Microsoft-Windows-Servicing
Event ID 1: Initiating changes for package CbsPackageInitiateChanges.PackageIdentifier.
#Description
Initiating changes for package CbsPackageInitiateChanges.PackageIdentifier. Current state is CbsPackageInitiateChanges.InitialPackageState. Target state is CbsPackageInitiateChanges.IntendedPackageState. Client id: CbsPackageInitiateChanges.Client.
Message #
Fields #
| Name | Description |
|---|---|
identifier | |
currentPackageState | |
currentPackageStateTextized | |
targetPackageState | |
targetPackageStateTextized | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1",
"event_source_name": "",
"event_id": 1,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-05T22:27:07.962339+00:00",
"event_record_id": 11,
"correlation": {},
"execution": {
"process_id": 5140,
"thread_id": 5984
},
"channel": "Setup",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsPackageInitiateChanges": {
"PackageIdentifier": "KB5032381",
"InitialPackageState": 5000,
"InitialPackageStateTextized": "Absent",
"IntendedPackageState": 5112,
"IntendedPackageStateTextized": "Installed",
"Client": "WindowsUpdateAgent"
}
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 2: Package CbsPackageChangeState.PackageIdentifier was successfully changed to the CbsPackageChangeState.IntendedPackageState state.
#Message #
Fields #
| Name | Description |
|---|---|
identifier | |
targetPackageState | |
targetPackageStateTextized | |
errorCode | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1",
"event_source_name": "",
"event_id": 2,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-05T22:27:38.467765+00:00",
"event_record_id": 12,
"correlation": {},
"execution": {
"process_id": 5140,
"thread_id": 5124
},
"channel": "Setup",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsPackageChangeState": {
"PackageIdentifier": "KB5032381",
"IntendedPackageState": 5112,
"IntendedPackageStateTextized": "Installed",
"ErrorCode": "0x0",
"Client": "WindowsUpdateAgent"
}
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 3: Package identifier failed to be changed to the targetPackageState state.
#Event ID 4: A reboot is necessary before package CbsPackageChangeState.PackageIdentifier can be changed to the CbsPackageChangeState.IntendedPackageState state.
#Message #
Fields #
| Name | Description |
|---|---|
identifier | |
targetPackageState | |
targetPackageStateTextized | |
errorCode | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1",
"event_source_name": "",
"event_id": 4,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2022-04-07T08:29:46.442470+00:00",
"event_record_id": 30,
"correlation": {},
"execution": {
"process_id": 6644,
"thread_id": 5384
},
"channel": "Setup",
"computer": "WIN-FPV0DSIC9O6.lab.local",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsPackageChangeState": {
"PackageIdentifier": "KB5009470",
"IntendedPackageState": 5112,
"IntendedPackageStateTextized": "Installed",
"ErrorCode": "0x0",
"Client": "WindowsUpdateAgent"
}
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 5: The servicing request received for package identifier cannot be satisfied since the package is not applicable.
#Event ID 6: Package identifier failed to be changed to the targetPackageState state and is now partially installed.
#Event ID 7: Initiating changes to turn on update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier.
#Description
Initiating changes to turn on update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier. Client id: CbsUpdateChangeState.Client.
Message #
Fields #
| Name | Description |
|---|---|
CbsUpdateChangeState.UpdateName | |
CbsUpdateChangeState.PackageIdentifier | |
CbsUpdateChangeState.ErrorCode | |
CbsUpdateChangeState.Client | |
updateName | |
identifier | |
errorCode | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 7,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T05:22:18.8620128+00:00",
"event_record_id": 63,
"correlation": {},
"execution": {
"process_id": 1436,
"thread_id": 708
},
"channel": "Setup",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "MSMQ-ADIntegration",
"PackageIdentifier": "Microsoft-Windows-MSMQ-Server",
"ErrorCode": "",
"Client": "DISM Package Manager Provider"
}
},
"message": "Initiating changes to turn on update MSMQ-ADIntegration of package Microsoft-Windows-MSMQ-Server. Client id: DISM Package Manager Provider."
}
Event ID 8: Initiating changes to turn off update updateName of package identifier.
#Description
Initiating changes to turn off update updateName of package identifier. Client id: client.
Message #
Fields #
| Name | Description |
|---|---|
CbsUpdateChangeState.UpdateName | |
CbsUpdateChangeState.PackageIdentifier | |
CbsUpdateChangeState.ErrorCode | |
CbsUpdateChangeState.Client | |
updateName UnicodeString | |
identifier UnicodeString | |
errorCode UnicodeString | |
client UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 8,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T05:12:43.6374269+00:00",
"event_record_id": 44,
"correlation": {},
"execution": {
"process_id": 1436,
"thread_id": 1136
},
"channel": "Setup",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "IIS-ApplicationDevelopment",
"PackageIdentifier": "IIS-WebServer-Core-Package",
"ErrorCode": "",
"Client": "DISM Package Manager Provider"
}
},
"message": "Initiating changes to turn off update IIS-ApplicationDevelopment of package IIS-WebServer-Core-Package. Client id: DISM Package Manager Provider."
}
Event ID 9: Selectable update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier was successfully turned on.
#Message #
Fields #
| Name | Description |
|---|---|
CbsUpdateChangeState.UpdateName | |
CbsUpdateChangeState.PackageIdentifier | |
CbsUpdateChangeState.ErrorCode | |
CbsUpdateChangeState.Client | |
updateName | |
identifier | |
errorCode | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 9,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T05:22:20.9509189+00:00",
"event_record_id": 64,
"correlation": {},
"execution": {
"process_id": 1436,
"thread_id": 708
},
"channel": "Setup",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "MSMQ-ADIntegration",
"PackageIdentifier": "Microsoft-Windows-MSMQ-Server",
"ErrorCode": "0x0",
"Client": "DISM Package Manager Provider"
}
},
"message": "Selectable update MSMQ-ADIntegration of package Microsoft-Windows-MSMQ-Server was successfully turned on."
}
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma # view in coverage
T1564, T1564.006
Event ID 10: Selectable update updateName of package identifier was successfully turned off.
#Message #
Fields #
| Name | Description |
|---|---|
CbsUpdateChangeState.UpdateName | |
CbsUpdateChangeState.PackageIdentifier | |
CbsUpdateChangeState.ErrorCode | |
CbsUpdateChangeState.Client | |
updateName UnicodeString | |
identifier UnicodeString | |
errorCode UnicodeString | |
client UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 10,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-06-13T05:13:28.1168946+00:00",
"event_record_id": 54,
"correlation": {},
"execution": {
"process_id": 1436,
"thread_id": 1136
},
"channel": "Setup",
"computer": "telemetry-DC-c.cell-c.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "IIS-ApplicationDevelopment",
"PackageIdentifier": "IIS-WebServer-Core-Package",
"ErrorCode": "0x0",
"Client": "DISM Package Manager Provider"
}
},
"message": "Selectable update IIS-ApplicationDevelopment of package IIS-WebServer-Core-Package was successfully turned off."
}
Event ID 11: Update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier failed to be turned on.
#Description
Update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier failed to be turned on. Status: CbsUpdateChangeState.ErrorCode.
Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
errorCode UnicodeString | |
client UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1",
"event_source_name": "",
"event_id": 11,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2026-03-13T20:03:35.142239+00:00",
"event_record_id": 67,
"correlation": {
"ActivityID": "FB184003-DCB7-4B69-9E92-32E15BDF0739"
},
"execution": {
"process_id": 6332,
"thread_id": 6572
},
"channel": "Setup",
"computer": "LAB-WIN11.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "NetFx3",
"PackageIdentifier": "Microsoft .NET Framework 3.0",
"ErrorCode": "0x80070005",
"Client": "DISM Package Manager Provider"
}
},
"message": ""
}
Event ID 12: Update updateName of package identifier failed to be turned off.
#Event ID 13: A reboot is necessary before the selectable update CbsUpdateChangeState.UpdateName of package CbsUpdateChangeState.PackageIdentifier can be turned on.
#Message #
Fields #
| Name | Description |
|---|---|
updateName | |
identifier | |
errorCode | |
client |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "BD12F3B8-FC40-4A61-A307-B7A013A069C1",
"event_source_name": "",
"event_id": 13,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2022-04-04T10:59:07.927880+00:00",
"event_record_id": 85,
"correlation": {},
"execution": {
"process_id": 3472,
"thread_id": 2576
},
"channel": "Setup",
"computer": "WIN-TKC15D7KHUR",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "TFTP",
"PackageIdentifier": "Microsoft-Windows-TFTP-Client",
"ErrorCode": "0x0",
"Client": "DISM Package Manager Provider"
}
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 14: A reboot is necessary before the selectable update updateName of package identifier can be turned off.
#Message #
Fields #
| Name | Description |
|---|---|
CbsUpdateChangeState.UpdateName | |
CbsUpdateChangeState.PackageIdentifier | |
CbsUpdateChangeState.ErrorCode | |
CbsUpdateChangeState.Client | |
updateName UnicodeString | |
identifier UnicodeString | |
errorCode UnicodeString | |
client UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 14,
"version": 0,
"level": 0,
"task": 1,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-04-17T04:14:39.3221439+00:00",
"event_record_id": 170,
"correlation": {
"ActivityID": "{88818765-142B-403C-9C5F-A690EC1C7401}"
},
"execution": {
"process_id": 4220,
"thread_id": 536
},
"channel": "Setup",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsUpdateChangeState": {
"UpdateName": "Containers-DisposableClientVM",
"PackageIdentifier": "Containers-OptionalFeature-DisposableClientVM",
"ErrorCode": "0x0",
"Client": "DISM Package Manager Provider"
}
},
"message": "A reboot is necessary before the selectable update Containers-DisposableClientVM of package Containers-OptionalFeature-DisposableClientVM can be turned off."
}
Event ID 15: Selectable update updateName of package identifier was successfully turned off with its payload removed.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
errorCode UnicodeString | |
client UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"event_id": 15,
"level": 0,
"task": 1,
"opcode": 0,
"time_created": "2026-04-18T00:32:48.5275254+00:00",
"computer": "WIN11-25H2-X64",
"channel": "Setup"
},
"event_data": {
"PackageIdentifier": "UserExperience-Recall",
"ErrorCode": "0x0",
"UpdateName": "Recall",
"Client": "DISM Package Manager Provider"
}
}
Example keys not documented in the fields table: Client, ErrorCode, PackageIdentifier, UpdateName
Event ID 16: Update updateName of package identifier failed to be turned off.
#Event ID 18: START [Resolve]:[EventReport].
#Event ID 21: START [Execute]:[EventReport].
#Event ID 33: START [DPX Expansion]:[EventReport].
#Event ID 34: END [DPX Expansion]:[EventReport].
#Event ID 35: START [Doq Stage]:[EventReport].
#Event ID 37: END [Doq Stage]:[EventReport].
#Event ID 38: START [Doq Unstage]:[EventReport].
#Event ID 39: END [Doq Unstage]:[EventReport].
#Event ID 40: START [Doq Critical Install]:[EventReport].
#Event ID 41: END [Doq Critical Install]:[EventReport].
#Event ID 42: START [Doq Install]:[EventReport].
#Event ID 43: END [Doq Install]:[EventReport].
#Event ID 44: STARt [Doq Critical Uninstall]:[EventReport].
#Event ID 45: END [Doq Critical Uninstall]:[EventReport].
#Event ID 46: START [Doq Uninstall]:[EventReport].
#Event ID 47: END [Doq Uninstall]:[EventReport].
#Event ID 48: START [Doq Device Install]:[EventReport].
#Event ID 49: END [Doq Device Install]:[EventReport].
#Event ID 50: START [InstallUninstall]:[EventReport].
#Event ID 51: END [InstallUninstall]:[EventReport].
#Event ID 52: START [Poqexec]:[EventReport].
#Event ID 54: START [Shutdown Processing]:[EventReport].
#Event ID 55: END [Shutdown Processing]:[EventReport].
#Event ID 56: START [Non-Critical Doq]:[EventReport].
#Event ID 57: END [Non-Critical Doq]:[EventReport].
#Event ID 58: START [Critical Doq]:[EventReport].
#Event ID 59: END [Critical Doq]:[EventReport].
#Event ID 61: END [Plan Package]:[EventReport].
#Event ID 62: TrustedInstaller Finalize Event Report:[EventReport].
#Event ID 63: TrustedInstaller Initialize Event Report:[EventReport].
#Event ID 64: Doq Stage Progress Event Report:[EventReport].
#Event ID 65: Doq Unstage Progress Event Report:[EventReport].
#Event ID 66: Doq Install Progress Event Report:[EventReport].
#Event ID 67: Doq Uninstall Progress Event Report:[EventReport].
#Event ID 68: Startup Complete Event Report:[EventReport].
#Event ID 69: START [AI Queue Processing]:[DescString].
#Event ID 70: END [AI Queue Processing]:[DescString].
#Event ID 71: START [AI Install]:[Description = [DescString], Phase = [Phase], Mode = [Mode], PrevComponent=[PrevComponent], NewComponent=[NewComponent]].
#Event ID 72: END [AI Install]:[Status=[DescString]].
#Event ID 74: CSI INSTALL Deployment Event Report: [DescString].
#Event ID 75: CSI UNINSTALL Deployment Event Report: [DescString].
#Event ID 76: START [KTM Transaction]:[DescString].
#Event ID 77: END [KTM Transaction]:[DescString].
#Event ID 78: CSI COMPRESS Event Report: [DescString].
#Event ID 79: CSI Stage Component Event Report: [DescString].
#Event ID 80: CSI AI Completion Event Report: [DescString].
#Event ID 82: START [CSI SMIPI]:[DescString].
#Event ID 84: CSI SMIPI INSTALL Event Report: [DescString].
#Event ID 85: CSI Transaction Start Event Report: [DescString].
#Event ID 86: CSI Transaction End Event Report: [DescString].
#Event ID 87: START [CSI Corruption Detection Event]:[DescString].
#Event ID 88: END [CSI Corruption Detection Event]:[DescString].
#Event ID 89: START [CSI Corruption Repair Event]:[DescString].
#Event ID 90: END [CSI Corruption Repair Event]:[DescString].
#Event ID 91: START [CSI Scavenge]:[DescString].
#Event ID 92: END [CSI Scavenge]:[DescString].
#Event ID 93: START [CBS Scavenge]:[EventReport].
#Event ID 94: END [CBS Scavenge]:[EventReport].
#Event ID 95: START [Archive Logs]:[EventReport].
#Event ID 96: END [Archive Logs]:[EventReport].
#Event ID 97: START [Drain Catalogs]:[EventReport].
#Event ID 98: END [Drain Catalogs]:[EventReport].
#Event ID 99: START [Automatic Deepclean]:[EventReport].
#Event ID 100: END [Automatic Deepclean]:[EventReport].
#Event ID 101: START [Manual Deepclean]:[EventReport].
#Event ID 102: END [Manual Deepclean]:[EventReport].
#Event ID 103: START [Delete Session Files]:[EventReport].
#Event ID 104: END [Delete Session Files]:[EventReport].
#Event ID 105: Progress: UI message updated.
#Event ID 1000: Windows Servicing is processing hotpatch package identifier(releaseType).
#Event ID 1001: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is not enabled for hotpatching.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1002: Windows Servicing disabled hotpatching for package identifier(releaseType) because servicing is being performed offline.
#Event ID 1003: Windows Servicing disabled hotpatching for package identifier(releaseType) because a reboot is required to complete a prior operation.
#Event ID 1004: Windows Servicing successfully installed hotpatching package identifier(releaseType).
#Event ID 1005: Windows Servicing has required a reboot to complete the installation of hotpatching package identifier(releaseType).
#Event ID 1006: Windows Servicing disabled hotpatching for package identifier(releaseType) because a file could not be replaced immediately.
#Event ID 1007: Windows Servicing disabled hotpatching for package identifier(releaseType) because required files or custom actions are incompatible with hotpatching.
#Event ID 1008: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because the hotpatch installer required a reboot.
#Event ID 1009: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because of an error (errorCode).
#Event ID 1010: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is being set to state updateStateLoc(updateState).
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1011: Windows Servicing disabled hotpatching for package identifier(releaseType) because hotpatch update updateName will not be installed.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1012: Windows Servicing disabled hotpatching for package identifier(releaseType) to process regular update updateName.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1013: Initiating system store corruption detection and repair.
#Description
Initiating system store corruption detection and repair. Detection Only: detectionType, Automatically Triggered: triggerType.
Message #
Fields #
| Name | Description |
|---|---|
CbsStoreCorruptionRepairStart.DetectionOnly | |
CbsStoreCorruptionRepairStart.AutoTriggered | |
detectionType UInt32 | |
triggerType UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 1013,
"version": 0,
"level": 0,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T02:09:07.6272920+00:00",
"event_record_id": 183,
"correlation": {
"ActivityID": "{085B8FD5-7274-4CCD-A741-0CB01744C0E8}"
},
"execution": {
"process_id": 13664,
"thread_id": 7404
},
"channel": "Setup",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsStoreCorruptionRepairStart": {
"DetectionOnly": "1",
"AutoTriggered": "0"
}
},
"message": "Initiating system store corruption detection and repair. Detection Only: 1, Automatically Triggered: 0."
}
Event ID 1014: System store corruption detection and repair has completed.
#Description
System store corruption detection and repair has completed. Status: errorCode, Total instances of corruption found: totalCorruption, total instances of corruption repaired: repaired.
Message #
Fields #
| Name | Description |
|---|---|
CbsStoreCorruptionRepairFinish.ErrorCode | |
CbsStoreCorruptionRepairFinish.Repaired | |
CbsStoreCorruptionRepairFinish.TotalCorruption | |
errorCode UnicodeString | |
repaired UInt32 | |
totalCorruption UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 1014,
"version": 0,
"level": 0,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T02:13:58.8361346+00:00",
"event_record_id": 184,
"correlation": {
"ActivityID": "{085B8FD5-7274-4CCD-A741-0CB01744C0E8}"
},
"execution": {
"process_id": 13664,
"thread_id": 7404
},
"channel": "Setup",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsStoreCorruptionRepairFinish": {
"ErrorCode": "0x0",
"Repaired": "0",
"TotalCorruption": "1"
}
},
"message": "System store corruption detection and repair has completed. Status: 0x0, Total instances of corruption found: 1, total instances of corruption repaired: 0."
}
Event ID 1015: repaired of totalCorruption instances of system store corruption have been repaired.
#Description
repaired of totalCorruption instances of system store corruption have been repaired. Unrepaired corruptions may lead to failures in future system servicing.
Message #
Fields #
| Name | Description |
|---|---|
CbsStoreCorruptionRepairFinish.ErrorCode | |
CbsStoreCorruptionRepairFinish.Repaired | |
CbsStoreCorruptionRepairFinish.TotalCorruption | |
errorCode UnicodeString | |
repaired UInt32 | |
totalCorruption UInt32 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Servicing",
"guid": "{BD12F3B8-FC40-4A61-A307-B7A013A069C1}",
"event_source_name": "",
"event_id": 1015,
"version": 0,
"level": 3,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T02:13:58.8361368+00:00",
"event_record_id": 185,
"correlation": {
"ActivityID": "{085B8FD5-7274-4CCD-A741-0CB01744C0E8}"
},
"execution": {
"process_id": 13664,
"thread_id": 7404
},
"channel": "Setup",
"computer": "JD-DC01-2022.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"user_data": {
"CbsStoreCorruptionRepairFinish": {
"ErrorCode": "0x0",
"Repaired": "0",
"TotalCorruption": "1"
}
},
"message": "0 of 1 instances of system store corruption have been repaired. Unrepaired corruptions may lead to failures in future system servicing."
}
Event ID 4371: Windows Servicing started a process of changing package identifier(releaseType) state from initialPackageStateLoc(initialPackageState) to packageStateLoc(packageState)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
initialPackageStateLoc UnicodeString | |
initialPackageState UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
client UnicodeString | |
supportInformation UnicodeString |
Event ID 4372: Windows Servicing is setting package identifier(releaseType) state to packageStateLoc(packageState)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4373: Windows Servicing successfully set package identifier(releaseType) state to packageStateLoc(packageState)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4374: Windows Servicing identified that package identifier(releaseType) is not applicable for this system
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4375: Windows Servicing failed to complete the process of setting package identifier (releaseType) into packageStateLoc(packageState) state
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4376: Servicing has required reboot to complete the operation of setting package identifier(releaseType) into packageStateLoc(packageState) state
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4383: Windows Servicing completed the process of changing update updateName from package identifier (releaseType) into updateStateLoc(updateState) state
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4385: Windows Servicing failed to complete the process of changing update updateName from package identifier(releaseType) into updateStateLoc(updateState) state
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4386: Windows Servicing required reboot to complete the process of changing update updateName from package identifier(releaseType) into updateStateLoc(updateState) state
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4400: Windows Servicing is processing hotpatch package identifier(releaseType)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4401: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is not enabled for hotpatching
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4402: Windows Servicing disabled hotpatching for package identifier(releaseType) because servicing is being performed offline
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4403: Windows Servicing disabled hotpatching for package identifier(releaseType) because a reboot is required to complete a prior operation
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4404: Windows Servicing successfully installed hotpatching package identifier(releaseType)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4405: Windows Servicing has required a reboot to complete the installation of hotpatching package identifier(releaseType)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4406: Windows Servicing disabled hotpatching for package identifier(releaseType) because a file could not be replaced immediately
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4407: Windows Servicing disabled hotpatching for package identifier(releaseType) because required files or custom actions are incompatible with hotpatching
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4408: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because the hotpatch installer required a reboot
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4409: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because of an error (errorCode)
#Fields #
| Name | Description |
|---|---|
identifier UnicodeString | |
releaseType UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 4416: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is being set to state updateStateLoc(updateState)
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4417: Windows Servicing disabled hotpatching for package identifier(releaseType) because hotpatch update updateName will not be installed
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 4418: Windows Servicing disabled hotpatching for package identifier(releaseType) to process regular update
#Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1073746195: Windows Servicing started a process of changing package identifier(releaseType) state from initialPackageStateLoc(initialPackageState) to packageStateLoc(packageState).
#Message #
Fields #
| Name | Description |
|---|---|
identifier UnicodeString | Windows Servicing started a process of changing package |
releaseType UnicodeString | |
initialPackageStateLoc UnicodeString | ) state from |
initialPackageState UnicodeString | |
packageStateLoc UnicodeString | |
packageState UnicodeString | |
packageAssembly UnicodeString | |
client UnicodeString | |
supportInformation UnicodeString |
Event ID 1073746196: Windows Servicing is setting package identifier(releaseType) state to packageStateLoc(packageState).
#Message #
Fields #
| Name | Description |
|---|---|
identifier UnicodeString | Windows Servicing is setting package |
releaseType UnicodeString | |
packageStateLoc UnicodeString | ) state to |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 1073746197: Windows Servicing successfully set package identifier(releaseType) state to packageStateLoc(packageState).
#Message #
Fields #
| Name | Description |
|---|---|
identifier UnicodeString | Windows Servicing successfully set package |
releaseType UnicodeString | |
packageStateLoc UnicodeString | ) state to |
packageState UnicodeString | |
packageAssembly UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString | |
missingElements UnicodeString |
Event ID 1073746207: Windows Servicing completed the process of changing update updateName from package identifier (releaseType) into updateStateLoc(updateState) state.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1073746224: Windows Servicing is processing hotpatch package identifier(releaseType).
#Event ID 1073746225: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is not enabled for hotpatching.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 1073746226: Windows Servicing disabled hotpatching for package identifier(releaseType) because servicing is being performed offline.
#Event ID 1073746227: Windows Servicing disabled hotpatching for package identifier(releaseType) because a reboot is required to complete a prior operation.
#Event ID 1073746228: Windows Servicing successfully installed hotpatching package identifier(releaseType).
#Event ID 1073746229: Windows Servicing has required a reboot to complete the installation of hotpatching package identifier(releaseType).
#Event ID 1073746240: Windows Servicing disabled hotpatching for package identifier(releaseType) because update updateName is being set to state updateStateLoc(updateState).
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 2147488022: Windows Servicing identified that package identifier(releaseType) is not applicable for this system.
#Event ID 2147488024: Servicing has required reboot to complete the operation of setting package identifier(releaseType) into packageStateLoc(packageState) state.
#Event ID 2147488034: Windows Servicing required reboot to complete the process of changing update updateName from package identifier(releaseType) into updateStateLoc(updateState) state.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 2147488054: Windows Servicing disabled hotpatching for package identifier(releaseType) because a file could not be replaced immediately.
#Event ID 2147488055: Windows Servicing disabled hotpatching for package identifier(releaseType) because required files or custom actions are incompatible with hotpatching.
#Event ID 2147488056: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because the hotpatch installer required a reboot.
#Event ID 2147488057: Windows Servicing failed to perform hotpatching for package identifier(releaseType) because of an error (errorCode).
#Event ID 2147488065: Windows Servicing disabled hotpatching for package identifier(releaseType) because hotpatch update updateName will not be installed.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 2147488066: Windows Servicing disabled hotpatching for package identifier(releaseType) to process regular update updateName.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Event ID 3221229847: Windows Servicing failed to complete the process of setting package identifier (releaseType) into packageStateLoc(packageState) state.
#Event ID 3221229857: Windows Servicing failed to complete the process of changing update updateName from package identifier(releaseType) into updateStateLoc(updateState) state.
#Message #
Fields #
| Name | Description |
|---|---|
updateName UnicodeString | |
identifier UnicodeString | |
releaseType UnicodeString | |
updateStateLoc UnicodeString | |
updateState UnicodeString | |
packageAssembly UnicodeString | |
updateDisplayName UnicodeString | |
operation UnicodeString | |
operationCompleted UnicodeString | |
errorCode UnicodeString | |
rebootOption UnicodeString |
Provenance
ETW provider GUID bd12f3b8-fc40-4a61-a307-b7a013a069c1
Defined in cbsmsg.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB