Microsoft-Windows-StartupRepair
66 events across 2 channels
Event ID 1001: Startup Repair successfully completed repairs.
#Event ID 1002: Startup Repair failed.
#Event ID 1101: The master boot record (MBR) was corrupt.
#Event ID 1102: The partition table was corrupt.
#Event ID 1103: The boot sector on the system partition was corrupt.
#Event ID 1104: The system volume was corrupt.
#Event ID 1105: Windows startup files were not found on the disk.
#Event ID 1106: A hard disk could not be found.
#Event ID 1107: A valid system partition was not found.
#Event ID 1108: The boot manager was missing.
#Event ID 1109: The boot manager was corrupt.
#Event ID 1110: The boot manager failed to find the Windows loader.
#Event ID 1112: The Windows loader was corrupt.
#Event ID 1113: The boot configuration data was corrupt.
#Event ID 1114: The boot configuration data was corrupt.
#Event ID 1115: The boot configuration data was missing.
#Event ID 1116: Windows could not detect the problem.
#Event ID 1117: A possible problem with hardware memory (RAM) might have prevented Windows from starting.
#Event ID 1118: Startup Repair tried several times but could not determine the cause of the problem.
#Event ID 1119: Failure during the installation of Windows.
#Event ID 1120: The following file necessary for Windows startup was missing: Info.
#Event ID 1121: The following file necessary for Windows startup was corrupt: Info.
#Event ID 1122: The registry hive was corrupt.
#Event ID 1123: Windows was unable to determine the problem.
#Event ID 1124: A recent driver installation or upgrade might have prevented Windows from starting.
#Event ID 1125: A software patch prevented the system from starting.
#Event ID 1126: An error on the hard disk prevented Windows from starting.
#Event ID 1127: An access control list (ACL) on the following file might have prevented Windows from starting : Info.
#Event ID 1128: Security settings on this computer prevented Windows from starting.
#Event ID 1129: Low disk space on this computer prevented Windows from starting.
#Event ID 1130: Windows could not recognize the system partition type.
#Event ID 1131: The boot configuration data was corrupt.
#Event ID 1132: This operating system version is not supported by Startup Repair.
#Event ID 1133: The computer firmware (BIOS) is not compatible with Windows.
#Event ID 1134: The boot sector code on the system partition was corrupt.
#Event ID 1135: Several files necessary for Windows startup were corrupt.
#Event ID 1136: This version of Startup Repair is not compatible with currently installed updates to Windows.
#Event ID 1137: Unspecified changes to system configuration might have caused the problem.
#Event ID 1138: The computer hard disk is encrypted using BitLocker Drive Encryption and could not be unlocked.
#Event ID 1139: The WIMBoot configuration file was corrupt.
#Event ID 1140: An in-progress package installation may be preventing Windows from starting.
#Event ID 1141: Last installed LCU may be preventing Windows from starting.
#Event ID 1142: An error is detected by Recovery plugin
#Description
An error is detected by Recovery plugin.
Fields #
| Name | Description |
|---|---|
Info UnicodeString |
Event ID 1142: An error is detected by Recovery plugin.
#Event ID 1201: Repaired the master boot record (MBR).
#Event ID 1202: Reconstructed the partition table.
#Event ID 1203: Restored the boot sector from backup files.
#Event ID 1204: Repaired file system errors.
#Event ID 1205: Scheduled a hardware memory (RAM) test.
#Event ID 1206: Copied the following file from backup files: Info.
#Event ID 1207: Reconstructed boot configuration data.
#Event ID 1208: Restored system to an earlier restore point.
#Event ID 1209: Fixed access control list (ACL) on the following file: Info.
#Event ID 1210: Restored the registry from backup files.
#Event ID 1211: Fixed the CrashOnAuditFailure registry setting.
#Event ID 1212: Restored the boot sector code.
#Event ID 1213: Repaired the corrupted files from backup.
#Event ID 1214: Removed service start type overrides.
#Event ID 1215: Repaired the WIMBoot configuration file.
#Event ID 1216: Aborted all pending package installations.
#Event ID 1217: Uninstall latest LCU.
#Event ID 1218: Uninstall recently installed driver updates.
#Event ID 1219: Perform remediation from Recovery Plugins (local)
#Description
Perform remediation from Recovery Plugins (local).
Fields #
| Name | Description |
|---|---|
RepairStatus UInt32 | |
Info UnicodeString |
Event ID 1219: Perform remediation from Recovery Plugins (local).
#Event ID 1220: Perform remediation from Recovery Plugins (cloud)
#Description
Perform remediation from Recovery Plugins (cloud).
Fields #
| Name | Description |
|---|---|
RepairStatus UInt32 | |
Info UnicodeString |
Event ID 1220: Perform remediation from Recovery Plugins (cloud).
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID c914f0df-835a-4a22-8c70-732c9a80c634
Defined in reagent.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3323, captured 2026-06-02