Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP

54 events across 4 channels

Event	Title	Channel	Sample
2	Event ID 2	Debug	N
2	Event ID 2	Operational	N
3	Event ID 3	Debug	N
3	Event ID 3	Operational	N
4	Event ID 4	Analytic	N
4	Event ID 4	Operational	N
5	Event ID 5	Analytic	N
5	Event ID 5	Operational	N
6	Event ID 6	Debug	N
6	Event ID 6	Operational	N
7	Event ID 7	Debug	N
7	Event ID 7	Operational	N
8	Event ID 8	Analytic	N
8	Event ID 8	Operational	N
9	Event ID 9	Analytic	N
9	Event ID 9	Operational	N
100	Remote Desktop IP Virtualization has started.	Admin	N
100	Event ID 100	Operational	N
101	Remote Desktop IP Virtualization has ended.	Admin	N
101	Event ID 101	Operational	N
102	An error occurred when the computer tried to start Remote Desktop IP …	Admin	N
102	Event ID 102	Operational	N
103	Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID …	Admin	N
103	Event ID 103	Operational	N
104	Remote Desktop IP Virtualization released the IP address, Param1, for session ID …	Admin	N
104	Event ID 104	Operational	N
105	Remote Desktop IP Virtualization could not acquire an IP address for session ID …	Admin	N
105	Event ID 105	Operational	N
106	Remote Desktop IP Virtualization could not release the IP address for session ID …	Admin	N
106	Event ID 106	Operational	N
107	Remote Desktop IP Virtualization will virtualize the application, Param1, on …	Admin	N
107	Event ID 107	Operational	N
108	Remote Desktop IP Virtualization will virtualize the application, Param1, on …	Admin	N
108	Event ID 108	Operational	N
109	Remote Desktop IP Virtualization did not virtualize the application, Param1, on …	Admin	N
109	Event ID 109	Operational	N
110	Remote Desktop IP Virtualization did not virtualize the application, Param1, on …	Admin	N
110	Event ID 110	Operational	N
111	Remote Desktop IP Virtualization detected more than one network adapter.	Admin	N
111	Event ID 111	Operational	N
112	Remote Desktop IP Virtualization will use the network adapter with the MAC …	Admin	N
112	Event ID 112	Operational	N
113	Remote Desktop IP Virtualization could not find the network adapter that matches …	Admin	N
113	Event ID 113	Operational	N
114	Remote Desktop IP Virtualization could not load Param1.	Admin	N
114	Event ID 114	Operational	N
115	Remote Desktop IP Virtualization could not renew the IP address, Param1.	Admin	N
115	Event ID 115	Operational	N
116	Remote Desktop IP Virtualization could not renew the IP address, Param1, for …	Admin	N
116	Event ID 116	Operational	N
117	Remote Desktop IP Virtualization successfully renewed the IP address, message.	Admin	N
117	Event ID 117	Operational	N
118	Remote Desktop IP Virtualization could not allocate the IP address, Param1, for …	Admin	N
118	Event ID 118	Operational	N

Event ID 2

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 2

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 3

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 3

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 4

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 4

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 5

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 5

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 6

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 6

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 7

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Debug

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 7

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 8

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 8

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 9

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Analytic

Message #

%1

Fields #

Name	Description
`message` AnsiString

Event ID 9

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Fields #

Name	Description
`message` AnsiString

Event ID 100: Remote Desktop IP Virtualization has started.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization has started.

Message #

Remote Desktop IP Virtualization has started.

Event ID 100

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization has started.

Event ID 101: Remote Desktop IP Virtualization has ended.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization has ended.

Message #

Remote Desktop IP Virtualization has ended.

Event ID 101

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization has ended.

Event ID 102: An error occurred when the computer tried to start Remote Desktop IP Virtualization: Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

An error occurred when the computer tried to start Remote Desktop IP Virtualization: Param1.

Message #

An error occurred when the computer tried to start Remote Desktop IP Virtualization: %1.

Fields #

Name	Description
`Param1` HexInt32

Event ID 102

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

An error occurred when the computer tried to start Remote Desktop IP Virtualization: .

Fields #

Name	Description
`Param1` HexInt32

Event ID 103: Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization assigned the IP address, Param1, to session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization assigned the IP address, %1,  to session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 103

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization assigned the IP address, , to session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 104: Remote Desktop IP Virtualization released the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization released the IP address, Param1, for session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization released the IP address, %1, for session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 104

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization released the IP address, , for session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 105: Remote Desktop IP Virtualization could not acquire an IP address for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not acquire an IP address for session ID Param2. Error code: Param1.

Message #

Remote Desktop IP Virtualization could not acquire an IP address for session ID %1.  Error code: %2

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 105

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not acquire an IP address for session ID . Error code.

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 106: Remote Desktop IP Virtualization could not release the IP address for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not release the IP address for session ID Param2. Error code: Param1.

Message #

Remote Desktop IP Virtualization could not release the IP address for session ID %1. Error code: %2

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 106

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not release the IP address for session ID . Error code.

Fields #

Name	Description
`Param2` Int32
`Param1` HexInt32

Event ID 107: Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param3.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param3.

Message #

Remote Desktop IP Virtualization will virtualize the application, %1, on session ID %2, with IP address, %3.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString

Event ID 107

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will virtualize the application, , on session ID , with IP address, .

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString

Event ID 108: Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param5.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will virtualize the application, Param1, on session ID Param2, with IP address, Param5. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization will virtualize the application, %1, on session ID %2, with IP address, %5. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString
`Param5` UnicodeString

Event ID 108

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will virtualize the application, , on session ID , with IP address, . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString
`Param5` UnicodeString

Event ID 109: Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Message #

Remote Desktop IP Virtualization did not virtualize the application, %2, on session ID %1.

Fields #

Name	Description
`Param2` Int32
`Param1` UnicodeString

Event ID 109

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization did not virtualize the application, , on session ID .

Fields #

Name	Description
`Param2` Int32
`Param1` UnicodeString

Event ID 110: Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization did not virtualize the application, Param1, on session ID Param2. The user account for this session is Param3\Param4.

Message #

Remote Desktop IP Virtualization did not virtualize the application, %1, on session ID %2. The user account for this session is %3\%4.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 110

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization did not virtualize the application, , on session ID . The user account for this session is \.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` UnicodeString
`Param4` UnicodeString

Event ID 111: Remote Desktop IP Virtualization detected more than one network adapter.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Message #

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Event ID 111

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization detected more than one network adapter. Per-session IP virtualization has been disabled.

Event ID 112: Remote Desktop IP Virtualization will use the network adapter with the MAC address of message to provide IP virtualization.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization will use the network adapter with the MAC address of message to provide IP virtualization.

Message #

Remote Desktop IP Virtualization will use the network adapter with the MAC address of %1 to provide IP virtualization.

Fields #

Name	Description
`message` UnicodeString

Event ID 112

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization will use the network adapter with the MAC address of to provide IP virtualization.

Fields #

Name	Description
`message` UnicodeString

Event ID 113: Remote Desktop IP Virtualization could not find the network adapter that matches Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not find the network adapter that matches Param1. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not find the network adapter that matches %1. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 113

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not find the network adapter that matches . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 114: Remote Desktop IP Virtualization could not load Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not load Param1. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not load %1. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 114

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not load . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 115: Remote Desktop IP Virtualization could not renew the IP address, Param1.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not renew the IP address, Param1. Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code: Param2.

Message #

Remote Desktop IP Virtualization could not renew the IP address, %1. Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code: %2

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 115

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not renew the IP address, . Remote Desktop IP Virtualization will attempt to renew the IP address until it reaches the specified timeout. Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` HexInt32

Event ID 116: Remote Desktop IP Virtualization could not renew the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not renew the IP address, Param1, for session ID Param2. Error code: Param3.

Message #

Remote Desktop IP Virtualization could not renew the IP address, %1, for session ID %2.  Error code: %3

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 116

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not renew the IP address, , for session ID . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 117: Remote Desktop IP Virtualization successfully renewed the IP address, message.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization successfully renewed the IP address, message.

Message #

Remote Desktop IP Virtualization successfully renewed the IP address, %1.

Fields #

Name	Description
`message` UnicodeString

Event ID 117

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization successfully renewed the IP address, .

Fields #

Name	Description
`message` UnicodeString

Event ID 118: Remote Desktop IP Virtualization could not allocate the IP address, Param1, for session ID Param2.

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Admin

Description

Remote Desktop IP Virtualization could not allocate the IP address, Param1, for session ID Param2. Error code: Param3.

Message #

Remote Desktop IP Virtualization could not allocate the IP address, %1, for session ID %2.  Error code: %3

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

Event ID 118

Provider: Microsoft-Windows-TerminalServices-TSAppSrv-TSVIP
Channel: Operational

Description

Remote Desktop IP Virtualization could not allocate the IP address, , for session ID . Error code.

Fields #

Name	Description
`Param1` UnicodeString
`Param2` Int32
`Param3` HexInt32

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)