Microsoft-Windows-RemoteApp and Desktop Connections
43 events across 2 channels
Event ID 1000: An error occurred.
#Event ID 1001: An error occurred.
#Event ID 1002: Windows cannot find the remote computer that contains the connection.
#Event ID 1003: Windows cannot find the remote computer that contains the connection.
#Event ID 1004: The URL you typed does not have a connection.
#Event ID 1005: The URL you typed does not have a connection.
#Event ID 1006: The connection update timed out.
#Event ID 1007: The connection update timed out.
#Event ID 1008: Some available resources could not be downloaded.
#Event ID 1009: Some available resources could not be downloaded.
#Event ID 1010: There are currently no resources available in this connection.
#Event ID 1011: There are currently no resources available in this connection.
#Event ID 1012: There is a problem with this connection's security certificate.
#Event ID 1013: There is a problem with this connection's security certificate.
#Event ID 1014: The credentials that were used to connect to Connection_name did not work.
#Event ID 1015: The credentials that were used to connect to Connection_name did not work.
#Event ID 1016: An update to this connection is already in progress.
#Event ID 1017: The following resource could not be downloaded.
#Event ID 1018: The following resource could not be downloaded.
#Event ID 1019: You have successfully set up the following connection.
#Event ID 1020: The connection has been successfully removed.
#Event ID 1021: Multiple resources are associated with the same file extensions.
#Description
Multiple resources are associated with the same file extensions. Resources: String1. Associated file extensions: String2. Only one of these resources will be associated as the default program. To resolve this issue, change the file association settings for one or more of these resources so that they do not attempt to associate as the default program for the same extension.
Message #
Fields #
| Name | Description |
|---|---|
String1 UnicodeString | |
String2 UnicodeString |
Event ID 1022: Connection discovery was successful.
#Event ID 1023: Connection discovery failed.
#Event ID 1024: Connection discovery failed.
#Event ID 1025: An error occurred while Windows was installing file-type associations for the default connection.
#Description
An error occurred while Windows was installing file-type associations for the default connection. You will not be able to open files with the ResourceName RemoteApp program because the program couldn't be associated with any file types. Contact your workplace administrator for assistance. Connection name: ConnectionName Connection URL: ConnectionURL Error code: ErrorCode
Message #
Fields #
| Name | Description |
|---|---|
ResourceName UnicodeString | |
ConnectionName UnicodeString | |
ConnectionURL UnicodeString | |
ErrorCode UInt32 |
Event ID 1026: The installation of the default connection has been cancelled.
#Event ID 1027: New RemoteApp and Desktop connection (UserName) is started for user (ConnectionName) with authenticated credentials.
#Event ID 1028: New RemoteApp and Desktop connection (UserName) is started for user (ConnectionName) without authenticated credentials.
#Event ID 1029: RemoteApp and Desktop connection (UserName) already exists for user (ConnectionName) with authenticated credentials.
#Event ID 1030: RemoteApp and Desktop connection (UserName) already exists for user (ConnectionName) without authenticated credentials.
#Event ID 1031: RemoteApp and Desktop connection (ConnectionName) start failed (Error = ErrorCode).
#Event ID 1032: User (UserName) authentication information is registered on RemoteApp and Desktop connection (ConnectionName).
#Event ID 1033: Failed to register user (UserName) authentication information on RemoteApp and Desktop connection (ConnectionName).
#Event ID 1034: A connection (ConnectionId) is added to the RemoteApp and Desktop connection (ConnectionName).
#Event ID 1035: RemoteApp and Desktop connection (ConnectionName) is disconnected.
#Event ID 1036: RemoteApp and Desktop connection (ConnectionName) disconnect failed (Error = ErrorCode).
#Event ID 1037: A connection (ConnectionId) is removed from the RemoteApp and Desktop connection (ConnectionName).
#Event ID 1038: RemoteApp and Desktop connection (UserName) reconnect succeeded to the RDWeb (ConnectionName).
#Event ID 1039: RemoteApp and Desktop connection (UserName) reconnect failed to the RDWeb (ConnectionName) (Error = ErrorCode).
#Event ID 1040: Remote application (UserName) is launched using stored credentials on RemoteApp and Desktop connection (ConnectionName).
#Event ID 1041: Remote application (RemoteAppName) is launched on RemoteApp and Desktop connection (ConnectionName) but no stored credentials are used for single sign on.
#Event ID 1042: Remote application (UserName) failed to launch on RemoteApp and Desktop connection (ConnectionName).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 1b8b402d-78dc-46fb-bf71-46e64aedf165
Defined in TSWorkspace.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02