Microsoft-Windows-Spell-Checking

Event	Title	Channel	Sample	Rule
0	Reinitialize Provider	Analytic	N	N
1	Initialize wordlist request sent to provider	Analytic	N	N
2	Initialize wordlist request returned from provider	Analytic	N	N
3	Check request sent to provider	Analytic	N	N
4	Check request returned from provider	Analytic	N	N
5	CreateSpellChecker request sent to provider	Analytic	N	N
6	CreateSpellChecker request received from provider	Analytic	N	N
7	Suggest request sent to provider	Analytic	N	N
8	Suggest request receive from provider	Analytic	N	N
9	EnumSpellingErrorDecorator Next Start	Analytic	N	N
10	EnumSpellingErrorDecorator Next Stop	Analytic	N	N
11	SupportedLanguages request sent to provider	Analytic	N	N
12	SupportedLanguages request received from provider	Analytic	N	N
13	Initialize Provider start	Analytic	N	N
14	Initialize Provider complete	Analytic	N	N
16	File First is not Unicode (UTF-16LE).	Application	N	N
17	File string is not Unicode (UTF-16LE).	Application	N	N
18	string is not a directory.	Application	N	N
19	Unable to create directory string.	System	N	N
20	Attempt to initialize wordlist wordlist in languageTag spell checker failed.	Application	N	N
21	Get option value request sent to provider	Analytic	N	N
22	Get option value request received from provider	Analytic	N	N
23	Initialize wordlist from files request sent to provider	Analytic	N	N
24	Initialize wordlist from files request returned from provider	Analytic	N	N
25	Initiated URI Check	Analytic	N	N
26	Finished URI Check	Analytic	N	N
27	Failed to launch the watcher thread for changes in user wordlists and spell …	Application	N	N
28	Failed to watch for user wordlist changes: hr.	Application	N	N
29	Failed to watch for spell checking option changes: hr.	Application	N	N
30	Spell checking provider returned error indexes out of the string boundaries.	Application	N	N
31	Failed to update wordlist user custom wordlist: hr.	Application	N	N
32	ComprehensiveCheck request sent to provider	Analytic	N	N
33	ComprehensiveCheck request returned from provider	Analytic	N	N
34	Failed to add "First" to the text prediction language model.	Application	N	N

Event ID 0: Reinitialize Provider

Channel: Analytic
Opcode: Info

Event ID 1: Initialize wordlist request sent to provider

Channel: Analytic
Task: Spellchecking
Opcode: Send

Fields #

Name	Description
`WordlistType` UInt32

Event ID 2: Initialize wordlist request returned from provider

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Fields #

Name	Description
`WordlistType` UInt32

Event ID 3: Check request sent to provider

Channel: Analytic
Task: Spellchecking
Opcode: Send

Event ID 4: Check request returned from provider

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Event ID 5: CreateSpellChecker request sent to provider

Channel: Analytic
Task: GetSuggestions
Opcode: Send

Event ID 6: CreateSpellChecker request received from provider

Channel: Analytic
Task: GetSuggestions
Opcode: Receive

Event ID 7: Suggest request sent to provider

Channel: Analytic
Task: GetSuggestions
Opcode: Send

Event ID 8: Suggest request receive from provider

Channel: Analytic
Task: GetSuggestions
Opcode: Receive

Event ID 9: EnumSpellingErrorDecorator Next Start

Channel: Analytic
Task: Spellchecking
Opcode: Send

Event ID 10: EnumSpellingErrorDecorator Next Stop

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Event ID 11: SupportedLanguages request sent to provider

Channel: Analytic
Opcode: Send

Event ID 12: SupportedLanguages request received from provider

Channel: Analytic
Opcode: Receive

Event ID 13: Initialize Provider start

Channel: Analytic
Opcode: Send

Event ID 14: Initialize Provider complete

Channel: Analytic
Opcode: Receive

Event ID 16: File First is not Unicode (UTF-16LE).

Channel: Application
Opcode: Info

Description

File First is not Unicode (UTF-16LE). It has been moved to Second.

Message #

File %1 is not Unicode (UTF-16LE). It has been moved to %2.

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString

Event ID 17: File string is not Unicode (UTF-16LE).

Channel: Application
Opcode: Info

Description

File string is not Unicode (UTF-16LE). Unable to rename it. This will block spell checkers from using wordlists in this directory.

Message #

File %1 is not Unicode (UTF-16LE). Unable to rename it. This will block spell checkers from using wordlists in this directory.

Fields #

Name	Description
`string` UnicodeString

Event ID 18: string is not a directory.

Channel: Application
Opcode: Info

Description

string is not a directory. Please remove or rename.

Message #

%1 is not a directory. Please remove or rename.

Fields #

Name	Description
`string` UnicodeString

Event ID 19: Unable to create directory string.

Channel: System
Opcode: Info

Message #

Unable to create directory %1.

Fields #

Name	Description
`string` UnicodeString

Event ID 20: Attempt to initialize wordlist wordlist in languageTag spell checker failed.

Channel: Application
Opcode: Info

Description

Attempt to initialize wordlist wordlist in languageTag spell checker failed. This could be due to a bug with the spell checker. The spell checker will remain available.

Message #

Attempt to initialize %1 wordlist in %2 spell checker failed. This could be due to a bug with the spell checker. The spell checker will remain available.

Fields #

Name	Description
`wordlist` UInt32
`languageTag` UnicodeString

Event ID 21: Get option value request sent to provider

Channel: Analytic
Task: Options
Opcode: Send

Event ID 22: Get option value request received from provider

Channel: Analytic
Task: Options
Opcode: Receive

Event ID 23: Initialize wordlist from files request sent to provider

Channel: Analytic
Task: Spellchecking
Opcode: Send

Fields #

Name	Description
`WordlistType` UInt32

Event ID 24: Initialize wordlist from files request returned from provider

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Fields #

Name	Description
`WordlistType` UInt32

Event ID 25: Initiated URI Check

Channel: Analytic
Task: Spellchecking
Opcode: Send

Event ID 26: Finished URI Check

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Event ID 27: Failed to launch the watcher thread for changes in user wordlists and spell checking options: hr.

Channel: Application
Opcode: Info

Description

Failed to launch the watcher thread for changes in user wordlists and spell checking options: hr. Spell checking will remain available, but no changes will be reported.

Message #

Failed to launch the watcher thread for changes in user wordlists and spell checking options: %1. Spell checking will remain available, but no changes will be reported.

Fields #

Name	Description
`hr` Int32

Event ID 28: Failed to watch for user wordlist changes: hr.

Channel: Application
Opcode: Info

Description

Failed to watch for user wordlist changes: hr. Spell checking will remain available, but no changes will be reported.

Message #

Failed to watch for user wordlist changes: %1. Spell checking will remain available, but no changes will be reported.

Fields #

Name	Description
`hr` Int32

Event ID 29: Failed to watch for spell checking option changes: hr.

Channel: Application
Opcode: Info

Description

Failed to watch for spell checking option changes: hr. Spell checking will remain available, but no changes will be reported.

Message #

Failed to watch for spell checking option changes: %1. Spell checking will remain available, but no changes will be reported.

Fields #

Name	Description
`hr` Int32

Event ID 30: Spell checking provider returned error indexes out of the string boundaries.

Channel: Application
Opcode: Info

Description

Spell checking provider returned error indexes out of the string boundaries. This indicates that the provider either has a bug or that it is malicious.

Message #

Spell checking provider returned error indexes out of the string boundaries. This indicates that the provider either has a bug or that it is malicious.

Event ID 31: Failed to update wordlist user custom wordlist: hr.

Channel: Application
Opcode: Info

Description

Failed to update wordlist user custom wordlist: hr. Spell checking will remain available, but this user wordlist will not be updated.

Message #

Failed to update %1 user custom wordlist: %2. Spell checking will remain available, but this user wordlist will not be updated.

Fields #

Name	Description
`wordlist` UInt32
`hr` Int32

Event ID 32: ComprehensiveCheck request sent to provider

Channel: Analytic
Task: Spellchecking
Opcode: Send

Event ID 33: ComprehensiveCheck request returned from provider

Channel: Analytic
Task: Spellchecking
Opcode: Receive

Event ID 34: Failed to add "First" to the text prediction language model.

Channel: Application
Opcode: Info

Description

Failed to add "First" to the text prediction language model. Language tag - Second, HRESULT - hr. The word has still been added to the spell checker custom dictionary.

Message #

Failed to add "%1" to the text prediction language model. Language tag - %2, HRESULT - %3. The word has still been added to the spell checker custom dictionary.

Fields #

Name	Description
`First` UnicodeString
`Second` UnicodeString
`hr` Int32

Provenance

ETW provider GUID d0e22efc-ac66-4b25-a72d-382736b5e940

Defined in MsSpellCheckingFacility.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB