPs` UnicodeString
`InternetDIPs` UnicodeString
`VPNStartAddress` UnicodeString
`VPNEndAddress` UnicodeString
`ServerName` UnicodeString

Event ID 10031: RemoteAccessServerName has been removed from the load balanced cluster.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

RemoteAccessServerName has been removed from the load balanced cluster.

Message #

%1 has been removed from the load balanced cluster.

Fields #

Name	Description
`RemoteAccessServerName` UnicodeString
`ServerName` UnicodeString

Event ID 10032: Application servers were added to security group SGName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Application servers were added to security group SGName.

Message #

Application servers were added to security group %2.

Fields #

Name	Description
`ServerList` UnicodeString
`SGName` UnicodeString
`ServerName` UnicodeString

Event ID 10033: Application servers were removed from security group SGName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Application servers were removed from security group SGName.

Message #

Application servers were removed from security group %2.

Fields #

Name	Description
`ServerList` UnicodeString
`SGName` UnicodeString
`ServerName` UnicodeString

Event ID 10034: Connection method for application servers: AppServerConnectionType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Connection method for application servers: AppServerConnectionType.

Message #

Connection method for application servers: %1.

Fields #

Name	Description
`AppServerConnectionType` UInt32
`IPsectrafficprotection` Boolean
`ServerName` UnicodeString

Event ID 10035: Accounting: RAActionType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Accounting: RAActionType. Accounting store: RAAcctType.

Message #

Accounting: %1. Accounting store: %2.

Fields #

Name	Description
`RAActionType` UInt32
`RAAcctType` UInt32
`ServerName` UnicodeString

Event ID 10036: Data from FromDate to EndDate was deleted from the accounting store.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Data from FromDate to EndDate was deleted from the accounting store.

Message #

Data from %1 to %2 was deleted from the accounting store.

Fields #

Name	Description
`FromDate` UnicodeString
`EndDate` UnicodeString
`ServerName` UnicodeString

Event ID 10037: Data since FromDate was deleted from the accounting store.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Data since FromDate was deleted from the accounting store.

Message #

Data since %1 was deleted from the accounting store.

Fields #

Name	Description
`FromDate` UnicodeString
`EndDate` UnicodeString
`ServerName` UnicodeString

Event ID 10038: The accounting store was cleared.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The accounting store was cleared.

Message #

The accounting store was cleared.

Fields #

Name	Description
`ServerName` UnicodeString

Event ID 10039: Accounting store size: StoreLimit.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Accounting store size: StoreLimit.

Message #

Accounting store size: %1.

Fields #

Name	Description
`StoreLimit` UnicodeString
`ServerName` UnicodeString

Event ID 10040: User UserNameIP was disconnected.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

User UserNameIP was disconnected.

Message #

User %1 was disconnected.

Fields #

Name	Description
`UserNameIP` UnicodeString
`ServerName` UnicodeString

Event ID 10041: GPO GroupPolicyobjectName cannot be GroupPolicyobjectAction.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

GPO GroupPolicyobjectName cannot be GroupPolicyobjectAction. The user does not have the required permissions.

Message #

GPO %2 cannot be %1. The user does not have the required permissions.

Fields #

Name	Description
`GroupPolicyobjectAction` UInt32
`GroupPolicyobjectName` UnicodeString
`DomainName` UnicodeString

Event ID 10042: Registry settings cannot be configured for GPO GroupPolicyobjectName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Registry settings cannot be configured for GPO GroupPolicyobjectName.

Message #

Registry settings cannot be configured for GPO %3.

Fields #

Name	Description
`KeyPath` UnicodeString
`ValueName` UnicodeString
`GroupPolicyobjectName` UnicodeString
`Errorcode` HexInt32

Event ID 10043: IPsec rule IPsecRuleName cannot be created.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

IPsec rule IPsecRuleName cannot be created.

Message #

IPsec rule %1 cannot be created.

Fields #

Name	Description
`IPsecRuleName` UnicodeString
`Errorcode` HexInt32

Event ID 10044: Firewall rule FirewallRuleName cannot be created.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Firewall rule FirewallRuleName cannot be created.

Message #

Firewall rule %1 cannot be created.

Fields #

Name	Description
`FirewallRuleName` UnicodeString
`Errorcode` HexInt32

Event ID 10045: Firewall rule FirewallRuleName cannot be updated.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Firewall rule FirewallRuleName cannot be updated.

Message #

Firewall rule %1 cannot be updated.

Fields #

Name	Description
`FirewallRuleName` UnicodeString
`Errorcode` HexInt32

Event ID 10046: GPO GroupPolicyobjectNameorId cannot be loaded.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

GPO GroupPolicyobjectNameorId cannot be loaded.

Message #

GPO %1 cannot be loaded.

Fields #

Name	Description
`GroupPolicyobjectNameorId` UnicodeString

Event ID 10047: Security filtering for GPO GroupPolicyobjectName cannot be modified.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Security filtering for GPO GroupPolicyobjectName cannot be modified.

Message #

Security filtering for GPO %1 cannot be modified.

Fields #

Name	Description
`GroupPolicyobjectName` UnicodeString
`Errorcode` HexInt32

Event ID 10048: OTP authentication has been enabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

OTP authentication has been enabled.

Message #

OTP authentication has been enabled.

Event ID 10049: OTP authentication has been disabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

OTP authentication has been disabled.

Message #

OTP authentication has been disabled.

Event ID 10050: Server ComputerName has been enabled as the first entry point in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Server ComputerName has been enabled as the first entry point in the multisite deployment.

Message #

Server %1 has been enabled as the first entry point in the multisite deployment.

Fields #

Name	Description
`ComputerName` UnicodeString

Event ID 10051: Server ComputerName cannot be enabled as the first entry point in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Server ComputerName cannot be enabled as the first entry point in the multisite deployment.

Message #

Server %1 cannot be enabled as the first entry point in the multisite deployment.

Fields #

Name	Description
`ComputerName` UnicodeString

Event ID 10052: Server ComputerName has been removed as an entry point from the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Server ComputerName has been removed as an entry point from the multisite deployment.

Message #

Server %1 has been removed as an entry point from the multisite deployment.

Fields #

Name	Description
`ComputerName` UnicodeString

Event ID 10053: Server ComputerName cannot be removed as an entry point from the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Server ComputerName cannot be removed as an entry point from the multisite deployment.

Message #

Server %1 cannot be removed as an entry point from the multisite deployment.

Fields #

Name	Description
`ComputerName` UnicodeString

Event ID 10054: Manual entry point selection has been enabled in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Manual entry point selection has been enabled in the multisite deployment.

Message #

Manual entry point selection has been enabled in the multisite deployment.

Event ID 10055: Manual entry point selection cannot be enabled in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Manual entry point selection cannot be enabled in the multisite deployment.

Message #

Manual entry point selection cannot be enabled in the multisite deployment.

Event ID 10056: Manual entry point selection has been disabled in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Manual entry point selection has been disabled in the multisite deployment.

Message #

Manual entry point selection has been disabled in the multisite deployment.

Event ID 10057: Manual entry point selection cannot be disabled in the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Manual entry point selection cannot be disabled in the multisite deployment.

Message #

Manual entry point selection cannot be disabled in the multisite deployment.

Event ID 10058: The global load balancing FQDN is set to GlobalLoadBalancingFQDN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The global load balancing FQDN is set to GlobalLoadBalancingFQDN.

Message #

The global load balancing FQDN is set to %1.

Fields #

Name	Description
`GlobalLoadBalancingFQDN` UnicodeString

Event ID 10059: The global load balancing FQDN cannot be set to GlobalLoadBalancingFQDN.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The global load balancing FQDN cannot be set to GlobalLoadBalancingFQDN.

Message #

The global load balancing FQDN cannot be set to %1.

Fields #

Name	Description
`GlobalLoadBalancingFQDN` UnicodeString

Event ID 10062: The multisite deployment name is EnterpriseName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The multisite deployment name is EnterpriseName.

Message #

The multisite deployment name is %1.

Fields #

Name	Description
`EnterpriseName` UnicodeString

Event ID 10063: The multisite deployment name cannot be set to EnterpriseName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The multisite deployment name cannot be set to EnterpriseName.

Message #

The multisite deployment name cannot be set to %1.

Fields #

Name	Description
`EnterpriseName` UnicodeString

Event ID 10064: Domain controller DomainControllerName has been associated with entry point EntryPointName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Domain controller DomainControllerName has been associated with entry point EntryPointName.

Message #

Domain controller %1 has been associated with entry point %2.

Fields #

Name	Description
`DomainControllerName` UnicodeString
`EntryPointName` UnicodeString

Event ID 10065: Domain controller DomainControllerName cannot be associated with entry point EntryPointName.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Domain controller DomainControllerName cannot be associated with entry point EntryPointName.

Message #

Domain controller %1 cannot be associated with entry point %2.

Fields #

Name	Description
`DomainControllerName` UnicodeString
`EntryPointName` UnicodeString

Event ID 10066: Entry point EntrypointName has been added to the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Entry point EntrypointName has been added to the multisite deployment.

Message #

Entry point %1 has been added to the multisite deployment.

Fields #

Name	Description
`EntrypointName` UnicodeString

Event ID 10067: Entry point EntrypointName cannot be added to the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Entry point EntrypointName cannot be added to the multisite deployment.

Message #

Entry point %1 cannot be added to the multisite deployment.

Fields #

Name	Description
`EntrypointName` UnicodeString

Event ID 10068: The global load balancing IP address of entry point EntrypointName is set to GloballoadbalancingIPaddress.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The global load balancing IP address of entry point EntrypointName is set to GloballoadbalancingIPaddress.

Message #

The global load balancing IP address of entry point %1 is set to %2.

Fields #

Name	Description
`EntrypointName` UnicodeString
`GloballoadbalancingIPaddress` UnicodeString

Event ID 10069: The global load balancing IP address of entry point EntrypointName cannot be set to GloballoadbalancingIPaddress.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The global load balancing IP address of entry point EntrypointName cannot be set to GloballoadbalancingIPaddress.

Message #

The global load balancing IP address of entry point %1 cannot be set to %2.

Fields #

Name	Description
`EntrypointName` UnicodeString
`GloballoadbalancingIPaddress` UnicodeString

Event ID 10070: Entry point EntrypointName has been removed from the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Entry point EntrypointName has been removed from the multisite deployment.

Message #

Entry point %1 has been removed from the multisite deployment.

Fields #

Name	Description
`EntrypointName` UnicodeString

Event ID 10071: Entry point EntrypointName cannot be removed from the multisite deployment.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

Entry point EntrypointName cannot be removed from the multisite deployment.

Message #

Entry point %1 cannot be removed from the multisite deployment.

Fields #

Name	Description
`EntrypointName` UnicodeString

Event ID 10072: The deployment mode has been changed to DAInstallType.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The deployment mode has been changed to DAInstallType.

Message #

The deployment mode has been changed to %1.

Fields #

Name	Description
`DAInstallType` UInt32
`ServerName` UnicodeString

Event ID 10073: The root certificate for IPsec has been changed to RootCert.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The root certificate for IPsec has been changed to RootCert.

Message #

The root certificate for IPsec has been changed to %1.

Fields #

Name	Description
`RootCert` UnicodeString
`Intermediatecertused` Boolean
`ServerName` UnicodeString

Event ID 10074: The name of entry point CurrentEntryPointName has been changed to NewEntryPointname.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The name of entry point CurrentEntryPointName has been changed to NewEntryPointname.

Message #

The name of entry point %1 has been changed to %2.

Fields #

Name	Description
`CurrentEntryPointName` UnicodeString
`NewEntryPointname` UnicodeString

Event ID 10075: The name of entry point CurrentEntryPointName cannot be changed to NewEntryPointname.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational

Description

The name of entry point CurrentEntryPointName cannot be changed to NewEntryPointname.

Message #

The name of entry point %1 cannot be changed to %2.

Fields #

Name	Description
`CurrentEntryPointName` UnicodeString
`NewEntryPointname` UnicodeString

Event ID 20001: BGP router added.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router added.

Message #

BGP router added.

Event ID 20001

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router added.

Event ID 20002: BGP router added for routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router added for routing domain Arg1.

Message #

BGP router added for routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20002

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router added for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20003: BGP router removed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router removed.

Message #

BGP router removed.

Event ID 20003

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router removed.

Event ID 20004: BGP router removed for routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router removed for routing domain Arg1.

Message #

BGP router removed for routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20004

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP router removed for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20005: Configuration changed for BGP router.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP router.

Message #

Configuration changed for BGP router.

Event ID 20005

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP router.

Event ID 20006: Configuration changed for BGP router of routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP router of routing domain Arg1.

Message #

Configuration changed for BGP router of routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20006

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP router of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20007: BGP peer Arg1 added.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer Arg1 added.

Message #

BGP peer %1 added.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20007

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer added.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20008: BGP peer Arg1 added for routing domain Arg2.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer Arg1 added for routing domain Arg2.

Message #

BGP peer %1 added for routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20008

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer added for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20009: BGP peer Arg1 removed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer Arg1 removed.

Message #

BGP peer %1 removed.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20009

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer removed.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20010: BGP peer Arg1 removed for routing domain Arg2.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer Arg1 removed for routing domain Arg2.

Message #

BGP peer %1 removed for routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20010

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP peer removed for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20011: Configuration changed for BGP peer Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP peer Arg1.

Message #

Configuration changed for BGP peer %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20011

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP peer .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20012: Configuration changed for BGP peer Arg1 of routing domain Arg2.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP peer Arg1 of routing domain Arg2.

Message #

Configuration changed for BGP peer %1 of routing domain %2.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20012

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Configuration changed for BGP peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString

Event ID 20013: Operation mode changed from Arg1 to Arg2 for peer Arg3.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Operation mode changed from Arg1 to Arg2 for peer Arg3.

Message #

Operation mode changed from %1 to %2 for peer %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 20013

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Operation mode changed from to for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 20014: Operation mode changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Operation mode changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.

Message #

Operation mode changed from %1 to %2 for peer %3 of routing domain %4.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 20014

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Operation mode changed from to for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 20015: Peering type changed from Arg1 to Arg2 for peer Arg3.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Peering type changed from Arg1 to Arg2 for peer Arg3.

Message #

Peering type changed from %1 to %2 for peer %3.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 20015

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Peering type changed from to for peer .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString

Event ID 20016: Peering type changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

Peering type changed from Arg1 to Arg2 for peer Arg3 of routing domain Arg4.

Message #

Peering type changed from %1 to %2 for peer %3 of routing domain %4.

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 20016

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

Peering type changed from to for peer of routing domain .

Fields #

Name	Description
`Arg1` UnicodeString
`Arg2` UnicodeString
`Arg3` UnicodeString
`Arg4` UnicodeString

Event ID 20017: BGP route flap dampening enabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening enabled.

Message #

BGP route flap dampening enabled.

Event ID 20017

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening enabled.

Event ID 20018: BGP route flap dampening enabled for routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening enabled for routing domain Arg1.

Message #

BGP route flap dampening enabled for routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20018

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening enabled for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20019: BGP route flap dampening configuration changed.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening configuration changed.

Message #

BGP route flap dampening configuration changed.

Event ID 20019

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening configuration changed.

Event ID 20020: BGP route flap dampening configuration changed for routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening configuration changed for routing domain Arg1.

Message #

BGP route flap dampening configuration changed for routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20020

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening configuration changed for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20021: BGP route flap dampening disabled.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening disabled.

Message #

BGP route flap dampening disabled.

Event ID 20021

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening disabled.

Event ID 20022: BGP route flap dampening disabled for routing domain Arg1.

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Config
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening disabled for routing domain Arg1.

Message #

BGP route flap dampening disabled for routing domain %1.

Fields #

Name	Description
`Arg1` UnicodeString

Event ID 20022

Provider: Microsoft-Windows-RemoteAccess-MgmtClient
Channel: Operational
Task: BorderGatewayProtocolConfigurationTask

Description

BGP route flap dampening disabled for routing domain .

Fields #

Name	Description
`Arg1` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b0261971-f607-458e-8d89-02fe7e846129

Defined in RAMgmtPSProvider.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-RemoteAccess-MgmtClient registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)