Microsoft-Windows-ServerManager-MultiMachine

Event	Title	Channel	Sample	Rule
0	Refresh scheduler started.	Operational	Y	N
1	Refresh scheduler stopped.	Operational	N	N
2	Start of filtering out in-progress refresh.	Debug	N	N
3	End of filtering out in-progress refresh.	Debug	N	N
4	Short circuit refresh.	Operational	Y	N
5	Start of triggering refresh job.	Operational	N	N
6	End of triggering refresh job.	Operational	N	N
7	Error received from refresh job.	Operational	N	N
8	Child job completed.	Operational	Y	N
9	Parent job completed.	Operational	Y	N
10	Start of request for refresh.	Operational	N	N
11	End of request for refresh.	Operational	N	N
12	Task 'TaskName' execution started.	Debug	N	N
13	Task 'TaskName' execution completed.	Debug	N	N
14	Error during processing data.	Operational	N	N
15	Start of decoding BPA results.	Debug	N	N
16	End of decoding BPA results.	Debug	N	N
17	Error during decoding of BPA results.	Operational	N	N
18	Start of updating Bpa result records.	Debug	N	N
19	End of updating Bpa result records.	Debug	N	N
20	Short circuting of updating of Bpa result records.	Debug	N	N
21	Error during updating of Bpa result records.	Operational	N	N
22	Triggered Bpa results updated event.	Debug	N	N
23	Start of decoding service statuses.	Debug	N	N
24	End of decoding service statuses.	Debug	N	N
25	Error during decoding of service statuses.	Operational	N	N
26	Start of updating services records.	Debug	N	N
27	End of updating services records.	Debug	N	N
28	Short circuting of updating of services records.	Debug	N	N
29	Error during updating of services records.	Operational	N	N
30	Triggered services updated event.	Debug	N	N
31	Plugin load started for Role Id roleId.	Operational	Y	N
32	Plugin load stopped for Role Id roleId.	Operational	Y	N
33	Plugin load failed for Role Id roleId.	Operational	N	N
34	Plugin unload started for Role Id roleId.	Operational	Y	N
35	Plugin unload stopped for Role Id roleId.	Operational	N	N
36	Plugin unload failed for Role Id roleId.	Operational	N	N
37	Plugin registration information is loaded.	Operational	Y	N
38	Plugin registration information failed to load.	Debug	N	N
39	ARW launch command started.	Operational	Y	N
40	ARW launch command completed.	Operational	Y	N
41	Add server command started.	Operational	N	N
42	Add server command completed.	Operational	N	N
43	The requested server machineName is already added.	Operational	N	N
44	Add server command failed while adding server machineName, failure: …	Operational	N	N
45	Full refresh command started.	Operational	N	N
46	Full refresh command completed.	Operational	N	N
47	Started initializing service provider.	Operational	Y	N
48	Completed initializing service provider.	Operational	Y	N
49	Boot loader started.	Operational	Y	N
50	Boot loader completed.	Operational	Y	N
51	Boot loader can't find the service provider list, Error: errorMessage.	Operational	N	N
52	Failed to load user settings, Error: errorMessage.	Operational	N	N
53	Main window initialized.	Operational	Y	N
54	Main window initialization failed, Error: errorMessage.	Operational	N	N
55	Failed to change the navigation item navigationItemName of type …	Operational	N	N
56	Navigation service selection changed.	Operational	N	N
57	Server manager started	Operational	N	N
58	Server manager shutdown started	Operational	Y	N
59	Server manager shutdown failure: errorMessage.	Operational	N	N
60	Saving server list failure: errorMessage.	Operational	N	N
61	Server manager automation shutdown failure: errorMessage.	Operational	N	N
62	Server manager plugin manager shutdown failure: errorMessage.	Operational	N	N
63	Server manager exception.	Operational	N	N
64	Start of decoding performance counter threshold alerts results.	Debug	N	N
65	Stop of decoding performance counter threshold alerts results.	Debug	N	N
66	Error during decoding performance counter threshold alerts results.	Operational	N	N
67	Start of data update to performance counter threshold alert data.	Debug	N	N
68	Stop of data update to performance counter threshold alert data.	Debug	N	N
69	Error during data update to performance counter threshold alert data.	Operational	N	N
70	Triggered performance counter threshold alert data results updated event.	Operational	N	N
71	Start of decoding performance counter samples results.	Debug	N	N
72	Stop of decoding performance counter samples results.	Debug	N	N
73	Error during decoding performance counter samples results.	Operational	N	N
74	Start of data update to performance counter sample data.	Debug	N	N
75	Stop of data update to performance counter sample data.	Debug	N	N
76	Error during data update to performance counter sample data.	Operational	N	N
77	Triggered performance counter sample data results updated event.	Operational	N	N
78	Start job of diagnostics data collect (process snapshots).	Debug	N	N
79	Stop job of diagnostics data collect (process snapshots).	Debug	N	N
80	Error in a job of diagnostics data collect (process snapshots).	Operational	N	N
81	Start of data update to diagnostics data (process snapshots).	Debug	N	N
82	Stop of data update to diagnostics data (process snapshots).	Debug	N	N
83	Error during data update to diagnostics data (process snapshots).	Operational	N	N
84	Start of time change filter.	Debug	N	N
85	Stop of time change filter.	Debug	N	N
86	Error during time change filter.	Operational	N	N
87	Start job of time change filter.	Debug	N	N
88	Stop job of time change filter.	Debug	N	N
89	Error in a job of time change filter.	Operational	N	N
90	Start of data update for time change filter.	Debug	N	N
91	Stop of data update for time change filter.	Debug	N	N
92	Error during data update for time change filter.	Operational	N	N
93	Job refresh error.	Operational	N	N
94	Splash screen started.	Operational	Y	N
95	Splash screen stopped.	Operational	Y	N
96	Server list loading failed.	Operational	N	N
97	Server manager shutdown stopped.	Operational	Y	N
98	User settings save started.	Operational	Y	N
99	User settings save stopped.	Operational	Y	N
100	Automation job history.	Debug	N	N
101	Automation job history.	Debug	N	N
102	Group of inventory refresh jobs has finished.	Operational	N	N
103	Error encountered while attempting to load an advanced tool: ErrorMessage.	Debug	N	N
104	DataStore persistence: starting load	Debug	N	N
105	DataStore persistence: load error ErrorMessage.	Operational	N	N
106	DataStore persistence: load finished	Debug	N	N
107	DataStore persistence: starting save	Debug	N	N
108	DataStore persistence: save error: ErrorMessage.	Operational	N	N
109	DataStore persistence: save finished	Debug	N	N
110	Inventory data update failed.	Operational	N	N
111	Launched BPA scan on machine MachineName, BPA Model Ids JobName.	Operational	N	N
112	Bpa Scan launch failed for server MachineName, error: Error.	Operational	N	N
113	Start of enable job of performance counter collector.	Debug	N	N
114	Stop of enable job of performance counter collector.	Debug	N	N
115	Failed enabling of performance counter collector.	Operational	N	N
116	Bpa include or exclude launch failed for server MachineName, error: Error.	Operational	N	N
117	Error while launching command 'MachineName' : Error.	Operational	N	N
118	Failed to close the post deployment configuration task.	Operational	N	N
119	Created the post deployment task.	Operational	N	N
120	Completed the post deployment task.	Operational	Y	N
121	Failed to create the post deployment configuration task.	Operational	N	N
122	Unknown type of failure to refresh data.	Operational	N	N
123	Roles and features discovered on ServerName: Features.	Operational	N	N
124	Roles and features requiring configuration on ServerName: Features.	Operational	N	N
125	Skipping Server Manager auto refresh.	Operational	N	N
126	Skipping loading the navigation item for a plugin that is not initialized.	Operational	N	N
127	Shell plugin icon not found.	Operational	N	N
128	Parent role not found.	Operational	N	N
129	String pool has been scanned.	Operational	N	N
130	Automation job query started.	Operational	N	N
131	Automation job query result.	Operational	N	N
132	Automation job query completed.	Operational	N	N
133	Automation job created.	Operational	Y	N
134	Automation job creation failed with error: ErrorMessage.	Operational	N	N
135	Exception reported to refresh data.	Operational	N	N
136	Exception reported to data collection.	Operational	Y	N
150	Automation job started.	Debug	N	N
151	Automation job state changed.	Debug	N	N
152	Automation job error data added.	Debug	N	N
153	Automation job output data added.	Debug	N	N
154	Automation job progress data added.	Debug	N	N
155	Automation job error data added.	Debug	N	N
156	Data processing time.	Debug	N	N
157	Lengthy data processing time.	Debug	N	N
160	Error setting main window focus with the handle.	Operational	N	N
161	Error writing the window handle.	Operational	N	N
162	File mapping initialization failed.	Operational	N	N
163	Error shutting down the kernel service.	Operational	N	N
164	CEIP/WER launch command started.	Operational	N	N
165	CEIP/WER launch command completed.	Operational	N	N
166	CEIP/WER plugin load started.	Operational	N	N
167	CEIP/WER plugin load completed.	Operational	N	N
168	Connection to M3P starting.	Operational	Y	N
169	Connection to M3P completed.	Operational	Y	N
170	Credentials set for connections to machines: Targets.	Operational	N	N
171	Refresh session started.	Operational	Y	N
172	Refresh session completed.	Operational	Y	N
173	Credentials loaded from the cred store: User name = UserName.	Operational	N	N
174	Error loading credentials from the cred store.	Operational	N	N
175	Credentials saved to the cred store: User name = UserName.	Operational	N	N
176	Error saving credentials to the cred store.	Operational	N	N
177	Credentials deleted from the cred store: User name = UserName.	Operational	N	N
178	Error deleting credentials from the cred store.	Operational	N	N
179	Local server properties refresh started.	Operational	Y	N
180	Local server properties refresh completed.	Operational	Y	N
181	Error accessing local server properties.	Operational	N	N
182	Completed services modification job	Operational	Y	N
183	Launching wizard from automation job started.	Operational	N	N
184	Launching wizard from automation job completed.	Operational	N	N
190	Starting WinRM service status check.	Operational	Y	N
191	Completed WinRM service status check.	Operational	Y	N
192	Refresh item completed.	Operational	Y	N
193	Error cleaning up credentials from the cred store.	Operational	N	N
194	Cluster query item added.	Operational	N	N
195	Cluster query item data received.	Operational	N	N
196	New cluster nodes added to session.	Operational	N	N
197	Cluster query item completed.	Operational	N	N
200	Refresh item session create started.	Debug	N	N
201	Refresh item session create completed.	Debug	N	N
202	Refresh item session close started.	Debug	N	N
203	Refresh item session close completed.	Debug	N	N
204	Refresh item invocation started.	Debug	N	N
205	Refresh item enumeration started.	Debug	N	N
206	Refresh item data received.	Debug	N	N
207	Refresh item operation completed.	Debug	N	N
208	Refresh item operation error.	Debug	N	N
209	Creating new session.	Operational	Y	N
210	Enumerate instances started.	Operational	N	N
211	Enumerate instances completed.	Operational	N	N
212	Enumerate instances error.	Operational	N	N
213	Enumerate instances data received.	Operational	N	N
214	Invoke method started.	Operational	Y	N
215	Invoke method completed.	Operational	Y	N
216	Invoke method error.	Operational	N	N
217	Invoke method data received.	Operational	Y	N
218	Invoke method non-terminating error received.	Operational	Y	N
219	Invoke method message received.	Operational	N	N
220	Disconnect from M3P starting.	Operational	N	N
221	Disconnect from M3P completed.	Operational	N	N
300	Server data processer start.	Debug	N	N
301	Server data processer stop.	Debug	N	N
302	Server data processor failed.	Debug	N	N
303	Server data processor on next start.	Debug	N	N
304	Server data processor on next stop.	Debug	N	N
305	Feature data processer start.	Debug	N	N
306	Feature data processer stop.	Debug	N	N
307	Feature data processor failed.	Debug	N	N
308	Feature data processor on next start.	Debug	N	N
309	Feature data processor on next stop.	Debug	N	N
310	BPA data processer start.	Debug	N	N
311	BPA data processer stop.	Debug	N	N
312	BPA data processor failed.	Debug	N	N
313	BPA data processor on next start.	Debug	N	N
314	BPA data processor on next stop.	Debug	N	N
315	Events data processer start.	Debug	N	N
316	Events data processer stop.	Debug	N	N
317	Events data processor failed.	Debug	N	N
318	Events data processor on next start.	Debug	N	N
319	Events data processor on next stop.	Debug	N	N
320	Performance counter data processer start.	Debug	N	N
321	Performance counter data processer stop.	Debug	N	N
322	Performance counter data processor failed.	Debug	N	N
323	Performance counter data processor on next start.	Debug	N	N
324	Performance counter data processor on next stop.	Debug	N	N
325	Services data processer start.	Debug	N	N
326	Services data processer stop.	Debug	N	N
327	Services data processor failed.	Debug	N	N
328	Services data processor on next start.	Debug	N	N
329	Services data processor on next stop.	Debug	N	N
330	Servers tile view update start.	Debug	N	N
331	Servers tile view update stop.	Debug	N	N
332	Features tile view update start.	Debug	N	N
333	Features tile view update stop.	Debug	N	N
334	BPA tile view update start.	Debug	N	N
335	BPA tile view update stop.	Debug	N	N
336	Events tile view update start.	Debug	N	N
337	Events tile view update stop.	Debug	N	N
338	Performance tile view update start.	Debug	N	N
339	Performance tile view update stop.	Debug	N	N
340	Services tile view update start.	Debug	N	N
341	Services tile view update stop.	Debug	N	N
342	Servers thumbnail view update start.	Debug	N	N
343	Servers thumbnail view update stop.	Debug	N	N
344	Timestamp thumbnail view update start.	Debug	N	N
345	Timestamp thumbnail view update stop.	Debug	N	N
346	BPA thumbnail view update start.	Debug	N	N
347	BPA thumbnail view update stop.	Debug	N	N
348	Events thumbnail view update start.	Debug	N	N
349	Events thumbnail view update stop.	Debug	N	N
350	Performance thumbnail view update start.	Debug	N	N
351	Performance thumbnail view update stop.	Debug	N	N
352	Services thumbnail view update start.	Debug	N	N
353	Services thumbnail view update stop.	Debug	N	N
354	Manageability thumbnail view update start.	Debug	N	N
355	Manageability thumbnail view update stop.	Debug	N	N
356	Async job creation started.	Operational	Y	N
2000	Deployment Wizard is launched.	Operational	Y	N
2001	Deployment Wizard is closed.	Operational	Y	N
2002	Deployment Wizard repository loading start.	Operational	Y	N
2003	Deployment Wizard repository loading completed.	Operational	Y	N
2004	Deployment Wizard repository loading completed and repository is empty.	Operational	N	N
2005	Deployment Wizard installation type changed.	Operational	N	N
2006	Deployment Wizard component selected.	Operational	Y	N
2007	Deployment Wizard component unselected.	Operational	Y	N
2008	Deployment Wizard component selection cancelled through dependency dialog.	Operational	N	N
2009	Deployment Wizard target server collection has changed.	Operational	Y	N
2010	Deployment Wizard page enter.	Operational	Y	N
2011	Deployment Wizard page exit.	Operational	Y	N
2012	Deployment Wizard cancel requested.	Operational	N	N
2013	Deployment Wizard commit action started.	Operational	Y	N
2014	Deployment Wizard commit action completed.	Operational	Y	N
2015	Deployment Wizard component selection step completed.	Operational	Y	N
2016	Deployment Wizard component unselection completed.	Operational	Y	N
2100	Deployment plugin loading started.	Operational	Y	N
2101	Deployment plugin loading completed.	Operational	Y	N
2102	Deployment component pages added.	Operational	Y	N
2103	Deployment component pages removed.	Operational	Y	N
2105	Deployment configuration data export started.	Operational	N	N
2106	Deployment configuration data export completed.	Operational	N	N
2107	Pre-requisite check started for component with ComponentId: componentId.	Operational	N	N
2108	Pre-requisite check completed for component with ComponentId: roleId, Status: …	Operational	N	N
2109	Pre-uninstall step started for component with ComponentId: componentId.	Operational	N	N
2110	Pre-uninstall step completed for component with ComponentId: roleId, Status: …	Operational	N	N
4000	Add-_InternalWindowsRole workflow entered.	Operational	Y	N
4001	Add-_InternalWindowsRole workflow ended, TargetComputer:targetComputer, …	Operational	Y	N
4002	Add-_InternalWindowsRole workflow reported an error installing or removing the …	Operational	N	N
4010	Add-_InternalWindowsRole workflow launching install/remove operation.	Debug	N	N
4011	Add-_InternalWindowsRole workflow launched install/remove operation, …	Debug	N	N
4012	Add-_InternalWindowsRole workflow polling for completion.	Debug	N	N
4013	Add-_InternalWindowsRole workflow polled for completion, …	Debug	N	N
4020	Add-_InternalWindowsRole workflow has determined that the target computer should …	Debug	N	N
4021	Add-_InternalWindowsRole workflow has determined that the target computer should …	Debug	N	N
4022	Add-_InternalWindowsRole workflow is requesting restart of the target computer.	Debug	N	N
4023	Add-_InternalWindowsRole workflow has requested restart of the target computer.	Debug	N	N
4024	Add-_InternalWindowsRole workflow failed to restart the target computer within …	Debug	N	N
9000	Get-WindowsFeature cmdlet started.	Operational	Y	N
9001	Get-WindowsFeature cmdlet ended, Guid: requestGuid, Components: …	Operational	Y	N
9002	GetServerComponent method started.	Debug	N	N
9003	GetServerComponent method ended with Success.	Debug	N	N
9004	GetServerComponent method returned InProgress.	Debug	N	N
9005	GetServerComponent method returned Failed.	Debug	N	N
9006	GetEnumerationState method started.	Debug	N	N
9007	GetEnumerationState method ended with Success.	Debug	N	N
9008	GetEnumerationState method returned InProgress.	Debug	N	N
9009	GetEnumerationState method returned Failed.	Debug	N	N
9010	Get Windows feature failed with Error: message.	Operational	Y	N
9011	Component message1 has invalid state currentRoleId.	Operational	N	N
9012	Component message1 has state currentRoleId.	Operational	Y	N
9100	Add-WindowsFeature cmdlet started.	Operational	Y	N
9101	Add-WindowsFeature cmdlet ended.	Operational	Y	N
9102	AddServerComponent method started.	Debug	N	N
9103	AddServerComponent method ended with Success.	Debug	N	N
9104	AddServerComponent method returned InProgress.	Debug	N	N
9105	AddServerComponent method returned Failed.	Debug	N	N
9106	GetAlterationState method for Add-WindowsFeature started.	Debug	N	N
9107	GetAlterationState method for Add-WindowsFeature ended.	Debug	N	N
9108	GetAlterationState method for Add-WindowsFeature returned InProgress.	Debug	N	N
9109	GetAlterationState method for Add-WindowsFeature returned Failed.	Debug	N	N
9110	Mutual Exclusion conflict detected during add.	Operational	N	N
9200	Remove-WindowsFeature cmdlet started.	Operational	N	N
9201	Remove-WindowsFeature cmdlet ended.	Operational	Y	N
9202	RemoveServerComponent method started.	Debug	N	N
9203	RemoveServerComponent method ended with Success.	Debug	N	N
9204	RemoveServerComponent method returned InProgress.	Debug	N	N
9205	RemoveServerComponent method returned Failed.	Debug	N	N
9206	GetAlterationState method for Remove-WindowsFeature started.	Debug	N	N
9207	GetAlterationState method for Remove-WindowsFeature ended.	Debug	N	N
9208	GetAlterationState method for Remove-WindowsFeature returned InProgress.	Debug	N	N
9209	GetAlterationState method for Remove-WindowsFeature returned Failed.	Debug	N	N
9210	Remove Windows feature failed with Error: message.	Operational	N	N
9211	Add Windows feature failed with Error: message.	Operational	N	N
9301	message.	Debug	N	N

Event ID 0: Refresh scheduler started.

Channel: Operational
Task: Servermanagerrefreshtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 0,
    "version": 0,
    "level": 0,
    "task": 0,
    "opcode": 0,
    "keywords": 0,
    "time_created": "2022-04-07T17:06:29.351679+00:00",
    "event_record_id": 174,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-F886-7BDD9E4AD801",
      "RelatedActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 1: Refresh scheduler stopped.

Channel: Operational
Task: Servermanagerrefreshtask.

Event ID 2: Start of filtering out in-progress refresh.

Channel: Debug
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`Category` UnicodeString
`Machines` UnicodeString

Event ID 3: End of filtering out in-progress refresh.

Channel: Debug
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`Category` UnicodeString
`Machines` UnicodeString

Event ID 4: Short circuit refresh.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:14:07.080861+00:00",
    "event_record_id": 370,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-47B6-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 5: Start of triggering refresh job.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Start of triggering refresh job. Server: MachineName. Job: JobName.

Message #

Start of triggering refresh job. Server: %1. Job: %2.

Fields #

Name	Description
`MachineName` UnicodeString
`JobName` UnicodeString

Event ID 6: End of triggering refresh job.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

End of triggering refresh job. Server: MachineName. Job: JobName.

Message #

End of triggering refresh job. Server: %1. Job: %2.

Fields #

Name	Description
`MachineName` UnicodeString
`JobName` UnicodeString

Event ID 7: Error received from refresh job.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 8: Child job completed.

Channel: Operational
Level: Informational
Task: Automationjobexecution.
Opcode: Start

Description

Child job completed. Command: Command, Target: Target, State: State, Proxy Instance ID: ID.

Message #

Child job completed. Command: %2, Target: %3, State: %4, Proxy Instance ID: %1

Fields #

Name	Description
`ID` GUID
`Command` UnicodeString
`Target` UnicodeString
`State` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 8,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:43.025255+00:00",
    "event_record_id": 687,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 940
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ID": "E829D96F-C50A-47DE-A1F2-3823DF71237B",
    "Command": "ServerManagerShell\\Invoke-_InternalServiceMethod",
    "Target": "localhost",
    "State": "Completed"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 9: Parent job completed.

Channel: Operational
Level: Informational
Task: Automationjobexecution.
Opcode: Start

Description

Parent job completed. Command: Command, Target: Target, State: State, Proxy Instance ID: ID.

Message #

Parent job completed. Command: %2, Target: %3, State: %4, Proxy Instance ID: %1

Fields #

Name	Description
`ID` GUID
`Command` UnicodeString
`Target` UnicodeString
`State` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:43.028446+00:00",
    "event_record_id": 688,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4924
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ID": "97DEB445-282E-4B54-9C43-57E30F4270F5",
    "Command": "ServerManagerShell\\Invoke-_InternalServiceMethod",
    "Target": "localhost",
    "State": "Completed"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 10: Start of request for refresh.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Start of request for refresh. Source: RefreshTriggerSource. Categories: Category. Servers: Machines. Session: ID.

Message #

Start of request for refresh. Source: %1. Categories: %2. Servers: %3. Session: %4

Fields #

Name	Description
`RefreshTriggerSource` UnicodeString
`Category` UnicodeString
`Machines` UnicodeString
`ID` GUID

Event ID 11: End of request for refresh.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

End of request for refresh. Source: RefreshTriggerSource. Categories: Category. Servers: Machines. Session: ID.

Message #

End of request for refresh. Source: %1. Categories: %2. Servers: %3. Session: %4

Fields #

Name	Description
`RefreshTriggerSource` UnicodeString
`Category` UnicodeString
`Machines` UnicodeString
`ID` GUID

Event ID 12: Task 'TaskName' execution started.

Channel: Debug
Task: Servermanagerrefreshtask.

Message #

Task '%1' execution started.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 13: Task 'TaskName' execution completed.

Channel: Debug
Task: Servermanagerrefreshtask.

Message #

Task '%1' execution completed.

Fields #

Name	Description
`TaskName` UnicodeString

Event ID 14: Error during processing data.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 15: Start of decoding BPA results.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 16: End of decoding BPA results.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 17: Error during decoding of BPA results.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 18: Start of updating Bpa result records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 19: End of updating Bpa result records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 20: Short circuting of updating of Bpa result records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 21: Error during updating of Bpa result records.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 22: Triggered Bpa results updated event.

Channel: Debug
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 23: Start of decoding service statuses.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 24: End of decoding service statuses.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 25: Error during decoding of service statuses.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 26: Start of updating services records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 27: End of updating services records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 28: Short circuting of updating of services records.

Channel: Debug
Task: Servermanagerrefreshtask.

Event ID 29: Error during updating of services records.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 30: Triggered services updated event.

Channel: Debug
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 31: Plugin load started for Role Id roleId.

Channel: Operational
Level: Informational
Task: Therolepluginloadtask.
Opcode: Start

Message #

Plugin load started for Role Id %1.

Fields #

Name	Description
`roleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "{D8D37081-10BD-4A89-A971-1CDA6899BDB3}",
    "event_source_name": "",
    "event_id": 31,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2026-06-13T13:40:28.2399161+00:00",
    "event_record_id": 12632,
    "correlation": {
      "ActivityID": "{AA49AB17-FAF4-0003-35D0-4BAAF4FADC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 1144
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "roleId": "18"
  },
  "message": "Plugin load started for Role Id 18."
}

Event ID 32: Plugin load stopped for Role Id roleId.

Channel: Operational
Level: Informational
Task: Therolepluginloadtask.
Opcode: Stop

Message #

Plugin load stopped for Role Id %1.

Fields #

Name	Description
`roleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "{D8D37081-10BD-4A89-A971-1CDA6899BDB3}",
    "event_source_name": "",
    "event_id": 32,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2026-06-13T13:40:28.2407439+00:00",
    "event_record_id": 12633,
    "correlation": {
      "ActivityID": "{AA49AB17-FAF4-0003-35D0-4BAAF4FADC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 6124
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "roleId": "18"
  },
  "message": "Plugin load stopped for Role Id 18."
}

Event ID 33: Plugin load failed for Role Id roleId.

Channel: Operational
Task: Therolepluginloadtask.

Description

Plugin load failed for Role Id roleId. Message.

Message #

Plugin load failed for Role Id %1. %2

Fields #

Name	Description
`roleId` Int32
`Message` UnicodeString

Event ID 34: Plugin unload started for Role Id roleId.

Channel: Operational
Level: Informational
Task: Therolepluginunloadtask.
Opcode: Start

Message #

Plugin unload started for Role Id %1.

Fields #

Name	Description
`roleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 34,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:38:13.298689+00:00",
    "event_record_id": 514,
    "correlation": {},
    "execution": {
      "process_id": 5300,
      "thread_id": 5256
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "roleId": 481
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 35: Plugin unload stopped for Role Id roleId.

Channel: Operational
Task: Therolepluginunloadtask.
Opcode: Start

Message #

Plugin unload stopped for Role Id %1.

Fields #

Name	Description
`roleId` Int32

Event ID 36: Plugin unload failed for Role Id roleId.

Channel: Operational
Task: Therolepluginunloadtask.

Description

Plugin unload failed for Role Id roleId. Message.

Message #

Plugin unload failed for Role Id %1. %2

Fields #

Name	Description
`roleId` Int32
`Message` UnicodeString

Event ID 37: Plugin registration information is loaded.

Channel: Operational
Level: Informational
Task: TherolepluginRegistrationinformationloadtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "{D8D37081-10BD-4A89-A971-1CDA6899BDB3}",
    "event_source_name": "",
    "event_id": 37,
    "version": 0,
    "level": 4,
    "task": 3,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-06-13T13:40:28.2399081+00:00",
    "event_record_id": 12631,
    "correlation": {
      "ActivityID": "{AA49AB17-FAF4-0003-35D0-4BAAF4FADC01}"
    },
    "execution": {
      "process_id": 3824,
      "thread_id": 1144
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {},
  "message": "Plugin registration information is loaded."
}

Event ID 38: Plugin registration information failed to load.

Channel: Debug
Task: TherolepluginRegistrationinformationloadtask.

Description

Plugin registration information failed to load. Error: message.

Message #

Plugin registration information failed to load. Error: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 39: ARW launch command started.

Channel: Operational
Level: Informational
Task: Thecommandexecutiontask.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 39,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:14.456573+00:00",
    "event_record_id": 78,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-737B-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 40: ARW launch command completed.

Channel: Operational
Level: Informational
Task: Thecommandexecutiontask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 40,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:14.691796+00:00",
    "event_record_id": 86,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-737B-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 41: Add server command started.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Start

Event ID 42: Add server command completed.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Stop

Event ID 43: The requested server machineName is already added.

Channel: Operational
Task: Thecommandexecutiontask.

Message #

The requested server %1 is already added.

Fields #

Name	Description
`machineName` UnicodeString
`errorMessage` UnicodeString

Event ID 44: Add server command failed while adding server machineName, failure: errorMessage.

Channel: Operational
Task: Thecommandexecutiontask.

Message #

Add server command failed while adding server %1, failure: %2

Fields #

Name	Description
`machineName` UnicodeString
`errorMessage` UnicodeString

Event ID 45: Full refresh command started.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Start

Event ID 46: Full refresh command completed.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Stop

Event ID 47: Started initializing service provider.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 47,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:58:09.017503+00:00",
    "event_record_id": 517,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 48: Completed initializing service provider.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 48,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:58:09.029982+00:00",
    "event_record_id": 518,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 49: Boot loader started.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 49,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:58:09.083883+00:00",
    "event_record_id": 519,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 50: Boot loader completed.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 50,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:58:23.552622+00:00",
    "event_record_id": 527,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4124
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 51: Boot loader can't find the service provider list, Error: errorMessage.

Channel: Operational
Task: Servermanagerstartuptask.

Message #

Boot loader can't find the service provider list, Error: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 52: Failed to load user settings, Error: errorMessage.

Channel: Operational
Task: Loadsettingstask.
Opcode: Stop

Message #

Failed to load user settings, Error: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 53: Main window initialized.

Channel: Operational
Level: Informational
Task: Servermanagerinitializationtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 53,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 2306124484190404608,
    "time_created": "2022-04-07T16:58:20.988934+00:00",
    "event_record_id": 522,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 54: Main window initialization failed, Error: errorMessage.

Channel: Operational
Task: Servermanagerinitializationtask.

Message #

Main window initialization failed, Error: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 55: Failed to change the navigation item navigationItemName of type navigationItemType, attached descriptor: associatedViewDescriptorType.

Channel: Operational
Task: Navigationtask.

Message #

Failed to change the navigation item %1 of type %2, attached descriptor: %3

Fields #

Name	Description
`navigationItemName` UnicodeString
`navigationItemType` UnicodeString
`associatedViewDescriptorType` UnicodeString

Event ID 56: Navigation service selection changed.

Channel: Operational
Task: Navigationtask.

Description

Navigation service selection changed. New item: newNavigationItem.

Message #

Navigation service selection changed. New item: %1

Fields #

Name	Description
`newNavigationItem` UnicodeString

Event ID 57: Server manager started

Channel: Operational
Task: Servermanagerstartuptask.

Event ID 58: Server manager shutdown started

Channel: Operational
Level: Informational
Task: Servermanagershutdowntask

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 58,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:38:13.257143+00:00",
    "event_record_id": 509,
    "correlation": {},
    "execution": {
      "process_id": 5300,
      "thread_id": 5388
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 59: Server manager shutdown failure: errorMessage.

Channel: Operational
Task: Servermanagershutdowntask

Message #

Server manager shutdown failure: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 60: Saving server list failure: errorMessage.

Channel: Operational
Task: Loadsettingstask.

Message #

Saving server list failure: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 61: Server manager automation shutdown failure: errorMessage.

Channel: Operational
Task: Servermanagershutdowntask

Message #

Server manager automation shutdown failure: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 62: Server manager plugin manager shutdown failure: errorMessage.

Channel: Operational
Task: Servermanagershutdowntask

Message #

Server manager plugin manager shutdown failure: %1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 63: Server manager exception.

Channel: Operational
Task: Servermanagerexceptiontask.

Description

Server manager exception. Source: source. Exception: exception.

Message #

Server manager exception. Source: %1. Exception: %2

Fields #

Name	Description
`source` UnicodeString
`exception` UnicodeString

Event ID 64: Start of decoding performance counter threshold alerts results.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 65: Stop of decoding performance counter threshold alerts results.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 66: Error during decoding performance counter threshold alerts results.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 67: Start of data update to performance counter threshold alert data.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 68: Stop of data update to performance counter threshold alert data.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 69: Error during data update to performance counter threshold alert data.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 70: Triggered performance counter threshold alert data results updated event.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 71: Start of decoding performance counter samples results.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 72: Stop of decoding performance counter samples results.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 73: Error during decoding performance counter samples results.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 74: Start of data update to performance counter sample data.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 75: Stop of data update to performance counter sample data.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 76: Error during data update to performance counter sample data.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 77: Triggered performance counter sample data results updated event.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 78: Start job of diagnostics data collect (process snapshots).

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 79: Stop job of diagnostics data collect (process snapshots).

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 80: Error in a job of diagnostics data collect (process snapshots).

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 81: Start of data update to diagnostics data (process snapshots).

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 82: Stop of data update to diagnostics data (process snapshots).

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 83: Error during data update to diagnostics data (process snapshots).

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 84: Start of time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 85: Stop of time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 86: Error during time change filter.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 87: Start job of time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 88: Stop job of time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 89: Error in a job of time change filter.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 90: Start of data update for time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 91: Stop of data update for time change filter.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 92: Error during data update for time change filter.

Channel: Operational
Task: Servermanagerrefreshtask.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 93: Job refresh error.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Job refresh error. Server name: server. Job name: job. Exception: exception.

Message #

Job refresh error. Server name: %1. Job name: %2. Exception: %3

Fields #

Name	Description
`server` UnicodeString
`job` UnicodeString
`exception` UnicodeString

Event ID 94: Splash screen started.

Channel: Operational
Level: Informational
Task: Servermanagerinitializationtask.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 94,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 1,
    "keywords": 2306124484190404608,
    "time_created": "2022-04-07T16:58:06.733119+00:00",
    "event_record_id": 516,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 95: Splash screen stopped.

Channel: Operational
Level: Informational
Task: Servermanagerinitializationtask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 95,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T16:58:15.307676+00:00",
    "event_record_id": 521,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 96: Server list loading failed.

Channel: Operational
Task: Loadsettingstask.
Opcode: Stop

Event ID 97: Server manager shutdown stopped.

Channel: Operational
Level: Informational
Task: Servermanagershutdowntask

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 97,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:38:13.358492+00:00",
    "event_record_id": 515,
    "correlation": {},
    "execution": {
      "process_id": 5300,
      "thread_id": 5388
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 98: User settings save started.

Channel: Operational
Level: Informational
Task: Loadsettingstask.
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 98,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:38:13.280535+00:00",
    "event_record_id": 510,
    "correlation": {},
    "execution": {
      "process_id": 5300,
      "thread_id": 5256
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 99: User settings save stopped.

Channel: Operational
Level: Informational
Task: Loadsettingstask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 99,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T08:38:13.293162+00:00",
    "event_record_id": 511,
    "correlation": {},
    "execution": {
      "process_id": 5300,
      "thread_id": 5256
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 100: Automation job history.

Channel: Debug
Task: Automationjobexecution.

Description

Automation job history. Server = Target. Job = JobName. TimeElapsed = TimeElapsed.

Message #

Automation job history. Server = %1. Job = %3. TimeElapsed = %4

Fields #

Name	Description
`Target` UnicodeString
`JobID` GUID
`JobName` UnicodeString
`TimeElapsed` UnicodeString
`History` UnicodeString

Event ID 101: Automation job history.

Channel: Debug
Task: Automationjobexecution.

Description

Automation job history. Server = Target. Job = JobName. TimeElapsed = TimeElapsed. Error = Exception.

Message #

Automation job history. Server = %1. Job = %3. TimeElapsed = %4. Error = %6

Fields #

Name	Description
`Target` UnicodeString
`JobID` GUID
`JobName` UnicodeString
`TimeElapsed` UnicodeString
`History` UnicodeString
`Exception` UnicodeString

Event ID 102: Group of inventory refresh jobs has finished.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Group of inventory refresh jobs has finished. Session: ID.

Message #

Group of inventory refresh jobs has finished. Session: %4

Fields #

Name	Description
`RefreshTriggerSource` UnicodeString
`Category` UnicodeString
`Machines` UnicodeString
`ID` GUID

Event ID 103: Error encountered while attempting to load an advanced tool: ErrorMessage.

Channel: Debug
Task: Servermanagerstartuptask.

Message #

Error encountered while attempting to load an advanced tool: %1

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 104: DataStore persistence: starting load

Channel: Debug
Task: Servermanagerstartuptask.

Event ID 105: DataStore persistence: load error ErrorMessage.

Channel: Operational
Task: Servermanagerstartuptask.

Message #

DataStore persistence: load error %1

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 106: DataStore persistence: load finished

Channel: Debug
Task: Servermanagerstartuptask.

Event ID 107: DataStore persistence: starting save

Channel: Debug
Task: Servermanagershutdowntask

Event ID 108: DataStore persistence: save error: ErrorMessage.

Channel: Operational
Task: Servermanagerstartuptask.

Message #

DataStore persistence: save error: %1

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 109: DataStore persistence: save finished

Channel: Debug
Task: Servermanagerstartuptask.

Event ID 110: Inventory data update failed.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Inventory data update failed. MachineName.

Message #

Inventory data update failed. %1.

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 111: Launched BPA scan on machine MachineName, BPA Model Ids JobName.

Channel: Operational
Task: Automationjobexecution.

Message #

Launched BPA scan on machine %1, BPA Model Ids %2

Fields #

Name	Description
`MachineName` UnicodeString
`JobName` UnicodeString

Event ID 112: Bpa Scan launch failed for server MachineName, error: Error.

Channel: Operational
Task: Automationjobexecution.

Message #

Bpa Scan launch failed for server %1, error: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 113: Start of enable job of performance counter collector.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Start

Event ID 114: Stop of enable job of performance counter collector.

Channel: Debug
Task: Servermanagerrefreshtask.
Opcode: Stop

Event ID 115: Failed enabling of performance counter collector.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Failed enabling of performance counter collector. ErrorMessage.

Message #

Failed enabling of performance counter collector. %1.

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 116: Bpa include or exclude launch failed for server MachineName, error: Error.

Channel: Operational
Task: Automationjobexecution.

Message #

Bpa include or exclude launch failed for server %1, error: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 117: Error while launching command 'MachineName' : Error.

Channel: Operational
Task: Thecommandexecutiontask.

Message #

Error while launching command '%1' : %2

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 118: Failed to close the post deployment configuration task.

Channel: Operational
Task: Postdeploymentconfigurationtask.

Description

Failed to close the post deployment configuration task. Task, Stack: Error.

Message #

Failed to close the post deployment configuration task. %1, Stack: %2

Fields #

Name	Description
`Task` UnicodeString
`Error` UnicodeString

Event ID 119: Created the post deployment task.

Channel: Operational
Task: Postdeploymentconfigurationtask.

Description

Created the post deployment task. Description. Source=Source.

Message #

Created the post deployment task. %1. Source=%2

Fields #

Name	Description
`Description` UnicodeString
`Source` UnicodeString

Event ID 120: Completed the post deployment task.

Channel: Operational
Level: Informational
Task: Postdeploymentconfigurationtask.

Description

Completed the post deployment task. Description. Source=Source.

Message #

Completed the post deployment task. %1. Source=%2

Fields #

Name	Description
`Description` UnicodeString
`Source` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 120,
    "version": 0,
    "level": 4,
    "task": 13,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:17.045456+00:00",
    "event_record_id": 181,
    "correlation": {
      "ActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "Description": "Additional steps are required to make this machine a domain controller.",
    "Source": "Wizard"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 121: Failed to create the post deployment configuration task.

Channel: Operational
Task: Postdeploymentconfigurationtask.

Description

Failed to create the post deployment configuration task. Id: RoleId, Server: Server, Source: Source, Message: Message.

Message #

Failed to create the post deployment configuration task. Id: %1, Server: %2, Source: %3, Message: %4

Fields #

Name	Description
`RoleId` Int32
`Server` UnicodeString
`Source` UnicodeString
`Message` UnicodeString

Event ID 122: Unknown type of failure to refresh data.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Unknown type of failure to refresh data. Server: MachineName. MessageID: MessageId. Message: Message.

Message #

Unknown type of failure to refresh data. Server: %1. MessageID: %2. Message: %3

Fields #

Name	Description
`MachineName` UnicodeString
`MessageId` UnicodeString
`Message` UnicodeString

Event ID 123: Roles and features discovered on ServerName: Features.

Channel: Operational
Task: Servermanagerrefreshtask.

Message #

Roles and features discovered on %1: %2

Fields #

Name	Description
`ServerName` UnicodeString
`Features` UnicodeString

Event ID 124: Roles and features requiring configuration on ServerName: Features.

Channel: Operational
Task: Servermanagerrefreshtask.

Message #

Roles and features requiring configuration on %1: %2

Fields #

Name	Description
`ServerName` UnicodeString
`Features` UnicodeString

Event ID 125: Skipping Server Manager auto refresh.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Skipping Server Manager auto refresh. The desktop is not active.

Message #

Skipping Server Manager auto refresh. The desktop is not active.

Event ID 126: Skipping loading the navigation item for a plugin that is not initialized.

Channel: Operational
Task: Therolepluginloadtask.

Description

Skipping loading the navigation item for a plugin that is not initialized. Role: roleId. Status: Status.

Message #

Skipping loading the navigation item for a plugin that is not initialized. Role: %1. Status: %2

Fields #

Name	Description
`roleId` Int32
`Status` UnicodeString	NTSTATUS reference

Event ID 127: Shell plugin icon not found.

Channel: Operational
Task: Therolepluginloadtask.

Description

Shell plugin icon not found. Role: roleId. Icon: Icon.

Message #

Shell plugin icon not found. Role: %1. Icon: %2

Fields #

Name	Description
`roleId` Int32
`Icon` UnicodeString

Event ID 128: Parent role not found.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Parent role not found. Server: serverName. Feature ID: currentRoleId. Role ID: parentRoleId.

Message #

Parent role not found. Server: %1. Feature ID: %2. Role ID: %3.

Fields #

Name	Description
`serverName` UnicodeString
`currentRoleId` Int32
`parentRoleId` Int32

Event ID 129: String pool has been scanned.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

String pool has been scanned. Total: totalCount, Removed: removedCount, Elapsed: elapsedTime.

Message #

String pool has been scanned. Total: %1, Removed: %2, Elapsed: %3.

Fields #

Name	Description
`totalCount` Int32
`removedCount` Int32
`elapsedTime` UnicodeString

Event ID 130: Automation job query started.

Channel: Operational
Task: Loadpersistedautomationjobs.

Description

Automation job query started. Owner: Owner.

Message #

Automation job query started. Owner: %1

Fields #

Name	Description
`Owner` UnicodeString

Event ID 131: Automation job query result.

Channel: Operational
Task: Loadpersistedautomationjobs.

Description

Automation job query result. Owner: Owner. Job count: Count.

Message #

Automation job query result. Owner: %1. Job count: %2

Fields #

Name	Description
`Owner` UnicodeString
`Count` Int32

Event ID 132: Automation job query completed.

Channel: Operational
Task: Loadpersistedautomationjobs.

Description

Automation job query completed. Owner: Owner. Error: Error.

Message #

Automation job query completed. Owner: %1. Error: %2

Fields #

Name	Description
`Owner` UnicodeString
`Error` UnicodeString

Event ID 133: Automation job created.

Channel: Operational
Level: Informational
Task: Automationjobexecution.

Description

Automation job created. Owner: Owner, Command: Command, Target: Target, Tracked: Tracked. Rehydrated: Rehydrated.

Message #

Automation job created. Owner: %1, Command: %2, Target: %3, Tracked: %4. Rehydrated: %5.

Fields #

Name	Description
`Owner` UnicodeString
`Command` UnicodeString
`Target` UnicodeString
`Tracked` Boolean
`Rehydrated` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 133,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:40.297165+00:00",
    "event_record_id": 685,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-ADEC-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4100
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "Owner": "ServerManager",
    "Command": "ServerManagerShell\\Invoke-_InternalServiceMethod",
    "Target": "",
    "Tracked": true,
    "Rehydrated": false
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 134: Automation job creation failed with error: ErrorMessage.

Channel: Operational
Task: Automationjobexecution.

Message #

Automation job creation failed with error: %1

Fields #

Name	Description
`ErrorMessage` UnicodeString

Event ID 135: Exception reported to refresh data.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Exception reported to refresh data. Server: MachineName. MessageID: MessageId. Message: Message.

Message #

Exception reported to refresh data. Server: %1. MessageID: %2. Message: %3

Fields #

Name	Description
`MachineName` UnicodeString
`MessageId` UnicodeString
`Message` UnicodeString

Event ID 136: Exception reported to data collection.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Description

Exception reported to data collection. Server: MachineName. OperationName: OperationName. MessageID: MessageId. Message: Message.

Message #

Exception reported to data collection. Server: %1. OperationName: %2. MessageID: %3. Message: %4

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString
`MessageId` UnicodeString
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 136,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-04T11:01:44.968878+00:00",
    "event_record_id": 1087,
    "correlation": {
      "ActivityID": "748EA6BB-2722-4FDA-B8B7-DA861FFC7DC8"
    },
    "execution": {
      "process_id": 3156,
      "thread_id": 5064
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-21-1958040314-2592322477-2606035944-500"
    }
  },
  "event_data": {
    "MachineName": "WIN-TKC15D7KHUR",
    "OperationName": "GetServerEventDetail",
    "MessageId": "(None)",
    "Message": "Events from 'WebServer.Events.xml' could not be enumerated.\r\n"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 150: Automation job started.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job started. Command: Command, Target: Target, Guid: ID.

Message #

Automation job started. Command: %2, Target: %3, Guid: %1

Fields #

Name	Description
`ID` GUID
`Command` UnicodeString
`Target` UnicodeString

Event ID 151: Automation job state changed.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job state changed. Command: Command, Target: Target, State: State, Guid: ID.

Message #

Automation job state changed. Command: %2, Target: %3, State: %4, Guid: %1

Fields #

Name	Description
`ID` GUID
`Command` UnicodeString
`Target` UnicodeString
`State` UnicodeString

Event ID 152: Automation job error data added.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job error data added. Error: Message, Command: Command, Target: Target, ID: ID, Parent: ParentID, Message: Action, Action: Exception, Exception: ErrorId.

Message #

Automation job error data added. Error: %6, Command: %3, Target: %4, ID: %1, Parent: %2, Message: %7, Action: %8, Exception: %5

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString
`ErrorId` UnicodeString
`Message` UnicodeString
`Action` UnicodeString
`Exception` UnicodeString

Event ID 153: Automation job output data added.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job output data added. Command: Command, Target: Target, ID: ID, Parent; ParentID.

Message #

Automation job output data added. Command: %3, Target: %4, ID: %1, Parent; %2

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString

Event ID 154: Automation job progress data added.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job progress data added. Percent complete: PercentComplete, Command: Command, Target: Target, ID: ID, Parent: ParentID.

Message #

Automation job progress data added. Percent complete: %5, Command: %3, Target: %4, ID: %1, Parent: %2

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString
`PercentComplete` Int32

Event ID 155: Automation job error data added.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Automation job error data added. Warning: Message, Command: Command, Target: Target, ID: ID, Parent: ParentID.

Message #

Automation job error data added. Warning: %5, Command: %3, Target: %4, ID: %1, Parent: %2

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString
`Message` UnicodeString

Event ID 156: Data processing time.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Data processing time. Command: Command, Milliseconds: Milliseconds, Target: Target, ID: ID, Parent; ParentID.

Message #

Data processing time. Command: %3, Milliseconds: %5, Target: %4, ID: %1, Parent; %2

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString
`Milliseconds` Int32

Event ID 157: Lengthy data processing time.

Channel: Debug
Task: Automationjobexecution.
Opcode: Start

Description

Lengthy data processing time. Command: Command, Milliseconds: Milliseconds, Target: Target, ID: ID, Parent; ParentID.

Message #

Lengthy data processing time. Command: %3, Milliseconds: %5, Target: %4, ID: %1, Parent; %2

Fields #

Name	Description
`ID` GUID
`ParentID` GUID
`Command` UnicodeString
`Target` UnicodeString
`Milliseconds` Int32

Event ID 160: Error setting main window focus with the handle.

Channel: Operational
Task: Servermanagerstartuptask.

Description

Error setting main window focus with the handle. exception.

Message #

Error setting main window focus with the handle. %1

Fields #

Name	Description
`exception` UnicodeString

Event ID 161: Error writing the window handle.

Channel: Operational
Task: Servermanagerstartuptask.

Description

Error writing the window handle. exception.

Message #

Error writing the window handle. %1

Fields #

Name	Description
`exception` UnicodeString

Event ID 162: File mapping initialization failed.

Channel: Operational
Task: Servermanagerstartuptask.

Description

File mapping initialization failed. errorCode.

Message #

File mapping initialization failed. %1

Fields #

Name	Description
`errorCode` Int32

Event ID 163: Error shutting down the kernel service.

Channel: Operational
Task: Servermanagershutdowntask

Description

Error shutting down the kernel service. exception.

Message #

Error shutting down the kernel service. %1

Fields #

Name	Description
`exception` UnicodeString

Event ID 164: CEIP/WER launch command started.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Start

Event ID 165: CEIP/WER launch command completed.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Stop

Event ID 166: CEIP/WER plugin load started.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Start

Event ID 167: CEIP/WER plugin load completed.

Channel: Operational
Task: Thecommandexecutiontask.
Opcode: Stop

Event ID 168: Connection to M3P starting.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 168,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:29.048530+00:00",
    "event_record_id": 676,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-77EB-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4780
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 169: Connection to M3P completed.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 169,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 2,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:31.700287+00:00",
    "event_record_id": 679,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4780
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 170: Credentials set for connections to machines: Targets.

Channel: Operational
Task: Loadsettingstask.

Description

Credentials set for connections to machines: Targets. User name = UserName.

Message #

Credentials set for connections to machines: %1. User name = %2

Fields #

Name	Description
`Targets` UnicodeString
`UserName` UnicodeString

Event ID 171: Refresh session started.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Description

Refresh session started. Source: RefreshTriggerSource. Categories: Category. Servers: Machines. Id: ID.

Message #

Refresh session started. Source: %1. Categories: %2. Servers: %3. Id: %4

Fields #

Name	Description
`RefreshTriggerSource` UnicodeString
`Category` UnicodeString
`Machines` UnicodeString
`ID` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 171,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:23.580114+00:00",
    "event_record_id": 722,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 2880
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "RefreshTriggerSource": "Scheduler (None, None)",
    "Category": "Inventory",
    "Machines": "WIN-FPV0DSIC9O6.lab.local",
    "ID": "670EEE8B-2C25-447D-AAD4-2FDBE19E5196"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 172: Refresh session completed.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Description

Refresh session completed. Id: ID.

Message #

Refresh session completed. Id: %1

Fields #

Name	Description
`ID` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 172,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.540457+00:00",
    "event_record_id": 753,
    "correlation": {
      "ActivityID": "C9DB0EBB-AD74-4A6D-A36D-C691522795E3"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4868
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ID": "670EEE8B-2C25-447D-AAD4-2FDBE19E5196"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 173: Credentials loaded from the cred store: User name = UserName.

Channel: Operational
Task: Loadsettingstask.

Message #

Credentials loaded from the cred store: User name = %1

Fields #

Name	Description
`UserName` UnicodeString

Event ID 174: Error loading credentials from the cred store.

Channel: Operational
Task: Loadsettingstask.

Description

Error loading credentials from the cred store. User name: UserName. Error: Error.

Message #

Error loading credentials from the cred store. User name: %1. Error: %2

Fields #

Name	Description
`UserName` UnicodeString
`Error` Int32

Event ID 175: Credentials saved to the cred store: User name = UserName.

Channel: Operational
Task: Loadsettingstask.

Message #

Credentials saved to the cred store: User name = %1

Fields #

Name	Description
`UserName` UnicodeString

Event ID 176: Error saving credentials to the cred store.

Channel: Operational
Task: Loadsettingstask.

Description

Error saving credentials to the cred store. User name: UserName. Error: Error.

Message #

Error saving credentials to the cred store. User name: %1. Error: %2

Fields #

Name	Description
`UserName` UnicodeString
`Error` Int32

Event ID 177: Credentials deleted from the cred store: User name = UserName.

Channel: Operational
Task: Loadsettingstask.

Message #

Credentials deleted from the cred store: User name = %1

Fields #

Name	Description
`UserName` UnicodeString

Event ID 178: Error deleting credentials from the cred store.

Channel: Operational
Task: Loadsettingstask.

Description

Error deleting credentials from the cred store. User name: UserName. Error: Error.

Message #

Error deleting credentials from the cred store. User name: %1. Error: %2

Fields #

Name	Description
`UserName` UnicodeString
`Error` Int32

Event ID 179: Local server properties refresh started.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 179,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:11:32.549096+00:00",
    "event_record_id": 613,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 2492
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 180: Local server properties refresh completed.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 180,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:11:34.976833+00:00",
    "event_record_id": 615,
    "correlation": {},
    "execution": {
      "process_id": 4444,
      "thread_id": 2492
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 181: Error accessing local server properties.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Error accessing local server properties. exception.

Message #

Error accessing local server properties. %1

Fields #

Name	Description
`exception` UnicodeString

Event ID 182: Completed services modification job

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 182,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:43.028714+00:00",
    "event_record_id": 689,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-E7EC-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4448
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 183: Launching wizard from automation job started.

Channel: Operational
Task: Loadpersistedautomationjobs.

Description

Launching wizard from automation job started. Command: Command.

Message #

Launching wizard from automation job started. Command: %1

Fields #

Name	Description
`Command` UnicodeString

Event ID 184: Launching wizard from automation job completed.

Channel: Operational
Task: Loadpersistedautomationjobs.

Description

Launching wizard from automation job completed. Command: Command.

Message #

Launching wizard from automation job completed. Command: %1

Fields #

Name	Description
`Command` UnicodeString

Event ID 190: Starting WinRM service status check.

Channel: Operational
Level: Informational
Task: Automationjobexecution.

Description

Starting WinRM service status check. Status: serviceStatus, Exception: exception.

Message #

Starting WinRM service status check. Status: %1, Exception: %2

Fields #

Name	Description
`serviceStatus` UnicodeString
`exception` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 190,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:29.061107+00:00",
    "event_record_id": 677,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-77EB-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4780
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serviceStatus": "Running",
    "exception": "None"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 191: Completed WinRM service status check.

Channel: Operational
Level: Informational
Task: Automationjobexecution.

Description

Completed WinRM service status check. Status: serviceStatus, Exception: exception.

Message #

Completed WinRM service status check. Status: %1, Exception: %2

Fields #

Name	Description
`serviceStatus` UnicodeString
`exception` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 191,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:29.061322+00:00",
    "event_record_id": 678,
    "correlation": {
      "ActivityID": "E0AAB88C-4A9F-0000-77EB-AAE09F4AD801"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4780
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serviceStatus": "Running",
    "exception": "None"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 192: Refresh item completed.

Channel: Operational
Level: Informational
Task: Servermanagerrefreshtask.

Description

Refresh item completed. Server: MachineName, Session Item Count: Count.

Message #

Refresh item completed. Server: %1, Session Item Count: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Count` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 192,
    "version": 0,
    "level": 4,
    "task": 10,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.540265+00:00",
    "event_record_id": 752,
    "correlation": {
      "ActivityID": "C9DB0EBB-AD74-4A6D-A36D-C691522795E3"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4868
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "MachineName": "WIN-FPV0DSIC9O6.lab.local",
    "Count": 1
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 193: Error cleaning up credentials from the cred store.

Channel: Operational
Task: Loadsettingstask.

Description

Error cleaning up credentials from the cred store. Error: errorCode.

Message #

Error cleaning up credentials from the cred store. Error: %1

Fields #

Name	Description
`errorCode` Int32

Event ID 194: Cluster query item added.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Cluster query item added. Server: MachineName, Cluster: ClusterName.

Message #

Cluster query item added. Server: %1, Cluster: %2

Fields #

Name	Description
`MachineName` UnicodeString
`ClusterName` UnicodeString

Event ID 195: Cluster query item data received.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Cluster query item data received. Server: MachineName.

Message #

Cluster query item data received. Server: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 196: New cluster nodes added to session.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

New cluster nodes added to session. Servers: MachineName.

Message #

New cluster nodes added to session. Servers: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 197: Cluster query item completed.

Channel: Operational
Task: Servermanagerrefreshtask.

Description

Cluster query item completed. Server: MachineName, Session Item Count: Count.

Message #

Cluster query item completed. Server: %1, Session Item Count: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Count` Int32

Event ID 200: Refresh item session create started.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item session create started. Server: MachineName.

Message #

Refresh item session create started. Server: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 201: Refresh item session create completed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item session create completed. Server: MachineName, Error: Error.

Message #

Refresh item session create completed. Server: %1, Error: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 202: Refresh item session close started.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item session close started. Server: MachineName.

Message #

Refresh item session close started. Server: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 203: Refresh item session close completed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item session close completed. Server: MachineName, Error: Error.

Message #

Refresh item session close completed. Server: %1, Error: %2

Fields #

Name	Description
`MachineName` UnicodeString
`Error` UnicodeString

Event ID 204: Refresh item invocation started.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item invocation started. Server: MachineName, Method name: OperationName.

Message #

Refresh item invocation started. Server: %1, Method name: %2

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString

Event ID 205: Refresh item enumeration started.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item enumeration started. Server: MachineName, Class name: OperationName.

Message #

Refresh item enumeration started. Server: %1, Class name: %2

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString

Event ID 206: Refresh item data received.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item data received. Server: MachineName, Method or class name: OperationName.

Message #

Refresh item data received. Server: %1, Method or class name: %2

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString

Event ID 207: Refresh item operation completed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item operation completed. Server: MachineName, Method or class name: OperationName.

Message #

Refresh item operation completed. Server: %1, Method or class name: %2

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString

Event ID 208: Refresh item operation error.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Refresh item operation error. Server: MachineName, Method or class name: OperationName, Error: Error.

Message #

Refresh item operation error. Server: %1, Method or class name: %2, Error: %3

Fields #

Name	Description
`MachineName` UnicodeString
`OperationName` UnicodeString
`Error` UnicodeString

Event ID 209: Creating new session.

Channel: Operational
Level: Informational
Task: Nodeaccess.

Description

Creating new session. Server: serverName, Protocol: protocol, User: userName.

Message #

Creating new session. Server: %1, Protocol: %2, User: %3

Fields #

Name	Description
`serverName` UnicodeString
`protocol` UnicodeString
`userName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 209,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.506487+00:00",
    "event_record_id": 746,
    "correlation": {
      "ActivityID": "4ACAA8DE-FAC8-4188-A6B0-EFCD7D7B46CA"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 2632
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "localhost",
    "protocol": "DCOM",
    "userName": "null"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 210: Enumerate instances started.

Channel: Operational
Task: Nodeaccess.

Description

Enumerate instances started. Server: serverName, Namespace: namespaceName, Class: wmiClassName.

Message #

Enumerate instances started. Server: %1, Namespace: %2, Class: %3

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`protocol` UnicodeString

Event ID 211: Enumerate instances completed.

Channel: Operational
Task: Nodeaccess.

Description

Enumerate instances completed. Server: serverName, Namespace: namespaceName, Class: wmiClassName.

Message #

Enumerate instances completed. Server: %1, Namespace: %2, Class: %3

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`protocol` UnicodeString

Event ID 212: Enumerate instances error.

Channel: Operational
Task: Nodeaccess.

Description

Enumerate instances error. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Error: error.

Message #

Enumerate instances error. Server: %1, Namespace: %2, Class: %3, Error: %5

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`protocol` UnicodeString
`error` UnicodeString

Event ID 213: Enumerate instances data received.

Channel: Operational
Task: Nodeaccess.

Description

Enumerate instances data received. Server: serverName, Namespace: namespaceName, Class: wmiClassName.

Message #

Enumerate instances data received. Server: %1, Namespace: %2, Class: %3

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`protocol` UnicodeString

Event ID 214: Invoke method started.

Channel: Operational
Level: Informational
Task: Nodeaccess.

Description

Invoke method started. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName.

Message #

Invoke method started. Server: %1, Namespace: %2, Class: %3, Method: %4

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 214,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.506485+00:00",
    "event_record_id": 745,
    "correlation": {
      "ActivityID": "4ACAA8DE-FAC8-4188-A6B0-EFCD7D7B46CA"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 2632
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "localhost",
    "namespaceName": "root\\microsoft\\windows\\servermanager",
    "wmiClassName": "MSFT_ServerManagerTasks",
    "methodName": "GetServerBpaResult",
    "protocol": "DCOM"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 215: Invoke method completed.

Channel: Operational
Level: Informational
Task: Nodeaccess.

Description

Invoke method completed. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName.

Message #

Invoke method completed. Server: %1, Namespace: %2, Class: %3, Method: %4

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 215,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.540206+00:00",
    "event_record_id": 751,
    "correlation": {
      "ActivityID": "C9DB0EBB-AD74-4A6D-A36D-C691522795E3"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4868
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "localhost",
    "namespaceName": "root\\microsoft\\windows\\servermanager",
    "wmiClassName": "MSFT_ServerManagerTasks",
    "methodName": "GetServerEventDetail",
    "protocol": "DCOM"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 216: Invoke method error.

Channel: Operational
Task: Nodeaccess.

Description

Invoke method error. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName, Error: error.

Message #

Invoke method error. Server: %1, Namespace: %2, Class: %3, Method: %4, Error: %6

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString
`error` UnicodeString

Event ID 217: Invoke method data received.

Channel: Operational
Level: Informational
Task: Nodeaccess.

Description

Invoke method data received. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName.

Message #

Invoke method data received. Server: %1, Namespace: %2, Class: %3, Method: %4

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 217,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:38:27.540179+00:00",
    "event_record_id": 750,
    "correlation": {
      "ActivityID": "C9DB0EBB-AD74-4A6D-A36D-C691522795E3"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4868
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "localhost",
    "namespaceName": "root\\microsoft\\windows\\servermanager",
    "wmiClassName": "MSFT_ServerManagerTasks",
    "methodName": "GetServerEventDetail",
    "protocol": "DCOM"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 218: Invoke method non-terminating error received.

Channel: Operational
Level: Warning
Task: Nodeaccess.

Description

Invoke method non-terminating error received. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName, Error Code: errorCode, Error Message: errorMessage.

Message #

Invoke method non-terminating error received. Server: %1, Namespace: %2, Class: %3, Method: %4, Error Code: %6, Error Message: %7

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString
`errorCode` UInt32
`errorMessage` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 218,
    "version": 0,
    "level": 3,
    "task": 17,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-04T11:01:44.968700+00:00",
    "event_record_id": 1086,
    "correlation": {
      "ActivityID": "748EA6BB-2722-4FDA-B8B7-DA861FFC7DC8"
    },
    "execution": {
      "process_id": 3156,
      "thread_id": 5064
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-21-1958040314-2592322477-2606035944-500"
    }
  },
  "event_data": {
    "serverName": "localhost",
    "namespaceName": "root\\microsoft\\windows\\servermanager",
    "wmiClassName": "MSFT_ServerManagerTasks",
    "methodName": "GetServerEventDetail",
    "protocol": "DCOM",
    "errorCode": 2,
    "errorMessage": "Events from 'WebServer.Events.xml' could not be enumerated.\r\n"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 219: Invoke method message received.

Channel: Operational
Task: Nodeaccess.

Description

Invoke method message received. Server: serverName, Namespace: namespaceName, Class: wmiClassName, Method: methodName, Channel: channel, Message: message.

Message #

Invoke method message received. Server: %1, Namespace: %2, Class: %3, Method: %4, Channel: %6, Message: %7

Fields #

Name	Description
`serverName` UnicodeString
`namespaceName` UnicodeString
`wmiClassName` UnicodeString
`methodName` UnicodeString
`protocol` UnicodeString
`channel` UInt32
`message` UnicodeString

Event ID 220: Disconnect from M3P starting.

Channel: Operational
Task: Servermanagerstartuptask.
Opcode: Stop

Event ID 221: Disconnect from M3P completed.

Channel: Operational
Task: Servermanagerstartuptask.
Opcode: Stop

Event ID 300: Server data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Server data processer start. Server name: MachineName.

Message #

Server data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 301: Server data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Server data processer stop. Server name: MachineName.

Message #

Server data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 302: Server data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Server data processor failed. Server name: serverName.

Message #

Server data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 303: Server data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Server data processor on next start. Server name: serverName, Parameter name: parameterName, Data: categories.

Message #

Server data processor on next start. Server name: %1, Parameter name: %2, Data: %3

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString
`categories` Int32

Event ID 304: Server data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Server data processor on next stop. Server name: serverName, Parameter name: parameterName, Data: categories.

Message #

Server data processor on next stop. Server name: %1, Parameter name: %2, Data: %3

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString
`categories` Int32

Event ID 305: Feature data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Feature data processer start. Server name: MachineName.

Message #

Feature data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 306: Feature data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Feature data processer stop. Server name: MachineName.

Message #

Feature data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 307: Feature data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Feature data processor failed. Server name: serverName.

Message #

Feature data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 308: Feature data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Feature data processor on next start. Server name: serverName, Parameter name: parameterName.

Message #

Feature data processor on next start. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 309: Feature data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Feature data processor on next stop. Server name: serverName, Parameter name: parameterName.

Message #

Feature data processor on next stop. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 310: BPA data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA data processer start. Server name: MachineName.

Message #

BPA data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 311: BPA data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA data processer stop. Server name: MachineName.

Message #

BPA data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 312: BPA data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA data processor failed. Server name: serverName.

Message #

BPA data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 313: BPA data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA data processor on next start. Server name: serverName, Parameter name: parameterName.

Message #

BPA data processor on next start. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 314: BPA data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA data processor on next stop. Server name: serverName, Parameter name: parameterName.

Message #

BPA data processor on next stop. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 315: Events data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events data processer start. Server name: MachineName.

Message #

Events data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 316: Events data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events data processer stop. Server name: MachineName.

Message #

Events data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 317: Events data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events data processor failed. Server name: serverName.

Message #

Events data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 318: Events data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events data processor on next start. Server name: serverName, Parameter name: parameterName.

Message #

Events data processor on next start. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 319: Events data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events data processor on next stop. Server name: serverName, Parameter name: parameterName.

Message #

Events data processor on next stop. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 320: Performance counter data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance counter data processer start. Server name: MachineName.

Message #

Performance counter data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 321: Performance counter data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance counter data processer stop. Server name: MachineName.

Message #

Performance counter data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 322: Performance counter data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance counter data processor failed. Server name: serverName.

Message #

Performance counter data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 323: Performance counter data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance counter data processor on next start. Server name: serverName, Parameter name: parameterName.

Message #

Performance counter data processor on next start. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 324: Performance counter data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance counter data processor on next stop. Server name: serverName, Parameter name: parameterName.

Message #

Performance counter data processor on next stop. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 325: Services data processer start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services data processer start. Server name: MachineName.

Message #

Services data processer start. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 326: Services data processer stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services data processer stop. Server name: MachineName.

Message #

Services data processer stop. Server name: %1

Fields #

Name	Description
`MachineName` UnicodeString

Event ID 327: Services data processor failed.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services data processor failed. Server name: serverName.

Message #

Services data processor failed. Server name: %1

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 328: Services data processor on next start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services data processor on next start. Server name: serverName, Parameter name: parameterName.

Message #

Services data processor on next start. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 329: Services data processor on next stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services data processor on next stop. Server name: serverName, Parameter name: parameterName.

Message #

Services data processor on next stop. Server name: %1, Parameter name: %2

Fields #

Name	Description
`serverName` UnicodeString
`parameterName` UnicodeString

Event ID 330: Servers tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Servers tile view update start. Name: tileName, Count: categories.

Message #

Servers tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 331: Servers tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Servers tile view update stop. Name: tileName, Count: categories.

Message #

Servers tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 332: Features tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Features tile view update start. Name: tileName, Count: categories.

Message #

Features tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 333: Features tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Features tile view update stop. Name: tileName, Count: categories.

Message #

Features tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 334: BPA tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA tile view update start. Name: tileName, Count: categories.

Message #

BPA tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 335: BPA tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA tile view update stop. Name: tileName, Count: categories.

Message #

BPA tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 336: Events tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events tile view update start. Name: tileName, Count: categories.

Message #

Events tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 337: Events tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events tile view update stop. Name: tileName, Count: categories.

Message #

Events tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 338: Performance tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance tile view update start. Name: tileName, Count: categories.

Message #

Performance tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 339: Performance tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance tile view update stop. Name: tileName, Count: categories.

Message #

Performance tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 340: Services tile view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services tile view update start. Name: tileName, Count: categories.

Message #

Services tile view update start. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 341: Services tile view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services tile view update stop. Name: tileName, Count: categories.

Message #

Services tile view update stop. Name: %1, Count: %2

Fields #

Name	Description
`tileName` UnicodeString
`categories` Int32

Event ID 342: Servers thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Servers thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

Servers thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 343: Servers thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Servers thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

Servers thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 344: Timestamp thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Timestamp thumbnail view update start. Name: thumbnailName, Time: timestamp.

Message #

Timestamp thumbnail view update start. Name: %1, Time: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`timestamp` UnicodeString

Event ID 345: Timestamp thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Timestamp thumbnail view update stop. Name: thumbnailName, Time: timestamp.

Message #

Timestamp thumbnail view update stop. Name: %1, Time: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`timestamp` UnicodeString

Event ID 346: BPA thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

BPA thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 347: BPA thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

BPA thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

BPA thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 348: Events thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

Events thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 349: Events thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Events thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

Events thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 350: Performance thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

Performance thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 351: Performance thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Performance thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

Performance thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 352: Services thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

Services thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 353: Services thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Services thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

Services thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 354: Manageability thumbnail view update start.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Manageability thumbnail view update start. Name: thumbnailName, Count: categories.

Message #

Manageability thumbnail view update start. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 355: Manageability thumbnail view update stop.

Channel: Debug
Task: Servermanagerrefreshtask.

Description

Manageability thumbnail view update stop. Name: thumbnailName, Count: categories.

Message #

Manageability thumbnail view update stop. Name: %1, Count: %2

Fields #

Name	Description
`thumbnailName` UnicodeString
`categories` Int32

Event ID 356: Async job creation started.

Channel: Operational
Level: Informational
Task: Automationjobexecution.
Opcode: Start

Description

Async job creation started. Command: Command, Target: Target, State: State, Proxy Instance ID: ID.

Message #

Async job creation started. Command: %2, Target: %3, State: %4, Proxy Instance ID: %1

Fields #

Name	Description
`ID` GUID
`Command` UnicodeString
`Target` UnicodeString
`State` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 356,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 1,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:21:41.337170+00:00",
    "event_record_id": 686,
    "correlation": {
      "ActivityID": "1480B89F-E871-42E4-BFB4-C8F88B053137"
    },
    "execution": {
      "process_id": 4444,
      "thread_id": 4380
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "ID": "97DEB445-282E-4B54-9C43-57E30F4270F5",
    "Command": "ServerManagerShell\\Invoke-_InternalServiceMethod",
    "Target": "localhost",
    "State": "Running"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2000: Deployment Wizard is launched.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.

Description

Deployment Wizard is launched. Target Server: serverName.

Message #

Deployment Wizard is launched.  Target Server: %1

Fields #

Name	Description
`serverName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2000,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:14.611551+00:00",
    "event_record_id": 85,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-737B-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "WIN-FPV0DSIC9O6"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2001: Deployment Wizard is closed.

Channel: Operational
Level: Informational
Task: Servermanagershutdowntask

Description

Deployment Wizard is closed. Target Server: serverName.

Message #

Deployment Wizard is closed.  Target Server: %1

Fields #

Name	Description
`serverName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2001,
    "version": 0,
    "level": 4,
    "task": 9,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:18.961762+00:00",
    "event_record_id": 203,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-FD97-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "WIN-FPV0DSIC9O6"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2002: Deployment Wizard repository loading start.

Channel: Operational
Level: Informational
Task: Servermanagerinitializationtask.

Description

Deployment Wizard repository loading start. Target Server: serverName.

Message #

Deployment Wizard repository loading start.  Target Server: %1

Fields #

Name	Description
`serverName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2002,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:14.562299+00:00",
    "event_record_id": 81,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-5585-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 1360
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "serverName": "WIN-FPV0DSIC9O6"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2003: Deployment Wizard repository loading completed.

Channel: Operational
Level: Informational
Task: Servermanagerinitializationtask.

Description

Deployment Wizard repository loading completed. Target Server: targetServer. Status: Message.

Message #

Deployment Wizard repository loading completed.  Target Server: %1. Status: %2

Fields #

Name	Description
`targetServer` UnicodeString
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2003,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:15.267300+00:00",
    "event_record_id": 89,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-5585-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 1360
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "targetServer": "WIN-FPV0DSIC9O6",
    "Message": "Success"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2004: Deployment Wizard repository loading completed and repository is empty.

Channel: Operational
Task: Servermanagerinitializationtask.

Description

Deployment Wizard repository loading completed and repository is empty. Target Server: serverName.

Message #

Deployment Wizard repository loading completed and repository is empty.  Target Server: %1

Fields #

Name	Description
`serverName` UnicodeString

Event ID 2005: Deployment Wizard installation type changed.

Channel: Operational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard installation type changed. InstallationType: Category.

Message #

Deployment Wizard installation type changed.  InstallationType: %1

Fields #

Name	Description
`Category` UnicodeString

Event ID 2006: Deployment Wizard component selected.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard component selected. ComponentId: componentId. Display Name: displayName.

Message #

Deployment Wizard component selected.  ComponentId: %1. Display Name: %2

Fields #

Name	Description
`componentId` Int32
`displayName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2006,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:53.457840+00:00",
    "event_record_id": 102,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-3986-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 3188
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "componentId": 10,
    "displayName": "Active Directory Domain Services"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2007: Deployment Wizard component unselected.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard component unselected. ComponentId: componentId. Display Name: displayName.

Message #

Deployment Wizard component unselected.  ComponentId: %1. Display Name: %2

Fields #

Name	Description
`componentId` Int32
`displayName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2007,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-04T10:56:42.409230+00:00",
    "event_record_id": 859,
    "correlation": {
      "ActivityID": "066FA786-2FC0-0000-A7F8-7006C02FD801"
    },
    "execution": {
      "process_id": 3156,
      "thread_id": 4644
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-21-1958040314-2592322477-2606035944-500"
    }
  },
  "event_data": {
    "componentId": 468,
    "displayName": "Remote Access"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2008: Deployment Wizard component selection cancelled through dependency dialog.

Channel: Operational
Task: Theuserinteractionwiththewizard.

Event ID 2009: Deployment Wizard target server collection has changed.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2009,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:19.729055+00:00",
    "event_record_id": 96,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-BC7B-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {},
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2010: Deployment Wizard page enter.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard page enter. Page title: pageTitle.

Message #

Deployment Wizard page enter. Page title: %1

Fields #

Name	Description
`pageTitle` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2010,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:06:24.456060+00:00",
    "event_record_id": 163,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-9086-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "pageTitle": "InstallationCompletionPage"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2011: Deployment Wizard page exit.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard page exit. Page title: pageTitle.

Message #

Deployment Wizard page exit. Page title: %1

Fields #

Name	Description
`pageTitle` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2011,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:06:24.453440+00:00",
    "event_record_id": 162,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0000-9086-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "pageTitle": "InstallationConfirmationPage"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2012: Deployment Wizard cancel requested.

Channel: Operational
Task: Servermanagerstartuptask.

Description

Deployment Wizard cancel requested. Target Server: serverName.

Message #

Deployment Wizard cancel requested. Target Server: %1

Fields #

Name	Description
`serverName` UnicodeString

Event ID 2013: Deployment Wizard commit action started.

Channel: Operational
Level: Informational
Task: Automationjobexecution.

Description

Deployment Wizard commit action started. Target Server: MachineName, Job: JobName.

Message #

Deployment Wizard commit action started.  Target Server: %1, Job: %2

Fields #

Name	Description
`MachineName` UnicodeString
`JobName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2013,
    "version": 0,
    "level": 4,
    "task": 12,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:06:32.648209+00:00",
    "event_record_id": 177,
    "correlation": {
      "ActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 5200
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "MachineName": "WIN-FPV0DSIC9O6",
    "JobName": "ID:66eda40e-d1c4-4391-9a10-1a9a078f1add;Feature installation"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2014: Deployment Wizard commit action completed.

Channel: Operational
Level: Informational
Task: Servermanagerstartuptask.

Description

Deployment Wizard commit action completed. Target Server: MachineName. Job: JobName. Status: Status. Reason Reason.

Message #

Deployment Wizard commit action completed.  Target Server: %1. Job: %2. Status: %3. Reason %4

Fields #

Name	Description
`MachineName` UnicodeString
`JobName` UnicodeString
`Status` UnicodeString	NTSTATUS reference
`Reason` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2014,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:17.055539+00:00",
    "event_record_id": 198,
    "correlation": {
      "ActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 5236
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "MachineName": "localhost",
    "JobName": "ID:66eda40e-d1c4-4391-9a10-1a9a078f1add;Feature installation",
    "Status": "Succeeded",
    "Reason": ""
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2015: Deployment Wizard component selection step completed.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard component selection step completed. ComponentId: componentId. Display Name: displayName.

Message #

Deployment Wizard component selection step completed.  ComponentId: %1. Display Name: %2

Fields #

Name	Description
`componentId` Int32
`displayName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2015,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:56.402968+00:00",
    "event_record_id": 140,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-777C-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "componentId": 10,
    "displayName": "Active Directory Domain Services"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2016: Deployment Wizard component unselection completed.

Channel: Operational
Level: Informational
Task: Theuserinteractionwiththewizard.

Description

Deployment Wizard component unselection completed. ComponentId: componentId. Display Name: displayName.

Message #

Deployment Wizard component unselection completed.  ComponentId: %1. Display Name: %2

Fields #

Name	Description
`componentId` Int32
`displayName` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2016,
    "version": 0,
    "level": 4,
    "task": 15,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-04T10:56:42.427037+00:00",
    "event_record_id": 861,
    "correlation": {
      "ActivityID": "066FA786-2FC0-0000-A8F8-7006C02FD801"
    },
    "execution": {
      "process_id": 3156,
      "thread_id": 3160
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-21-1958040314-2592322477-2606035944-500"
    }
  },
  "event_data": {
    "componentId": 468,
    "displayName": "Remote Access"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2100: Deployment plugin loading started.

Channel: Operational
Level: Informational
Task: Therolepluginloadtask.

Description

Deployment plugin loading started. RoleId: roleId.

Message #

Deployment plugin loading started.  RoleId: %1

Fields #

Name	Description
`roleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2100,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:17.045905+00:00",
    "event_record_id": 196,
    "correlation": {
      "ActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "roleId": 299
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2101: Deployment plugin loading completed.

Channel: Operational
Level: Informational
Task: Therolepluginloadtask.

Description

Deployment plugin loading completed. RoleId: roleId. Status: Status.

Message #

Deployment plugin loading completed.  RoleId: %1. Status: %2

Fields #

Name	Description
`roleId` Int32
`Status` UnicodeString	NTSTATUS reference
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2101,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:17.045906+00:00",
    "event_record_id": 197,
    "correlation": {
      "ActivityID": "AA4DB9AF-DA1D-455F-908A-502ABDF549C8"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "roleId": 299,
    "Status": "Not required",
    "Message": "The feature add-in is not required."
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2102: Deployment component pages added.

Channel: Operational
Level: Informational
Task: Loadsettingstask.

Description

Deployment component pages added. ComponentId: componentId.

Message #

Deployment component pages added.  ComponentId: %1

Fields #

Name	Description
`componentId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2102,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:05:56.444994+00:00",
    "event_record_id": 141,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-777C-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 1460,
      "thread_id": 4948
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "componentId": 10
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2103: Deployment component pages removed.

Channel: Operational
Level: Informational
Task: Loadsettingstask.

Description

Deployment component pages removed. ComponentId: componentId.

Message #

Deployment component pages removed.  ComponentId: %1

Fields #

Name	Description
`componentId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 2103,
    "version": 0,
    "level": 4,
    "task": 7,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-04T10:56:42.433764+00:00",
    "event_record_id": 862,
    "correlation": {
      "ActivityID": "066FA786-2FC0-0000-A8F8-7006C02FD801"
    },
    "execution": {
      "process_id": 3156,
      "thread_id": 3160
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-21-1958040314-2592322477-2606035944-500"
    }
  },
  "event_data": {
    "componentId": 468
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 2105: Deployment configuration data export started.

Channel: Operational
Task: Loadsettingstask.

Description

Deployment configuration data export started. File location: fileLocation.

Message #

Deployment configuration data export started. File location: %1

Fields #

Name	Description
`fileLocation` UnicodeString

Event ID 2106: Deployment configuration data export completed.

Channel: Operational
Task: Loadsettingstask.

Description

Deployment configuration data export completed. File location: fileLocation.

Message #

Deployment configuration data export completed. File location: %1

Fields #

Name	Description
`fileLocation` UnicodeString

Event ID 2107: Pre-requisite check started for component with ComponentId: componentId.

Channel: Operational
Task: Thecallintodeploymentpluginfunctionality.

Message #

Pre-requisite check started for component with ComponentId: %1

Fields #

Name	Description
`componentId` Int32

Event ID 2108: Pre-requisite check completed for component with ComponentId: roleId, Status: Status.

Channel: Operational
Task: Thecallintodeploymentpluginfunctionality.

Message #

Pre-requisite check completed for component with ComponentId: %1, Status: %2

Fields #

Name	Description
`roleId` Int32
`Status` UnicodeString	NTSTATUS reference

Event ID 2109: Pre-uninstall step started for component with ComponentId: componentId.

Channel: Operational
Task: Thecallintodeploymentpluginfunctionality.

Message #

Pre-uninstall step started for component with ComponentId: %1

Fields #

Name	Description
`componentId` Int32

Event ID 2110: Pre-uninstall step completed for component with ComponentId: roleId, Status: Status.

Channel: Operational
Task: Thecallintodeploymentpluginfunctionality.

Message #

Pre-uninstall step completed for component with ComponentId: %1, Status: %2

Fields #

Name	Description
`roleId` Int32
`Status` UnicodeString	NTSTATUS reference

Event ID 4000: Add-_InternalWindowsRole workflow entered.

Channel: Operational
Level: Informational
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow entered. If this event is not followed by event 4001 or 4002, the workflow either failed, was cancelled, or is still in progress. TargetComputer:targetComputer, ServerComponentNames: serverComponentNames, Remove: remove, PathToVhdFile: pathToVhdFile, PermitReboot: permitReboot, Source: source, DeleteComponents: deleteComponents

Message #

Add-_InternalWindowsRole workflow entered. If this event is not followed by event 4001 or 4002, the workflow either failed, was cancelled, or is still in progress. TargetComputer:%1, ServerComponentNames: %2, Remove: %3, PathToVhdFile: %4, PermitReboot: %5, Source: %6, DeleteComponents: %7

Fields #

Name	Description
`targetComputer` UnicodeString
`serverComponentNames` UnicodeString
`remove` Boolean
`pathToVhdFile` UnicodeString
`permitReboot` Boolean
`source` UnicodeString
`deleteComponents` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 4000,
    "version": 0,
    "level": 4,
    "task": 4001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:06:32.576262+00:00",
    "event_record_id": 175,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-E27C-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 5272,
      "thread_id": 2168
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "targetComputer": "",
    "serverComponentNames": "ServerComponent_AD_Domain_Services ServerComponent_GPMC ServerComponent_RSAT ServerComponent_RSAT_AD_AdminCenter ServerComponent_RSAT_AD_PowerShell ServerComponent_RSAT_AD_Tools ServerComponent_RSAT_ADDS ServerComponent_RSAT_ADDS_Tools ServerComponent_RSAT_Role_Tools",
    "remove": false,
    "pathToVhdFile": "",
    "permitReboot": true,
    "source": "",
    "deleteComponents": false
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4001: Add-_InternalWindowsRole workflow ended, TargetComputer:targetComputer, RequestState:requestState, RebootRequired: restartRequired, ErrorMessage: errorMessage, ErrorId: errorId, ErrorCategory: erro...

Channel: Operational
Level: Informational
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow ended, TargetComputer:targetComputer, RequestState:requestState, RebootRequired: restartRequired, ErrorMessage: errorMessage, ErrorId: errorId, ErrorCategory: errorCategory, Warning: warnings.

Message #

Add-_InternalWindowsRole workflow ended, TargetComputer:%1, RequestState:%2, RebootRequired: %3, ErrorMessage: %4, ErrorId: %5, ErrorCategory: %6, Warning: %7

Fields #

Name	Description
`targetComputer` UnicodeString
`requestState` Int32
`restartRequired` Boolean
`errorMessage` UnicodeString
`errorId` UnicodeString
`errorCategory` Int32
`warnings` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 4001,
    "version": 0,
    "level": 4,
    "task": 4001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2022-04-07T17:07:16.570811+00:00",
    "event_record_id": 178,
    "correlation": {
      "ActivityID": "DD7B0B6A-4A9E-0001-1F85-7BDD9E4AD801"
    },
    "execution": {
      "process_id": 5272,
      "thread_id": 4992
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "WIN-FPV0DSIC9O6",
    "security": {
      "user_id": "S-1-5-21-2121334350-1110938707-2888912545-500"
    }
  },
  "event_data": {
    "targetComputer": "",
    "requestState": 1,
    "restartRequired": false,
    "errorMessage": "",
    "errorId": "",
    "errorCategory": 0,
    "warnings": ""
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 4002: Add-_InternalWindowsRole workflow reported an error installing or removing the requested component(s), TargetComputer:targetComputer, RequestState:requestState, RebootRe...

Channel: Operational
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow reported an error installing or removing the requested component(s), TargetComputer:targetComputer, RequestState:requestState, RebootRequired: restartRequired, ErrorMessage: errorMessage, ErrorId: errorId, ErrorCategory: errorCategory, Warning: warnings

Message #

Add-_InternalWindowsRole workflow reported an error installing or removing the requested component(s), TargetComputer:%1, RequestState:%2, RebootRequired: %3, ErrorMessage: %4, ErrorId: %5, ErrorCategory: %6, Warning: %7

Fields #

Name	Description
`targetComputer` UnicodeString
`requestState` Int32
`restartRequired` Boolean
`errorMessage` UnicodeString
`errorId` UnicodeString
`errorCategory` Int32
`warnings` UnicodeString

Event ID 4010: Add-_InternalWindowsRole workflow launching install/remove operation.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow launching install/remove operation. If this event is not followed by event 4011, the workflow either failed, was cancelled, or is still in progress. TargetComputer:targetComputer, RequestGuid: requestGuid

Message #

Add-_InternalWindowsRole workflow launching install/remove operation. If this event is not followed by event 4011, the workflow either failed, was cancelled, or is still in progress. TargetComputer:%1, RequestGuid: %2

Fields #

Name	Description
`targetComputer` UnicodeString
`requestGuid` GUID

Event ID 4011: Add-_InternalWindowsRole workflow launched install/remove operation, TargetComputer:targetComputer, RequestGuid: requestGuid, RequestState:requestState, RebootRequired: restartRequired, Progr...

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow launched install/remove operation, TargetComputer:targetComputer, RequestGuid: requestGuid, RequestState:requestState, RebootRequired: restartRequired, ProgressTicks: progressTicks, TotalTicks: totalTicks, ErrorMessage: errorMessage, ErrorId: errorId, ErrorCategory: errorCategory, Warning: warnings

Message #

Add-_InternalWindowsRole workflow launched install/remove operation, TargetComputer:%1, RequestGuid: %2, RequestState:%3, RebootRequired: %4, ProgressTicks: %5, TotalTicks: %6, ErrorMessage: %7, ErrorId: %8, ErrorCategory: %9, Warning: %10

Fields #

Name	Description
`targetComputer` UnicodeString
`requestGuid` GUID
`requestState` Int32
`restartRequired` Boolean
`progressTicks` Int32
`totalTicks` Int32
`errorMessage` UnicodeString
`errorId` UnicodeString
`errorCategory` Int32
`warnings` UnicodeString

Event ID 4012: Add-_InternalWindowsRole workflow polling for completion.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow polling for completion. If this event is not followed by event 4013, the workflow either failed, was cancelled, or is still in progress. TargetComputer:, RequestGuid.

Message #

Add-_InternalWindowsRole workflow polling for completion. If this event is not followed by event 4013, the workflow either failed, was cancelled, or is still in progress. TargetComputer:%1, RequestGuid: %2

Fields #

Name	Description
`targetComputer` UnicodeString
`requestGuid` GUID

Event ID 4013: Add-_InternalWindowsRole workflow polled for completion, TargetComputer:targetComputer, RequestGuid: requestGuid, RequestState:requestState, RebootRequired: restartRequired, ProgressTicks: progress...

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow polled for completion, TargetComputer:targetComputer, RequestGuid: requestGuid, RequestState:requestState, RebootRequired: restartRequired, ProgressTicks: progressTicks, TotalTicks: totalTicks, ErrorMessage: errorMessage, ErrorId: errorId, ErrorCategory: errorCategory, Warning: warnings

Message #

Add-_InternalWindowsRole workflow polled for completion, TargetComputer:%1, RequestGuid: %2, RequestState:%3, RebootRequired: %4, ProgressTicks: %5, TotalTicks: %6, ErrorMessage: %7, ErrorId: %8, ErrorCategory: %9, Warning: %10

Fields #

Name	Description
`targetComputer` UnicodeString
`requestGuid` GUID
`requestState` Int32
`restartRequired` Boolean
`progressTicks` Int32
`totalTicks` Int32
`errorMessage` UnicodeString
`errorId` UnicodeString
`errorCategory` Int32
`warnings` UnicodeString

Event ID 4020: Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and is checking whether it has already been restarted.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and is checking whether it has already been restarted. If this event is not followed by event 4021, the workflow either failed, was cancelled, or is still in progress. TargetComputer:targetComputer, InitialLastBootTime: initialLastBootTime

Message #

Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and is checking whether it has already been restarted. If this event is not followed by event 4021, the workflow either failed, was cancelled, or is still in progress. TargetComputer:%1, InitialLastBootTime: %2

Fields #

Name	Description
`targetComputer` UnicodeString
`initialLastBootTime` FILETIME

Event ID 4021: Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and finished checking whether it has already been re...

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and finished checking whether it has already been restarted. TargetComputer:targetComputer, InitialLastBootTime: initialLastBootTime, CurrentLastBootTime:currentLastBootTime, AlreadyRebooted:alreadyRebooted

Message #

Add-_InternalWindowsRole workflow has determined that the target computer should be restarted, and finished checking whether it has already been restarted. TargetComputer:%1, InitialLastBootTime: %2, CurrentLastBootTime:%3, AlreadyRebooted:%4

Fields #

Name	Description
`targetComputer` UnicodeString
`initialLastBootTime` FILETIME
`currentLastBootTime` FILETIME
`alreadyRebooted` Boolean

Event ID 4022: Add-_InternalWindowsRole workflow is requesting restart of the target computer.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow is requesting restart of the target computer. If this event is not followed by event 4023, the workflow either failed, was cancelled, or is still in progress. TargetComputer:targetComputer

Message #

Add-_InternalWindowsRole workflow is requesting restart of the target computer. If this event is not followed by event 4023, the workflow either failed, was cancelled, or is still in progress. TargetComputer:%1

Fields #

Name	Description
`targetComputer` UnicodeString

Event ID 4023: Add-_InternalWindowsRole workflow has requested restart of the target computer.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow has requested restart of the target computer. TargetComputer:targetComputer.

Message #

Add-_InternalWindowsRole workflow has requested restart of the target computer. TargetComputer:%1

Fields #

Name	Description
`targetComputer` UnicodeString

Event ID 4024: Add-_InternalWindowsRole workflow failed to restart the target computer within the timeout period and will exit.

Channel: Debug
Task: Add__InternalWindowsRoletask.

Description

Add-_InternalWindowsRole workflow failed to restart the target computer within the timeout period and will exit. TargetComputer:targetComputer.

Message #

Add-_InternalWindowsRole workflow failed to restart the target computer within the timeout period and will exit. TargetComputer:%1

Fields #

Name	Description
`targetComputer` UnicodeString

Event ID 9000: Get-WindowsFeature cmdlet started.

Channel: Operational
Level: Informational
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9000,
    "version": 0,
    "level": 4,
    "task": 9001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-13T19:06:27.609152+00:00",
    "event_record_id": 3987,
    "correlation": {
      "ActivityID": "65934F52-B30E-000B-40D7-95650EB3DC01"
    },
    "execution": {
      "process_id": 13820,
      "thread_id": 10980
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "requestGuid": "7E0F4F8B-37A8-497E-806B-F440E7848387",
    "serverComponentNames": "Web-Server"
  },
  "message": ""
}

Event ID 9001: Get-WindowsFeature cmdlet ended, Guid: requestGuid, Components: serverComponentNames.

Channel: Operational
Level: Informational
Task: Get_WindowsFeaturetask.

Message #

Get-WindowsFeature cmdlet ended, Guid: %1, Components: %2.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9001,
    "version": 0,
    "level": 4,
    "task": 9001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-13T19:06:42.555723+00:00",
    "event_record_id": 4251,
    "correlation": {
      "ActivityID": "65934F52-B30E-000B-40D7-95650EB3DC01"
    },
    "execution": {
      "process_id": 13820,
      "thread_id": 10980
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "requestGuid": "7E0F4F8B-37A8-497E-806B-F440E7848387",
    "serverComponentNames": "Web-Server"
  },
  "message": ""
}

Event ID 9002: GetServerComponent method started.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Event ID 9003: GetServerComponent method ended with Success.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9004: GetServerComponent method returned InProgress.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9005: GetServerComponent method returned Failed.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9006: GetEnumerationState method started.

Channel: Debug
Task: Get_WindowsFeaturetask.

Event ID 9007: GetEnumerationState method ended with Success.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9008: GetEnumerationState method returned InProgress.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9009: GetEnumerationState method returned Failed.

Channel: Debug
Task: Get_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9010: Get Windows feature failed with Error: message.

Channel: Operational
Level: Error
Task: Get_WindowsFeaturetask.

Message #

Get Windows feature failed with Error: %1

Fields #

Name	Description
`message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "d8d37081-10bd-4a89-a971-1cda6899bdb3",
    "event_source_name": "",
    "event_id": 9010,
    "version": 0,
    "level": 2,
    "task": 9001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-07-06T16:34:56.5616869+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "bf440000-0bf1-0000-d349-45bff10bdd01",
      "RelatedActivityID": ""
    },
    "execution": {
      "process_id": 13204,
      "thread_id": 3144
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "message": "The target of the specified cmdlet cannot be a Windows client-based operating system."
  },
  "message": "Get Windows feature failed with Error: The target of the specified cmdlet cannot be a Windows client-based operating system."
}

Event ID 9011: Component message1 has invalid state currentRoleId.

Channel: Operational
Task: Get_WindowsFeaturetask.

Message #

Component %1 has invalid state %2

Fields #

Name	Description
`message1` UnicodeString
`currentRoleId` Int32

Event ID 9012: Component message1 has state currentRoleId.

Channel: Operational
Level: Informational
Task: Get_WindowsFeaturetask.

Message #

Component %1 has state %2

Fields #

Name	Description
`message1` UnicodeString
`currentRoleId` Int32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9012,
    "version": 0,
    "level": 4,
    "task": 9001,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-13T19:06:42.551154+00:00",
    "event_record_id": 3988,
    "correlation": {
      "ActivityID": "65934F52-B30E-000B-40D7-95650EB3DC01"
    },
    "execution": {
      "process_id": 13820,
      "thread_id": 10980
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "message1": "NET-Framework-45-Features",
    "currentRoleId": 1
  },
  "message": ""
}

Event ID 9100: Add-WindowsFeature cmdlet started.

Channel: Operational
Level: Informational
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9100,
    "version": 0,
    "level": 4,
    "task": 9002,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-13T19:06:43.279603+00:00",
    "event_record_id": 4252,
    "correlation": {
      "ActivityID": "65934F52-B30E-000B-55D7-95650EB3DC01"
    },
    "execution": {
      "process_id": 8328,
      "thread_id": 2708
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "requestGuid": "E8C08ECB-A15C-4FE2-B076-4C4E2A71C8E3",
    "serverComponentNames": "Web-Server"
  },
  "message": ""
}

Event ID 9101: Add-WindowsFeature cmdlet ended.

Channel: Operational
Level: Informational
Task: Add_WindowsFeaturetask.

Description

Add-WindowsFeature cmdlet ended. Guid: requestGuid, Components serverComponentNames.

Message #

Add-WindowsFeature cmdlet ended. Guid: %1, Components %2.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "D8D37081-10BD-4A89-A971-1CDA6899BDB3",
    "event_source_name": "",
    "event_id": 9101,
    "version": 0,
    "level": 4,
    "task": 9002,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-03-13T19:07:36.215587+00:00",
    "event_record_id": 4561,
    "correlation": {
      "ActivityID": "65934F52-B30E-000B-C4D8-95650EB3DC01"
    },
    "execution": {
      "process_id": 8328,
      "thread_id": 2708
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "requestGuid": "E8C08ECB-A15C-4FE2-B076-4C4E2A71C8E3",
    "serverComponentNames": "Web-Server,Web-WebServer,Web-Common-Http,Web-Default-Doc,Web-Dir-Browsing,Web-Http-Errors,Web-Static-Content,Web-Health,Web-Http-Logging,Web-Performance,Web-Stat-Compression,Web-Security,Web-Filtering,Web-Mgmt-Console,Web-Mgmt-Tools"
  },
  "message": ""
}

Event ID 9102: AddServerComponent method started.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Event ID 9103: AddServerComponent method ended with Success.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9104: AddServerComponent method returned InProgress.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9105: AddServerComponent method returned Failed.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9106: GetAlterationState method for Add-WindowsFeature started.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID

Event ID 9107: GetAlterationState method for Add-WindowsFeature ended.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9108: GetAlterationState method for Add-WindowsFeature returned InProgress.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9109: GetAlterationState method for Add-WindowsFeature returned Failed.

Channel: Debug
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9110: Mutual Exclusion conflict detected during add.

Channel: Operational
Task: Add_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9200: Remove-WindowsFeature cmdlet started.

Channel: Operational
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Event ID 9201: Remove-WindowsFeature cmdlet ended.

Channel: Operational
Level: Informational
Task: Remove_WindowsFeaturetask.

Description

Remove-WindowsFeature cmdlet ended. Guid: requestGuid, Components: serverComponentNames.

Message #

Remove-WindowsFeature cmdlet ended. Guid: %1, Components: %2.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-ServerManager-MultiMachine",
    "guid": "{D8D37081-10BD-4A89-A971-1CDA6899BDB3}",
    "event_source_name": "",
    "event_id": 9201,
    "version": 0,
    "level": 4,
    "task": 9003,
    "opcode": 0,
    "keywords": 2305843009213693952,
    "time_created": "2026-05-30T02:17:48.9001580+00:00",
    "event_record_id": 35568,
    "correlation": {
      "ActivityID": "{CEFBC89A-D2FC-0008-0B20-02CFFCD2DC01}"
    },
    "execution": {
      "process_id": 14332,
      "thread_id": 14056
    },
    "channel": "Microsoft-Windows-ServerManager-MultiMachine/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "event_data": {
    "requestGuid": "{8aa9205a-b0bf-4b2e-95d5-81965f786340}",
    "serverComponentNames": "Telnet-Client"
  },
  "message": "Remove-WindowsFeature cmdlet ended. Guid: {8aa9205a-b0bf-4b2e-95d5-81965f786340}, Components: Telnet-Client."
}

Event ID 9202: RemoveServerComponent method started.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`serverComponentNames` UnicodeString

Event ID 9203: RemoveServerComponent method ended with Success.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9204: RemoveServerComponent method returned InProgress.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9205: RemoveServerComponent method returned Failed.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9206: GetAlterationState method for Remove-WindowsFeature started.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID

Event ID 9207: GetAlterationState method for Remove-WindowsFeature ended.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`restartRequired` Boolean

Event ID 9208: GetAlterationState method for Remove-WindowsFeature returned InProgress.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`ticks` UInt32
`totalTicks` UInt32

Event ID 9209: GetAlterationState method for Remove-WindowsFeature returned Failed.

Channel: Debug
Task: Remove_WindowsFeaturetask.

Fields #

Name	Description
`requestGuid` GUID
`message` UnicodeString

Event ID 9210: Remove Windows feature failed with Error: message.

Channel: Operational
Task: Remove_WindowsFeaturetask.

Message #

Remove Windows feature failed with Error: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 9211: Add Windows feature failed with Error: message.

Channel: Operational
Task: Add_WindowsFeaturetask.

Message #

Add Windows feature failed with Error: %1

Fields #

Name	Description
`message` UnicodeString

Event ID 9301: message.

Channel: Debug
Task: Initializelogfiletask.

Message #

%1

Fields #

Name	Description
`message` UnicodeString

Provenance

ETW provider GUID d8d37081-10bd-4a89-a971-1cda6899bdb3

Defined in SrvMgrInst.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB