detection.wiki

Microsoft-Windows-RemoteDesktopServices-RdpCoreTS

EventTitleChannelSampleRule
1The RDP Graphics module failed to initialize.AdminNN
2Remote Desktop Protocol will use the RDP Graphics module to connect to the …AdminNN
3The RemoteFX module failed to initialize.AdminNN
4The RemoteFX module failed to initialize.AdminNN
5The client computer does not support RemoteFX.AdminNN
6The resolution requested by the remote client is not supported by RemoteFX.AdminNN
7The resolution requested by the remote client could not be set.AdminNN
8Module terminated.AdminNN
33Remote Desktop Protocol will use the RemoteFX guest mode module to connect to …OperationalYN
34Remote Desktop Protocol will use the RemoteFX host mode module to connect to the …OperationalNN
35Unable to initialize the RemoteFX host mode module.AdminNN
36Unable to initialize the RemoteFX host mode module.AdminNN
37The display resolution requested by the remote client is not supported by …OperationalNN
38The display resolution requested by the remote client could not be enabled.OperationalNN
65Connection ConnectionName created.OperationalYN
66The connection ConnectionName was assigned to session SessionID.OperationalYN
67The RemoteFX protocol connection ConnectionName encountered an error …OperationalNN
68TMT: ConnectionName=ConnectionName, PromptForCredentials=PromptForCredentials, …OperationalYN
69Listener ModuleName is loaded.OperationalNN
70The listener listens with display driver DisplayDriverName available.OperationalYN
71The connection ConnectionName uses display driver DisplayDriverName.OperationalYN
72Interface method called: Interface_method_called.OperationalYN
73Inner encryption disabled?OperationalNN
97The RDP protocol component ComponentName detected an error (ErrorCode) in the …OperationalNN
98A TCP connection has been successfully established.OperationalYN
99The TCP connection has failed with the error code ResultCode.OperationalNN
100The server has confirmed that the client's multi-transport capability.OperationalYN
101The network characteristics detection function has been disabled because of …OperationalYN
102The server has terminated main RDP connection with the client.OperationalYN
103The disconnect reason is ReasonCode.OperationalYN
104Client timezone is TimezoneBiasHour hour from UTC.OperationalYN
105The server's security layer setting allows it to use native RDP encryption, …AdminNN
106Disconnect initiated by server; forcing an AutoReconnect since listener is …OperationalNN
107Received Disconnect Provider Indication from the client.OperationalYN
129The server is using TransportProtocolName to bind to port Port.OperationalYN
130The server has initiated a multi-transport request to the client, for tunnel: …OperationalYN
131The server accepted a new ConnType connection from client ClientIP.OperationalYY
132A channel ChannelName has been connected between the server and the client using …OperationalYN
133The following network characteristics have been detected for tunnel TunnelID; …OperationalNN
134Link latency and bandwidth could not be detected for tunnel TunnelID.OperationalNN
135The multi-transport connection finished for tunnel: …OperationalYN
136Unable to establish a multi-transport connection; the connection will use TCP.OperationalNN
137The following network characteristics have been detected for tunnel TunnelID; …OperationalNN
138The DTLS initialization failed with the error code ResultCode, TLS will be used …AdminNN
139The server security layer detected an error (ResultCode) in the protocol stream …OperationalNN
140A connection from the client computer with an IP address of IPString failed …OperationalNN
141PerfCounter session started with instance ID InstanceID.OperationalYN
142TCP socket READ operation failed, error error.OperationalYN
143TCP socket WRITE operation failed, error error.OperationalYN
144TCP socket was gracefully terminatedOperationalYN
145During this connection, server has not sent data or graphics update for Idle2 …OperationalYN
146AutoReconnect failed with error Error.OperationalNN
147LogonUserExEx failed with error Error.OperationalNN
148Channel ChannelName has been closed between the server and the client on …OperationalYY
149Logon certificate sent by client did not pass validation.OperationalNN
150Long delay experienced while flushing data to the network.DebugNN
151In the past ms_all_packets_throughout_connection ms, HistoryMs heartbeats were …DebugNN
152Timestamp: Timestamp ms, heartbeats sent: ms_heartbeats_sent, data packet last …DebugNN
153Session negotiated TLS version TLSVersion.DebugNN
154Message.OperationalNN
155RDP Diagnostic HeartbeatDebugNN
161The RemoteFX encoding engine encountered an error (ErrorCode).OperationalNN
162The client supports version AVC_available of the RDP graphics protocol, client …OperationalYN
163The client supports RDP 7.OperationalYN
164The client advertised protocol configurations which are not supported by the …OperationalNN
165RDP RemoteFX graphics encoding is enabled.OperationalNN
166The RemoteFX Adaptive Graphics internal configuration changed to optimize for …OperationalNN
167The RemoteFX Adaptive Graphics internal configuration changed to optimize for …OperationalNN
168The resolution requested by the client: Monitor MonitorNum: (MonitorWidth, …OperationalYN
169The client operating system type is (MajorType, MinorType).OperationalYN
170AVC hardware encoder enabled: AVC_hardware_encoder_enabled, encoder name is …OperationalNN
171The client is uncapable to support screen capture protection feature.OperationalNN
172The client is uncapable to support watermarking feature.OperationalNN
193The RemoteFX Media Remoting is not supported by the client.OperationalNN
194The RemoteFX Media Remoting is not supported by the current server …OperationalNN
195The RemoteFX Media Remoting module encountered an error.OperationalNN
225StateTransition: Transitioned successfully from PreviousStateName to …DebugNN
226StateTransition: An error was encountered when transitioning from …OperationalYN
227CustomLevel.OperationalYN
228Disconnect trace:Disconnect_trace Message, Error code:ErrorCode.OperationalYN
229CustomLevel.OperationalYN
257The connection is using advanced RemoteFX RemoteApp graphics.OperationalNN
258The connection is not using advanced RemoteFX RemoteApp graphicsOperationalYN
289Got UDP reverse connect request to URL port Port connection id ConnectionID.OperationalNN
290UDP reverse connect successful.OperationalNN
291UDP reverse connect failed with error Error.OperationalNN
292Multi transport listener NOT initialized.OperationalNN
293Multi transport listener initialized.OperationalNN
294Reverse UDP connect is disabled by SxS registry settings.OperationalNN

Event ID 1: The RDP Graphics module failed to initialize.

#
Channel
Admin
Task
RDPStack
Opcode
Initialize

Description

The RDP Graphics module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status error code was HresultCode.

Message #

The RDP Graphics module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status error code was %1.

Fields #

NameDescription
HresultCode HexInt32

Event ID 2: Remote Desktop Protocol will use the RDP Graphics module to connect to the client computer.

#
Channel
Admin
Task
RDPStack
Opcode
Initialize

Description

Remote Desktop Protocol will use the RDP Graphics module to connect to the client computer. The RDP Graphics module is being used based on the server configuration, client configuration, and network connection.

Message #

Remote Desktop Protocol will use the RDP Graphics module to connect to the client computer. The RDP Graphics module is being used based on the server configuration, client configuration, and network connection.

Event ID 3: The RemoteFX module failed to initialize.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Initialize

Description

The RemoteFX module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status code was ErrorCode.

Message #

The RemoteFX module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status code was %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 4: The RemoteFX module failed to initialize.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Initialize

Description

The RemoteFX module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status code was ErrorCode.

Message #

The RemoteFX module failed to initialize. Verify that the server is correctly configured. A restart of the system may be needed. The relevant status code was %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 5: The client computer does not support RemoteFX.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Initialize

Description

The client computer does not support RemoteFX. The connection will be made with the RDP Graphics. The relevant status code was StatusCode.

Message #

The client computer does not support RemoteFX. The connection will be made with the RDP Graphics. The relevant status code was %1.

Fields #

NameDescription
StatusCode HexInt32NTSTATUS reference

Event ID 6: The resolution requested by the remote client is not supported by RemoteFX.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Initialize

Description

The resolution requested by the remote client is not supported by RemoteFX. The connection will be made with RemoteFX using a supported resolution. Resolution requested by the client: Monitors NumMonitors: RequestedMode. Resolution applied: AppliedMode.

Message #

The resolution requested by the remote client is not supported by RemoteFX. The connection will be made with RemoteFX using a supported resolution. Resolution requested by the client: Monitors %1: %2. Resolution applied: %3.

Fields #

NameDescription
NumMonitors UInt32
RequestedMode UnicodeString
AppliedMode UnicodeString

Event ID 7: The resolution requested by the remote client could not be set.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Initialize

Description

The resolution requested by the remote client could not be set. The default resolution will be set for the RemoteFX session. The server may be experiencing high load or require a restart.

Message #

The resolution requested by the remote client could not be set. The default resolution will be set for the RemoteFX session. The server may be experiencing high load or require a restart.

Event ID 8: Module terminated.

#
Channel
Admin
Task
RemoteFXmodule
Opcode
Terminate

Event ID 33: Remote Desktop Protocol will use the RemoteFX guest mode module to connect to the client computer.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Initialize

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 33,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 11,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:46.553439Z",
    "event_record_id": 898,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6776
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 34: Remote Desktop Protocol will use the RemoteFX host mode module to connect to the client computer.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Initialize

Event ID 35: Unable to initialize the RemoteFX host mode module.

#
Channel
Admin
Task
RemoteFXmodule_4
Opcode
Initialize

Description

Unable to initialize the RemoteFX host mode module. Restart the computer to resolve the issue. If the issue is not resolved, verify the computer configuration.. The error code is HresultCode.

Message #

Unable to initialize the RemoteFX host mode module. Restart the computer to resolve the issue. If the issue is not resolved, verify the computer configuration.. The error code is %1.

Fields #

NameDescription
HresultCode HexInt32

Event ID 36: Unable to initialize the RemoteFX host mode module.

#
Channel
Admin
Task
RemoteFXmodule_4
Opcode
Initialize

Description

Unable to initialize the RemoteFX host mode module. Restart the computer to resolve the issue. If the issue is not resolved, verify the computer configuration.. The error code is ErrorCode.

Message #

Unable to initialize the RemoteFX host mode module. Restart the computer to resolve the issue. If the issue is not resolved, verify the computer configuration.. The error code is %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 37: The display resolution requested by the remote client is not supported by RemoteFX host mode module.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Initialize

Description

The display resolution requested by the remote client is not supported by RemoteFX host mode module. The resolution requested by the client: Monitors NumMonitors: RequestedMode. Resolution applied: AppliedMode.

Message #

The display resolution requested by the remote client is not supported by RemoteFX host mode module. The resolution requested by the client: Monitors %1: %2. Resolution applied: %3.

Fields #

NameDescription
NumMonitors UInt32
RequestedMode UnicodeString
AppliedMode UnicodeString

Event ID 38: The display resolution requested by the remote client could not be enabled.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Initialize

Description

The display resolution requested by the remote client could not be enabled. The default resolution will be enabled for the RemoteFX session. The server may be experiencing high load.

Message #

The display resolution requested by the remote client could not be enabled. The default resolution will be enabled for the RemoteFX session. The server may be experiencing high load

Event ID 65: Connection ConnectionName created.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

Connection %1 created

Fields #

NameDescription
ConnectionName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 65,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:28.546169Z",
    "event_record_id": 846,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1660
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ConnectionName": "RDP-Tcp#5"
  }
}

References #

Event ID 66: The connection ConnectionName was assigned to session SessionID.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

The connection %1 was assigned to session %2

Fields #

NameDescription
ConnectionName UnicodeString
SessionID UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 66,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:46.547380Z",
    "event_record_id": 897,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6776
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ConnectionName": "RDP-Tcp#7",
    "SessionID": 1
  }
}

References #

Event ID 67: The RemoteFX protocol connection ConnectionName encountered an error (ErrorCode).

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

The RemoteFX protocol connection %1 encountered an error (%2)

Fields #

NameDescription
ConnectionName UnicodeString
ErrorCode HexInt32

Event ID 68: TMT: ConnectionName=ConnectionName, PromptForCredentials=PromptForCredentials, PromptForCredentialsDone=PromptForCredentialsDone, GfxChannelOpened=GfxChannelOpened, FirstGraphicsReceived=FirstGraph...

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Description

TMT: ConnectionName=ConnectionName, PromptForCredentials=PromptForCredentials, PromptForCredentialsDone=PromptForCredentialsDone, GfxChannelOpened=GfxChannelOpened, FirstGraphicsReceived=FirstGraphicsReceived [ms].

Message #

TMT: ConnectionName=%1, PromptForCredentials=%2, PromptForCredentialsDone=%3, GfxChannelOpened=%4, FirstGraphicsReceived=%5 [ms]

Fields #

NameDescription
ConnectionName UnicodeString
PromptForCredentials UInt32
PromptForCredentialsDone UInt32
GfxChannelOpened UInt32
FirstGraphicsReceived UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 68,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2020-11-13T11:09:15.885301Z",
    "event_record_id": 12592,
    "correlation": {
      "#attributes": {
        "ActivityID": "AF159B2D-D587-4709-AB35-F167130B0000"
      }
    },
    "execution": {
      "process_id": 388,
      "thread_id": 8512
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ConnectionName": "RDP-Tcp#0",
    "PromptForCredentials": 0,
    "PromptForCredentialsDone": 0,
    "GfxChannelOpened": 8266,
    "FirstGraphicsReceived": 10672
  }
}

References #

Event ID 69: Listener ModuleName is loaded.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

Listener %1 is loaded

Fields #

NameDescription
ModuleName UnicodeString

Event ID 70: The listener listens with display driver DisplayDriverName available.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

The listener listens with display driver %1 available.

Fields #

NameDescription
DisplayDriverName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "{1139C61B-B549-4251-8ED3-27250A1EDEC8}",
    "event_source_name": "",
    "event_id": 70,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.1010884+00:00",
    "event_record_id": 104,
    "correlation": {
      "ActivityID": "{F462A52A-5DAA-46E2-960E-FB3B92800000}"
    },
    "execution": {
      "process_id": 1300,
      "thread_id": 1600
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "DisplayDriverName": "rdpudd.dll"
  },
  "message": "The listener listens with display driver rdpudd.dll available."
}

Event ID 71: The connection ConnectionName uses display driver DisplayDriverName.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

The connection %1 uses display driver %2.

Fields #

NameDescription
ConnectionName UnicodeString
DisplayDriverName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 71,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.622046Z",
    "event_record_id": 886,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7136
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ConnectionName": "RDP-Tcp#7",
    "DisplayDriverName": "RDPUDD"
  }
}

References #

Event ID 72: Interface method called: Interface_method_called.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Message #

Interface method called: %1

Fields #

NameDescription
MethodName

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 72,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 13,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:28.548440Z",
    "event_record_id": 847,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6492
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "MethodName": "PrepareForAccept"
  }
}

References #

Event ID 73: Inner encryption disabled?

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
RCMProtocolImpl

Description

Inner encryption disabled? Disabled.

Message #

Inner encryption disabled? %1

Fields #

NameDescription
Disabled UInt32

Event ID 97: The RDP protocol component ComponentName detected an error (ErrorCode) in the protocol stream and the client was disconnected.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
ProtocolExchange

Message #

The RDP protocol component %1 detected an error (%2) in the protocol stream and the client was disconnected.

Fields #

NameDescription
ComponentName UnicodeString
ErrorCode UInt32

Event ID 98: A TCP connection has been successfully established.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 98,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.624254Z",
    "event_record_id": 891,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1692
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 99: The TCP connection has failed with the error code ResultCode.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

The TCP connection has failed with the error code %1.

Fields #

NameDescription
ResultCode HexInt32

Event ID 100: The server has confirmed that the client's multi-transport capability.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.624261Z",
    "event_record_id": 892,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1692
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 101: The network characteristics detection function has been disabled because of ReasonString.

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
NetworkDetect

Message #

The network characteristics detection function has been disabled because of %1.

Fields #

NameDescription
ReasonString UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 16,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.621408Z",
    "event_record_id": 880,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7312
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ReasonString": "Reason Code: 2(Server Configuration)."
  }
}

References #

Event ID 102: The server has terminated main RDP connection with the client.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
CloseConnection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 102,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 17,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.852452Z",
    "event_record_id": 854,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1644
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 103: The disconnect reason is ReasonCode.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
CloseConnection

Message #

The disconnect reason is %1

Fields #

NameDescription
ReasonCode UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 103,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 17,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.852505Z",
    "event_record_id": 857,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6492
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ReasonCode": 14
  }
}

References #

Event ID 104: Client timezone is TimezoneBiasHour hour from UTC.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

Client timezone is %1 hour from UTC;

Fields #

NameDescription
TimezoneBiasHour UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 104,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2020-07-09T19:47:00.719124Z",
    "event_record_id": 1129,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420CA7A-0E56-4135-8A7C-CE2182D30000"
      }
    },
    "execution": {
      "process_id": 476,
      "thread_id": 4152
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "TimezoneBiasHour": [
      1
    ]
  }
}

References #

Event ID 105: The server's security layer setting allows it to use native RDP encryption, which is no longer recommended.

#
Channel
Admin
Task
RemoteFXmodule_4
Opcode
ProtocolExchange

Description

The server's security layer setting allows it to use native RDP encryption, which is no longer recommended. Consider changing the server security layer to require SSL. You can change this setting in Group Policy.

Message #

The server's security layer setting allows it to use native RDP encryption, which is no longer recommended. Consider changing the server security layer to require SSL. You can change this setting in Group Policy.

Event ID 106: Disconnect initiated by server; forcing an AutoReconnect since listener is disabled.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
CloseConnection

Event ID 107: Received Disconnect Provider Indication from the client.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
CloseConnection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 107,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 17,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-28T10:07:43.924049Z",
    "event_record_id": 1066,
    "correlation": {
      "#attributes": {
        "ActivityID": "F4202795-713F-468C-BA0B-6C1C2F0C0000"
      }
    },
    "execution": {
      "process_id": 396,
      "thread_id": 1064
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 129: The server is using TransportProtocolName to bind to port Port.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
NetworkBinding

Message #

The server is using %1 to bind to port %2.

Fields #

NameDescription
TransportProtocolName UnicodeString
Port UInt16

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "{1139C61B-B549-4251-8ED3-27250A1EDEC8}",
    "event_source_name": "",
    "event_id": 129,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 18,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.0988665+00:00",
    "event_record_id": 103,
    "correlation": {
      "ActivityID": "{F462A52A-5DAA-46E2-960E-FB3B92800000}"
    },
    "execution": {
      "process_id": 1300,
      "thread_id": 1600
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "TransportProtocolName": "UDP",
    "Port": "3389"
  },
  "message": "The server is using UDP to bind to port 15629."
}

Event ID 130: The server has initiated a multi-transport request to the client, for tunnel: The_server_has_initiated_a_multitransport_request_to_the_client_for_tunnel.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

The server has initiated a multi-transport request to the client, for tunnel: %1.

Fields #

NameDescription
TunnelIDThe server has initiated a multi-transport request to the client, for tunnel.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 130,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.625322Z",
    "event_record_id": 894,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1692
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "TunnelID": 1
  }
}

References #

Event ID 131: The server accepted a new ConnType connection from client ClientIP.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

The server accepted a new %1 connection from client %2.

Fields #

NameDescription
ConnType UnicodeString
ClientIP UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 131,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2020-11-13T11:09:07.084053Z",
    "event_record_id": 12551,
    "correlation": {
      "#attributes": {
        "ActivityID": "F4207C37-D7A8-4A5E-9A35-4E79CAA60000"
      }
    },
    "execution": {
      "process_id": 388,
      "thread_id": 1292
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ConnType": "TCP",
    "ClientIP": "10.0.2.16:52202"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

  • RDP discovery performed on multiple hosts source high: Detects scenarios where an attacker attempts to discover active RDP services via tools like Hydra. Note that this event doesn't provide any information about login outcome (success or failure) as well as user information. For further correlation, ID 4624/4625 (logon type 3, 7 or 10) as well as ID 1149 should be used.T1021, T1021.001, T1046, T1110

References #

Event ID 132: A channel ChannelName has been connected between the server and the client using transport tunnel: TunnelID.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

A channel %1 has been connected between the server and the client using transport tunnel: %2.

Fields #

NameDescription
ChannelName UnicodeString
TunnelID UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 132,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.621433Z",
    "event_record_id": 881,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7312
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ChannelName": "rdplic",
    "TunnelID": 0
  }
}

References #

Event ID 133: The following network characteristics have been detected for tunnel TunnelID; Link latency : RTT milliseconds and Bandwidth: Bandwidth kbps.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
NetworkDetect

Message #

The following network characteristics have been detected for tunnel %1; Link latency : %2 milliseconds and Bandwidth: %3 kbps.

Fields #

NameDescription
TunnelID UInt32
RTT UInt32
Bandwidth UInt32

Event ID 134: Link latency and bandwidth could not be detected for tunnel TunnelID.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
NetworkDetect

Description

Link latency and bandwidth could not be detected for tunnel TunnelID. The error code is ResultCode. The following default network characteristics will be used; Link latency: RTT milliseconds and Bandwidth:Bandwidth kbps.

Message #

Link latency and bandwidth could not be detected for tunnel %2.  The error code is %1. The following default network characteristics will be used;  Link latency: %3 milliseconds and Bandwidth:%4 kbps.

Fields #

NameDescription
ResultCode HexInt32
TunnelID UInt32
RTT UInt32
Bandwidth UInt32

Event ID 135: The multi-transport connection finished for tunnel: The_multitransport_connection_finished_for_tunnel, its transport type set to TransportType.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

The multi-transport connection finished for tunnel: %1, its transport type set to %2.

Fields #

NameDescription
TunnelIDThe multi-transport connection finished for tunnel.
TransportType

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 135,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.624288Z",
    "event_record_id": 893,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1692
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "TunnelID": 3,
    "TransportType": "TCP: Reason Code: 2 (Forced by Server Configuration)"
  }
}

References #

Event ID 136: Unable to establish a multi-transport connection; the connection will use TCP.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Description

Unable to establish a multi-transport connection; the connection will use TCP. Consult the product documentation to enable UDP Connections.

Message #

Unable to establish a multi-transport connection; the connection will use TCP. Consult the product documentation to enable UDP Connections.

Event ID 137: The following network characteristics have been detected for tunnel TunnelID; Link latency : RTT milliseconds and Bandwidth: Bandwidth kbps.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
NetworkDetect

Description

The following network characteristics have been detected for tunnel ; Link latency : milliseconds and Bandwidth: kbps. Connections with these network characteristics may impact user experience.

Message #

The following network characteristics have been detected for tunnel %1; Link latency : %2 milliseconds and Bandwidth: %3 kbps. Connections with these network characteristics may impact user experience.

Fields #

NameDescription
TunnelID UInt32
RTT UInt32
Bandwidth UInt32

Event ID 138: The DTLS initialization failed with the error code ResultCode, TLS will be used instead.

#
Channel
Admin
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Description

The DTLS initialization failed with the error code ResultCode, TLS will be used instead. Audio/Video experience may be impacted.

Message #

The DTLS initialization failed with the error code %1, TLS will be used instead. Audio/Video experience may be impacted.

Fields #

NameDescription
ResultCode HexInt32

Event ID 139: The server security layer detected an error (ResultCode) in the protocol stream and the client (Client IP:IPString) has been disconnected.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
ProtocolExchange

Message #

The server security layer detected an error (%1) in the protocol stream and the client (Client IP:%2) has been disconnected.

Fields #

NameDescription
ResultCode HexInt32
IPString UnicodeString

Event ID 140: A connection from the client computer with an IP address of IPString failed because the user name or password is not correct.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
ProtocolExchange

Message #

A connection from the client computer with an IP address of %1 failed because the user name or password is not correct.

Fields #

NameDescription
IPString UnicodeString

Event ID 141: PerfCounter session started with instance ID InstanceID.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Initialize

Message #

PerfCounter session started with instance ID %1

Fields #

NameDescription
InstanceID UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 141,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 11,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:28.549456Z",
    "event_record_id": 849,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6492
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "InstanceID": 5
  }
}

References #

Event ID 142: TCP socket READ operation failed, error error.

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

TCP socket READ operation failed, error %1

Fields #

NameDescription
error UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 142,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.851987Z",
    "event_record_id": 852,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 6776
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "error": 64
  }
}

References #

Event ID 143: TCP socket WRITE operation failed, error error.

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Message #

TCP socket WRITE operation failed, error %1

Fields #

NameDescription
error UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 143,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.851924Z",
    "event_record_id": 850,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 4988
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "error": 64
  }
}

References #

Event ID 144: TCP socket was gracefully terminated

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
EstablishConnection

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 144,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 15,
    "keywords": 4611686018427387904,
    "time_created": "2026-03-11T10:16:51.112394+00:00",
    "event_record_id": 4129,
    "correlation": {
      "ActivityID": "F420FF93-1637-4090-92CE-51A628CA0000"
    },
    "execution": {
      "process_id": 1536,
      "thread_id": 9036
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "LAB-WIN11",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 145: During this connection, server has not sent data or graphics update for Idle2 seconds (Idle1: IdleSeconds1, Idle2: IdleSeconds2).

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

During this connection, server has not sent data or graphics update for %1 seconds (Idle1: %2, Idle2: %3).

Fields #

NameDescription
IdleSeconds
IdleSeconds1
IdleSeconds2

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 145,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.852455Z",
    "event_record_id": 855,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1644
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "IdleSeconds": 0,
    "IdleSeconds1": 0,
    "IdleSeconds2": 0
  }
}

References #

Event ID 146: AutoReconnect failed with error Error.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

AutoReconnect failed with error %1

Fields #

NameDescription
Error UnicodeString

Event ID 147: LogonUserExEx failed with error Error.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

LogonUserExEx failed with error %1

Fields #

NameDescription
Error HexInt32

Event ID 148: Channel ChannelName has been closed between the server and the client on transport tunnel: TunnelID.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
CloseConnection

Message #

Channel %1 has been closed between the server and the client on transport tunnel: %2.

Fields #

NameDescriptionRules
ChannelName UnicodeString1 detection rule
TunnelID UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 148,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 17,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.852505Z",
    "event_record_id": 856,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 1644
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ChannelName": "rdpinpt",
    "TunnelID": 0
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

References #

Event ID 149: Logon certificate sent by client did not pass validation.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

Logon certificate sent by client did not pass validation. Error: ErrorCode.

Message #

Logon certificate sent by client did not pass validation. Error: %1

Fields #

NameDescription
ErrorCode HexInt32

Event ID 150: Long delay experienced while flushing data to the network.

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Description

Long delay experienced while flushing data to the network. Flush time: FlushTimeMs ms, flush interval: FlushIntervalMs ms.

Message #

Long delay experienced while flushing data to the network. Flush time: %1 ms, flush interval: %2 ms.

Fields #

NameDescription
FlushTimeMs UInt32
FlushIntervalMs UInt32

Event ID 151: In the past ms_all_packets_throughout_connection ms, HistoryMs heartbeats were sent to the client.

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Description

In the past HistoryMs ms, NumHeartbeats heartbeats were sent to the client. Max time without sending packets in recent history: MaxRecentTimeNoPacketMs ms (all packets); throughout connection: MaxTotalTimeNoDataMs ms (data), MaxTotalTimeNoHeartbeatMs ms (heartbeats), MaxTotalTimeNoPacketMs ms (all packets). Time between disconnect and last packet sent: TimeNoLastPacketMs ms

Message #

In the past %1 ms, %2 heartbeats were sent to the client. Max time without sending packets in recent history: %3 ms (all packets); throughout connection: %4 ms (data), %5 ms (heartbeats), %6 ms (all packets). Time between disconnect and last packet sent: %7 ms

Fields #

NameDescription
HistoryMs UInt32
NumHeartbeats UInt32
MaxRecentTimeNoPacketMs UInt32
MaxTotalTimeNoDataMs UInt32
MaxTotalTimeNoHeartbeatMs UInt32
MaxTotalTimeNoPacketMs UInt32
TimeNoLastPacketMs UInt32

Event ID 152: Timestamp: Timestamp ms, heartbeats sent: ms_heartbeats_sent, data packet last sent: data_packet_last_sent ms, heartbeat last sent: ms_heartbeat_last_sent ms.

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

Timestamp: %1 ms, heartbeats sent: %2, data packet last sent: %3 ms, heartbeat last sent: %4 ms.

Fields #

NameDescription
TimestampMs UInt32
NumHeartbeats UInt32
LastDataPacketMs UInt32
LastHeartbeatMs UInt32

Event ID 153: Session negotiated TLS version TLSVersion.

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

Session negotiated TLS version %1

Fields #

NameDescription
TLSVersion UnicodeString

Event ID 154: Message.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

Message. Error Error

Message #

%1. Error %2

Fields #

NameDescription
Message UnicodeString
Error HexInt32

Event ID 155: RDP Diagnostic Heartbeat

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Event ID 161: The RemoteFX encoding engine encountered an error (ErrorCode).

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The RemoteFX encoding engine encountered an error (ErrorCode). Server: ServerName.

Message #

The RemoteFX encoding engine encountered an error (%1). Server: %2

Fields #

NameDescription
ErrorCode HexInt32
ServerName UnicodeString

Event ID 162: The client supports version AVC_available of the RDP graphics protocol, client mode: Initial_profile, AVC available: Server, Initial profile: ProfileIdNum.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client supports version AVC_available of the RDP graphics protocol, client mode: Initial_profile, AVC available: Server, Initial profile: ProfileIdNum. Server: ServerName.

Message #

The client supports version %1 of the RDP graphics protocol, client mode: %2, AVC available: %3, Initial profile: %4. Server: %5

Fields #

NameDescription
Version
ClientMode
AvcEnabled
ProfileIdNum
ServerName

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 162,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:46.742779Z",
    "event_record_id": 908,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 8020
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Version": "0xa0301",
    "ClientMode": 2,
    "AvcEnabled": 1,
    "ProfileIdNum": 2,
    "ServerName": "MSEDGEWIN10"
  }
}

References #

Event ID 163: The client supports RDP 7.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client supports RDP 7.1 or lower protocol. Server: Server.

Message #

The client supports RDP 7.1 or lower protocol. Server: %1

Fields #

NameDescription
ServerName

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 163,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-28T14:22:27.573268Z",
    "event_record_id": 1356,
    "correlation": {
      "#attributes": {
        "ActivityID": "F4201740-D459-489E-A55C-BFE842340000"
      }
    },
    "execution": {
      "process_id": 396,
      "thread_id": 1336
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ServerName": "MSEDGEWIN10"
  }
}

References #

Event ID 164: The client advertised protocol configurations which are not supported by the server.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client advertised protocol configurations which are not supported by the server. Server: ServerName.

Message #

The client advertised protocol configurations which are not supported by the server. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 165: RDP RemoteFX graphics encoding is enabled.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

RDP RemoteFX graphics encoding is enabled. Server: ServerName.

Message #

RDP RemoteFX graphics encoding is enabled. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 166: The RemoteFX Adaptive Graphics internal configuration changed to optimize for the minimum use of network bandwidth.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The RemoteFX Adaptive Graphics internal configuration changed to optimize for the minimum use of network bandwidth. Server: ServerName.

Message #

The RemoteFX Adaptive Graphics internal configuration changed to optimize for the minimum use of network bandwidth. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 167: The RemoteFX Adaptive Graphics internal configuration changed to optimize for experience.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The RemoteFX Adaptive Graphics internal configuration changed to optimize for experience. Server: ServerName.

Message #

The RemoteFX Adaptive Graphics internal configuration changed to optimize for experience. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 168: The resolution requested by the client: Monitor MonitorNum: (MonitorWidth, MonitorHeight), origin: (MonitorX, MonitorY).

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Initialize

Description

The resolution requested by the client: Monitor MonitorNum: (MonitorWidth, MonitorHeight), origin: (MonitorX, MonitorY). Server: ServerName.

Message #

The resolution requested by the client: Monitor %1: (%2, %3), origin: (%4, %5). Server: %6

Fields #

NameDescription
MonitorNum UInt32
MonitorWidth UInt32
MonitorHeight UInt32
MonitorX UInt32
MonitorY UInt32
ServerName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 168,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 11,
    "keywords": 4611686018427387904,
    "time_created": "2020-11-13T11:09:15.564770Z",
    "event_record_id": 12591,
    "correlation": {
      "#attributes": {
        "ActivityID": "F4207C37-D7A8-4A5E-9A35-4E79CAA60000"
      }
    },
    "execution": {
      "process_id": 388,
      "thread_id": 7312
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "MonitorNum": 0,
    "MonitorWidth": 200,
    "MonitorHeight": 200,
    "MonitorX": 0,
    "MonitorY": 0,
    "ServerName": "MSEDGEWIN10"
  }
}

References #

Event ID 169: The client operating system type is (MajorType, MinorType).

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client operating system type is (MajorType, MinorType). Server: ServerName.

Message #

The client operating system type is (%1, %2).  Server: %3

Fields #

NameDescription
MajorType UInt32
MinorType UInt32
ServerName UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:46.567652Z",
    "event_record_id": 902,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7312
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "MajorType": 1,
    "MinorType": 3,
    "ServerName": "MSEDGEWIN10"
  }
}

References #

Event ID 170: AVC hardware encoder enabled: AVC_hardware_encoder_enabled, encoder name is IsHardwareEncode.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

AVC hardware encoder enabled: AVC_hardware_encoder_enabled, encoder name is IsHardwareEncode. Server: EncoderMFTName.

Message #

AVC hardware encoder enabled: %1, encoder name is %2. Server: %3

Fields #

NameDescription
IsHardwareEncode UInt32
EncoderMFTName UnicodeString
ServerName UnicodeString

Event ID 171: The client is uncapable to support screen capture protection feature.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client is uncapable to support screen capture protection feature. Server: ServerName.

Message #

The client is uncapable to support screen capture protection feature. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 172: The client is uncapable to support watermarking feature.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The client is uncapable to support watermarking feature. Server: ServerName.

Message #

The client is uncapable to support watermarking feature. Server: %1

Fields #

NameDescription
ServerName UnicodeString

Event ID 193: The RemoteFX Media Remoting is not supported by the client.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Event ID 194: The RemoteFX Media Remoting is not supported by the current server configuration.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Event ID 195: The RemoteFX Media Remoting module encountered an error.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
Runtime

Description

The RemoteFX Media Remoting module encountered an error. The error code is ErrorCode.

Message #

The RemoteFX Media Remoting module encountered an error. The error code is %1.

Fields #

NameDescription
ErrorCode HexInt32

Event ID 225: StateTransition: Transitioned successfully from PreviousStateName to NewStateName in response to EventName.

#
Channel
Debug
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

%1: Transitioned successfully from %3 to %5 in response to %7.

Fields #

NameDescription
StateTransition UnicodeString
PreviousState UInt32
PreviousStateName UnicodeString
NewState UInt32
NewStateName UnicodeString
Event UInt32
EventName UnicodeString

Event ID 226: StateTransition: An error was encountered when transitioning from PreviousStateName in response to EventName (error code ErrorCode).

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

%1: An error was encountered when transitioning from %3 in response to %7 (error code %8).

Fields #

NameDescription
StateTransition UnicodeString
PreviousState UInt32
PreviousStateName UnicodeString
NewState UInt32
NewStateName UnicodeString
Event UInt32
EventName UnicodeString
ErrorCode HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 226,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:16:34.851971Z",
    "event_record_id": 851,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420DD64-C87E-4E2D-A02E-7D0935770000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 4988
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "StateTransition": "RDP_TCP",
    "PreviousState": 23,
    "PreviousStateName": "StateUnknown",
    "NewState": 21,
    "NewStateName": "StateDisconnected",
    "Event": 43,
    "EventName": "Event_Disconnect",
    "ErrorCode": "0x80070040"
  }
}

References #

Event ID 227: CustomLevel.

#
Channel
Operational
Level
Error
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

%3

Fields #

NameDescription
Name UnicodeString
Value UInt32
CustomLevel UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 227,
    "version": 0,
    "level": 2,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:45.622336Z",
    "event_record_id": 887,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7136
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Name": "CUMRDPConnection",
    "Value": 2147500033,
    "CustomLevel": "'Failed GetConnectionProperty' in CUMRDPConnection::QueryProperty at 2884 err=[0x80004001]"
  }
}

References #

Event ID 228: Disconnect trace:Disconnect_trace Message, Error code:ErrorCode.

#
Channel
Operational
Level
Warning
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

Disconnect trace:%1 %2, Error code:%3

Fields #

NameDescription
ComponentName
Message
ErrorCode

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 228,
    "version": 0,
    "level": 3,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:26:41.767599Z",
    "event_record_id": 938,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7572
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "ComponentName": "CUMRDPConnection",
    "Message": "Disconnect trace:'calling spGfxPlugin->PreDisconnect()' in CUMRDPConnection::PreDisconnect at 4595 err=[0x5]",
    "ErrorCode": 5
  }
}

References #

Event ID 229: CustomLevel.

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
Runtime

Message #

%2

Fields #

NameDescription
Name UnicodeString
CustomLevel UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 229,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 19,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-28T03:36:49.647283Z",
    "event_record_id": 975,
    "correlation": {
      "#attributes": {
        "ActivityID": "F4624E4C-DF38-4BB3-A4DB-3782C9880000"
      }
    },
    "execution": {
      "process_id": 480,
      "thread_id": 1196
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {
    "Name": "CUMRDPProtocolManager",
    "CustomLevel": "'CUMRDPProtocolManager::CreateListener(RDP-Tcp) DEBUG/VM/ReverseTCP/ReverseUDP/INET' in CUMRDPProtocolManager::CreateListener at 4134 err=[0x0]"
  }
}

References #

Event ID 257: The connection is using advanced RemoteFX RemoteApp graphics.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
AdvancedRemoteAppEnabled

Event ID 258: The connection is not using advanced RemoteFX RemoteApp graphics

#
Channel
Operational
Level
Informational
Task
RemoteFXmodule_4
Opcode
AdvancedRemoteAppNotEnabled

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS",
    "guid": "1139C61B-B549-4251-8ED3-27250A1EDEC8",
    "event_source_name": "",
    "event_id": 258,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 21,
    "keywords": 4611686018427387904,
    "time_created": "2019-08-27T17:17:47.617830Z",
    "event_record_id": 915,
    "correlation": {
      "#attributes": {
        "ActivityID": "F420C5E0-91BA-4CF1-97FF-34CCD7200000"
      }
    },
    "execution": {
      "process_id": 636,
      "thread_id": 7572
    },
    "channel": "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational",
    "computer": "MSEDGEWIN10",
    "security": {
      "user_id": "S-1-5-20"
    }
  },
  "event_data": {}
}

References #

Event ID 289: Got UDP reverse connect request to URL port Port connection id ConnectionID.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Message #

Got UDP reverse connect request to %1 port %2 connection id %3.

Fields #

NameDescription
URL UnicodeString
Port UInt32
ConnectionID UnicodeString

Event ID 290: UDP reverse connect successful.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Event ID 291: UDP reverse connect failed with error Error.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Message #

UDP reverse connect failed with error %1.

Fields #

NameDescription
Error HexInt32

Event ID 292: Multi transport listener NOT initialized.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Description

Multi transport listener NOT initialized. UDP reverse connect NOT supported.

Message #

Multi transport listener NOT initialized. UDP reverse connect NOT supported.

Event ID 293: Multi transport listener initialized.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Description

Multi transport listener initialized. UDP reverse connect supported.

Message #

Multi transport listener initialized. UDP reverse connect supported.

Event ID 294: Reverse UDP connect is disabled by SxS registry settings.

#
Channel
Operational
Task
RemoteFXmodule_4
Opcode
UDPReverseConnect

Provenance

ETW provider GUID 1139c61b-b549-4251-8ed3-27250a1edec8

Defined in RdpCoreTS.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB