detection.wiki

Microsoft-Windows-SettingSync-Desktop

EventTitleChannelSampleRule
5001The system failed to request a sync for collection {CollectionId} (operation: …OperationalNN
5002The setting unit {SettingUnitId} for collection {CollectionId} is invalid.OperationalNN
5003Starting or stopping setting change publisher for {CollectionId} failed.OperationalNN
5004Failed to create process '{CollectionId}' (Result: {HRESULT}).OperationalNN
5005Starting the setting monitor SSO failed.OperationalNN
5006Starting the WNF listener failed.OperationalNN
5007Event ID 5007OperationalNN
5008Event ID 5008OperationalNN
5009Event ID 5009OperationalNN
6001The sync provider requested that {CollectionId} not upload now.DebugNN
6002Starting or stopping setting change publisher for {CollectionId} failed.DebugNN
6501Wnf event callback failure.DebugNN
6502StartLayoutSync - Load layout data from stream.DebugNN
6503PicturePasswordPicture image validation failed (HRESULT: {HRESULT}).DebugNN
6509Event ID 6509DebugNN
6510Event ID 6510DebugNN
6511Event ID 6511DebugNN
6512Monitor SSO {Message} blocked.DebugNN

Event ID 5001: The system failed to request a sync for collection {CollectionId} (operation: {Operation}; Result: {HRESULT}).

#
Channel
Operational

Fields #

NameDescription
CollectionId
Operation
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
HRESULT

Event ID 5002: The setting unit {SettingUnitId} for collection {CollectionId} is invalid.

#
Channel
Operational

Description

The setting unit {SettingUnitId} for collection {CollectionId} is invalid. (operation: {Operation}; Result: {HRESULT}).

Message #

The setting unit {SettingUnitId} for collection {CollectionId} is invalid. (operation: {Operation}; Result: {HRESULT}).

Fields #

NameDescription
SettingUnitId
CollectionId
Operation
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
HRESULT

Event ID 5003: Starting or stopping setting change publisher for {CollectionId} failed.

#
Channel
Operational

Description

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT}).

Message #

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT})

Fields #

NameDescription
CollectionId
HRESULT

Event ID 5004: Failed to create process '{CollectionId}' (Result: {HRESULT}).

#
Channel
Operational

Fields #

NameDescription
CollectionId
HRESULT

Event ID 5005: Starting the setting monitor SSO failed.

#
Channel
Operational

Description

Starting the setting monitor SSO failed. (Message: {Message}; Result: {HRESULT}).

Message #

Starting the setting monitor SSO failed.  (Message: {Message}; Result: {HRESULT})

Fields #

NameDescription
Message
HRESULT

Event ID 5006: Starting the WNF listener failed.

#
Channel
Operational

Description

Starting the WNF listener failed. (Message: {Message}; Result: {HRESULT}).

Message #

Starting the WNF listener failed.  (Message: {Message}; Result: {HRESULT})

Fields #

NameDescription
Message
HRESULT

Event ID 5007

#
Channel
Operational

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 5008

#
Channel
Operational

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 5009

#
Channel
Operational

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 6001: The sync provider requested that {CollectionId} not upload now.

#
Channel
Debug

Description

The sync provider requested that {CollectionId} not upload now. It will retry the upload later.

Message #

The sync provider requested that {CollectionId} not upload now.  It will retry the upload later.

Fields #

NameDescription
CollectionId

Event ID 6002: Starting or stopping setting change publisher for {CollectionId} failed.

#
Channel
Debug

Description

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT}).

Message #

Starting or stopping setting change publisher for {CollectionId} failed. (Result: {HRESULT})

Fields #

NameDescription
CollectionId
HRESULT

Event ID 6501: Wnf event callback failure.

#
Channel
Debug

Description

Wnf event callback failure. State Name: {Message}. HRESULT: {HRESULT}.

Message #

Wnf event callback failure. State Name: {Message}. HRESULT: {HRESULT}.

Fields #

NameDescription
Message
HRESULT

Event ID 6502: StartLayoutSync - Load layout data from stream.

#
Channel
Debug

Description

StartLayoutSync - Load layout data from stream. (HRESULT: {HRESULT}).

Message #

StartLayoutSync - Load layout data from stream. (HRESULT: {HRESULT})

Fields #

NameDescription
HRESULT

Event ID 6503: PicturePasswordPicture image validation failed (HRESULT: {HRESULT}).

#
Channel
Debug

Fields #

NameDescription
HRESULT

Event ID 6509

#
Channel
Debug

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 6510

#
Channel
Debug

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 6511

#
Channel
Debug

Description

{Message}.

Message #

{Message}

Fields #

NameDescription
Message

Event ID 6512: Monitor SSO {Message} blocked.

#
Channel
Debug

Description

Monitor SSO {Message} blocked. SSF monitors not required as uploads are blocked by removal policy.

Message #

Monitor SSO {Message} blocked. SSF monitors not required as uploads are blocked by removal policy.

Fields #

NameDescription
Message