Microsoft-Windows-UserDataAccess-CallHistoryClient
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Error: P1_HResult Location: P2_String Line Number: P3_UInt32. | Operational | N | N |
| 2 | Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32. | Operational | N | N |
| 3 | Object {p:ObjPtr, type:ObjType, id:ObjId} property PropCode not yet fetched. | Operational | N | N |
| 4 | Async RPC call failed with RpcCode (output value OldCode). | Operational | N | N |
| 5 | Start cancelling task. | Operational | N | N |
| 6 | Task Cancelled. | Operational | N | N |
| 7 | CallbackContext: P1. | Operational | N | N |
Event ID 1: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 2: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.
#Event ID 3: Object {p:ObjPtr, type:ObjType, id:ObjId} property PropCode not yet fetched.
#Event ID 4: Async RPC call failed with RpcCode (output value OldCode).
#Event ID 5: Start cancelling task.
#Event ID 6: Task Cancelled.
#Provenance
ETW provider GUID f5988abb-323a-4098-8a34-85a3613d4638
Defined in CallHistoryClient.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, captured 2026-06-02 — Manifest XML pack, 2.0 MB