detection.wiki

Microsoft-Windows-User Profiles General

EventTitleChannelSampleRule
69SourceFile which has timestamp SourceTimestamp was not copied to DestinationFile …OperationalNN
77task_077OperationalNN
1006File FileName of size FileSizeInKb kilobytes copied from SourceLocation to …DiagnosticNN
1007SourceFile which has timestamp SourceTimestamp was not copied to DestinationFile …DiagnosticNN
1509Windows cannot copy file Source to location Target.ApplicationNN
1534There are too many profile copy errors.ApplicationNN
1600Windows cannot copy profile from Source to Target, you do not have enough disk …ApplicationNN
1601Windows cannot copy profile from Source to Target, you have exceeded the profile …ApplicationNN
2147485157Windows cannot copy file {Source} to location {Target}.OperationalNN
2147485182There are too many profile copy errors.OperationalNN
2147485248Windows cannot copy profile from {Source} to {Target}; you do not have enough …OperationalNN
2147485249Windows cannot copy profile from {Source} to {Target}; you have exceeded the …OperationalNN
3221226975Windows cannot set security on your registry.OperationalNN

Event ID 69: SourceFile which has timestamp SourceTimestamp was not copied to DestinationFile which has timestamp DestinationTimestamp since it is older than the file it would be overwriting.

#
Channel
Operational

Message #

%1 which has timestamp %2 was not copied to %3 which has timestamp %4 since it is older than the file it would be overwriting.

Fields #

NameDescription
SourceFile UnicodeString
SourceTimestamp UnicodeString
DestinationFile UnicodeString
DestinationTimestamp UnicodeString

Event ID 77: task_077

#
Channel
Operational

Fields #

NameDescription
EffectiveSid UnicodeString
Location UInt32
Code UInt32

Event ID 1006: File FileName of size FileSizeInKb kilobytes copied from SourceLocation to DestinationLocation in CopyTimeInSec seconds.

#
Channel
Diagnostic

Message #

File %1 of size %2 kilobytes copied from %3 to %4 in %5 seconds.

Fields #

NameDescription
FileName UnicodeString
FileSizeInKb UInt64
SourceLocation UnicodeString
DestinationLocation UnicodeString
CopyTimeInSec UInt64

Event ID 1007: SourceFile which has timestamp SourceTimestamp was not copied to DestinationFile which has timestamp DestinationTimestamp since it is older than the file it would be overwriting.

#
Channel
Diagnostic

Message #

%1 which has timestamp %2 was not copied to %3 which has timestamp %4 since it is older than the file it would be overwriting.

Fields #

NameDescription
SourceFile UnicodeString
SourceTimestamp UnicodeString
DestinationFile UnicodeString
DestinationTimestamp UnicodeString

Event ID 1509: Windows cannot copy file Source to location Target.

#
Channel
Application

Description

Windows cannot copy file Source to location Target. This error may be caused by network problems or insufficient security rights.

Message #

Windows cannot copy file %1 to location %2. This error may be caused by network problems or insufficient security rights. 

 DETAIL - %3

Fields #

NameDescription
Source UnicodeString
Target UnicodeString
Error UnicodeString

Event ID 1534: There are too many profile copy errors.

#
Channel
Application

Description

There are too many profile copy errors. Refer to the previous events for details. Windows will not log any additional copy errors for this copy process.

Message #

There are too many profile copy errors. Refer to the previous events for details. Windows will not log any additional copy errors for this copy process.

Event ID 1600: Windows cannot copy profile from Source to Target, you do not have enough disk space.

#
Channel
Application

Message #

Windows cannot copy profile from %1 to %2, you do not have enough disk space.

Fields #

NameDescription
Source UnicodeString
Target UnicodeString

Event ID 1601: Windows cannot copy profile from Source to Target, you have exceeded the profile quota.

#
Channel
Application

Message #

Windows cannot copy profile from %1 to %2, you have exceeded the profile quota.

Fields #

NameDescription
Source UnicodeString
Target UnicodeString

Event ID 2147485157: Windows cannot copy file {Source} to location {Target}.

#
Channel
Operational

Description

Windows cannot copy file {Source} to location {Target}. This error may be caused by network problems or insufficient security rights. DETAIL - {Error}.

Message #

Windows cannot copy file {Source} to location {Target}. This error may be caused by network problems or insufficient security rights.  DETAIL - {Error}

Fields #

NameDescription
Source
Target
Error

Event ID 2147485182: There are too many profile copy errors.

#
Channel
Operational

Description

There are too many profile copy errors. Refer to the previous events for details. Windows will not log any additional copy errors for this copy process.

Message #

There are too many profile copy errors. Refer to the previous events for details. Windows will not log any additional copy errors for this copy process.

Event ID 2147485248: Windows cannot copy profile from {Source} to {Target}; you do not have enough disk space.

#
Channel
Operational

Fields #

NameDescription
Source
Target

Event ID 2147485249: Windows cannot copy profile from {Source} to {Target}; you have exceeded the profile quota.

#
Channel
Operational

Fields #

NameDescription
Source
Target

Event ID 3221226975: Windows cannot set security on your registry.

#
Channel
Operational

Description

Windows cannot set security on your registry. DETAIL - {Error}.

Message #

Windows cannot set security on your registry.  DETAIL - {Error}

Fields #

NameDescription
Error

Provenance

ETW provider GUID db00dfb6-29f9-4a9c-9b3b-1f4f9e7d9770

Defined in userenv.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02