Microsoft-Windows-TerminalServices-RdpSoundDriver

Event	Title	Channel	Sample	Rule
1000	Server version: UInt32_1.	Playback	N	N
1001	Playback format.	Playback	N	N
1002	Playback format changed to: Format: UINT16_FORMAT_TAG Channels: …	Playback	N	N
1003	Audio playback redirection is enabled.	Playback	N	N
1004	Audio playback redirection was disabled by the client computer.	Playback	N	N
1005	Audio playback redirection was disabled because of a licensing issue.	Playback	N	N
1006	Audio playback redirection was disabled by using Group Policy.	Playback	N	N
1007	Audio playback redirection was disabled by using the Windows Registry.	Playback	N	N
1008	Audio playback redirection was disabled by an administrator.	Playback	N	N
1009	Audio playback redirection quality mode: UInt32Parameter Quality mode is a …	Playback	N	N
2003	Audio recording redirection is enabled.	Capture	N	N
2004	Audio recording redirection was disabled by the client computer.	Capture	N	N
2005	Audio recording redirection was disabled because of a licensing issue.	Capture	N	N
2006	Audio recording redirection was disabled by using Group Policy.	Capture	N	N
2007	Audio recording redirection was disabled by using the Windows Registry.	Capture	N	N
2008	Audio recording redirection was disabled by an administrator.	Capture	N	N
2009	Audio recording redirection is not available when the account is using session …	Capture	N	N

Event ID 1000: Server version: UInt32_1.

Channel: Playback
Task: SettingsCheck

Message #

Server version: %1
Client version: %2

Fields #

Name	Description
`UInt32_1` UInt32
`UInt32_2` UInt32
`SessionID` UInt32

Event ID 1001: Playback format.

Channel: Playback
Task: StreamSetup

Message #

Playback format:

Format: %1
Channels: %2
Samples per second: %3
Avg. Bytes per second: %4
Block align: %5
Bits per sample: %6

Fields #

Name	Description
`UINT16_FORMAT_TAG` UInt16
`UINT16_NUM_CHANNELS` UInt16
`UINT32_SAMPLES_PER_SECOND` UInt32
`UINT32_AVERAGE_BYTES_PER_SECOND` UInt32
`UINT16_BLOCK_ALIGN` UInt16
`UINT16_BITS_PER_SAMPLE` UInt16
`UINT16_STRUCTURE_SIZE` UInt16
`SessionID` UInt32

Event ID 1002: Playback format changed to: Format: UINT16_FORMAT_TAG Channels: UINT16_NUM_CHANNELS Samples per second: UINT32_SAMPLES_PER_SECOND Avg.

Channel: Playback
Task: SettingsChange

Description

Playback format changed to.

Message #

Playback format changed to:

Format: %1
Channels: %2
Samples per second: %3
Avg. Bytes per second: %4
Block align: %5
Bits per sample: %6

Fields #

Name	Description
`UINT16_FORMAT_TAG` UInt16
`UINT16_NUM_CHANNELS` UInt16
`UINT32_SAMPLES_PER_SECOND` UInt32
`UINT32_AVERAGE_BYTES_PER_SECOND` UInt32
`UINT16_BLOCK_ALIGN` UInt16
`UINT16_BITS_PER_SAMPLE` UInt16
`UINT16_STRUCTURE_SIZE` UInt16
`SessionID` UInt32

Event ID 1003: Audio playback redirection is enabled.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1004: Audio playback redirection was disabled by the client computer.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1005: Audio playback redirection was disabled because of a licensing issue.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1006: Audio playback redirection was disabled by using Group Policy.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1007: Audio playback redirection was disabled by using the Windows Registry.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1008: Audio playback redirection was disabled by an administrator.

Channel: Playback
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 1009: Audio playback redirection quality mode: UInt32Parameter Quality mode is a bitmask where Dynamic=0x01, Medium=0x02, and High Quality = 0x04.

Channel: Playback
Task: SettingsCheck

Description

Audio playback redirection quality mode: UInt32Parameter.

Message #

Audio playback redirection quality mode: %2

Quality mode is a bitmask where Dynamic=0x01, Medium=0x02, and High Quality = 0x04.

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2003: Audio recording redirection is enabled.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2004: Audio recording redirection was disabled by the client computer.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2005: Audio recording redirection was disabled because of a licensing issue.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2006: Audio recording redirection was disabled by using Group Policy.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2007: Audio recording redirection was disabled by using the Windows Registry.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2008: Audio recording redirection was disabled by an administrator.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Event ID 2009: Audio recording redirection is not available when the account is using session zero.

Channel: Capture
Task: SettingsCheck

Fields #

Name	Description
`StringParameter` UnicodeString
`UInt32Parameter` UInt32
`SessionID` UInt32

Provenance

ETW provider GUID 127e0dc5-e13b-4935-985e-78fd508b1d80

Defined in rdpendp.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB