Microsoft-Windows-UserDataAccess-UserDataApis

83 events across 1 channel

Event	Title	Channel	Sample
1	Error: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.	Operational	N
2	Error Propagated: HRESULT: P1_HResult Location: P2_String Line Number: …	Operational	N
10	Prop_UnicodeString.	Operational	N
100	Opening VoIP RPC client	Operational	N
101	Opened VoIP RPC client	Operational	N
102	New incoming VoIP call Prop_HexInt32.	Operational	N
103	New outgoing VoIP call Prop_HexInt32.	Operational	N
104	Made DSS token Prop_UnicodeString_1 for file Prop_UnicodeString_2.	Operational	N
105	Outgoing Video call upgrade call: Prop_HexInt32, Call upgrade Guid: Prop_Guid.	Operational	N
106	New incoming upgrade video call Prop_HexInt32.	Operational	N
120	Invoking AcceptIncoming for VoIP call Prop_HexInt32.	Operational	N
121	Invoking RejectIncoming for VoIP call Prop_HexInt32.	Operational	N
122	Invoking Hold for VoIP call Prop_HexInt32.	Operational	N
123	Invoking Unhold for VoIP call Prop_HexInt32.	Operational	N
124	Invoking End for VoIP call Prop_HexInt32.	Operational	N
140	Opening audio routing RPC client	Operational	N
141	Opened audio routing RPC client	Operational	N
142	A new SMS Intercept application has been added	Operational	N
143	A new SMS Intercept application has been removed	Operational	N
144	A new SMS has arrived	Operational	N
145	A new SMS has been retrieved of length Prop_UInt_1.	Operational	N
150	Opening phone call filter client	Operational	N
151	Opened phone call filter client	Operational	N
152	Opening SMS filter client	Operational	N
153	Opened SMS filter client	Operational	N
200	IncomingCallStart	Operational	N
201	StartCallStart	Operational	N
202	StartCallStop	Operational	N
203	EndCallStart	Operational	N
204	SetAudioRoutingStart	Operational	N
205	SetAudioRoutingStop	Operational	N
206	ProcessMuteStateNotificationStart	Operational	N
207	ProcessMuteStateNotificationStart207	Operational	N
301	Social object is missing UDM property: {Prop_UInt_1}.	Operational	N
304	Social object has invalid value for UDM property: {Prop_UInt_1}.	Operational	N
305	Saving feed of type=.	Operational	N
307	Social Originate Error: {Prop_UnicodeString}.	Operational	N
308	Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}.	Operational	N
401	Saving online picture remote id: [Prop_UnicodeString].	Operational	N
402	Saving online video remote id: [Prop_UnicodeString]).	Operational	N
403	Saving online album remote id: [Prop_UnicodeString]).	Operational	N
404	Bulk saving Prop_UInt_1 albums.	Operational	N
405	Bulk saving Prop_UInt_1 media items.	Operational	N
406	Done bulk saving albums	Operational	N
407	Done bulk saving media items	Operational	N
500	PhoneCallAnnotations: Starting location query.	Operational	N
501	PhoneCallAnnotations: Completing location query.	Operational	N
502	PhoneCallAnnotations: Starting RPC server with endpoint Prop_UnicodeString.	Operational	N
503	PhoneCallAnnotations: Stopping RPC server	Operational	N
600	The store for app Prop_Guid was not found.	Operational	N
1000	[ChatApis] ChatMessageStoreChangedEventArgs Kind = Prop_UInt_1, Type = …	Operational	N
1001	[ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= …	Operational	N
1002	[ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= Prop_UInt_1.	Operational	N
1003	[ChatApis] ChatMessageStoreImpl::MarkMessageReadAsync	Operational	N
1004	[ChatApis] ChatMessageStoreImpl::RetrySendMessageAsync	Operational	N
1005	[ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsync	Operational	N
1006	[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected …	Operational	N
1007	[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to …	Operational	N
1008	[ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=Prop_ULong.	Operational	N
1009	[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = …	Operational	N
1010	[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = …	Operational	N
1011	[ChatApis] …	Operational	N
1012	[ChatApis] …	Operational	N
1013	[ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed …	Operational	N
1500	ChatMessagesReadBatchWithCountAsync_START	Operational	N
1501	ChatMessagesReadBatchWithCountAsync_STOP	Operational	N
1502	ChatConversationsReadBatchWithCountAsync_START	Operational	N
1503	ChatConversationsReadBatchWithCountAsync_STOP	Operational	N
1504	ChatMessageRead_START	Operational	N
1505	ChatMessageRead_STOP	Operational	N
1506	ChatMessageStoreInitialize_START	Operational	N
1507	ChatMessageStoreInitialize_STOP	Operational	N
1508	ChatConversationReadAsync_START	Operational	N
1509	ChatConversationReadAsync_STOP	Operational	N
1510	ChatConversationThreadingReadAsync_START	Operational	N
1511	ChatConversationThreadingReadAsync_STOP	Operational	N
1512	ChatMessageManagerGetTransportsAsync_START	Operational	N
1513	ChatMessageManagerGetTransportsAsync_STOP	Operational	N
1514	ChatMessageManagerGetTransportAsync_START	Operational	N
1515	ChatMessageManagerGetTransportAsync_STOP	Operational	N
2000	UdmSessionHandleEnsureConnected_START	Operational	N
2001	UdmSessionHandleEnsureConnected_STOP	Operational	N
10000	3rd party log: {Prop_Caller} - {Prop_UnicodeString}.	Operational	N

Event ID 1: Error: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Error: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error: HRESULT: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 2: Error Propagated: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Error Propagated: HRESULT: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error Propagated: HRESULT: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 10: Prop_UnicodeString.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Prop_UnicodeString

Message #

%1

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 100: Opening VoIP RPC client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opening VoIP RPC client.

Message #

Opening VoIP RPC client

Event ID 101: Opened VoIP RPC client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opened VoIP RPC client.

Message #

Opened VoIP RPC client

Event ID 102: New incoming VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

New incoming VoIP call Prop_HexInt32.

Message #

New incoming VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 103: New outgoing VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

New outgoing VoIP call Prop_HexInt32.

Message #

New outgoing VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 104: Made DSS token Prop_UnicodeString_1 for file Prop_UnicodeString_2.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Made DSS token Prop_UnicodeString_1 for file Prop_UnicodeString_2.

Message #

Made DSS token %1 for file %2

Fields #

Name	Description
`Prop_UnicodeString_1` UnicodeString
`Prop_UnicodeString_2` UnicodeString

Event ID 105: Outgoing Video call upgrade call: Prop_HexInt32, Call upgrade Guid: Prop_Guid.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Outgoing Video call upgrade call: Prop_HexInt32, Call upgrade Guid: Prop_Guid.

Message #

Outgoing Video call upgrade call: %1, Call upgrade Guid: %2

Fields #

Name	Description
`Prop_HexInt32` UInt32
`Prop_Guid` GUID

Event ID 106: New incoming upgrade video call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

New incoming upgrade video call Prop_HexInt32.

Message #

New incoming upgrade video call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 120: Invoking AcceptIncoming for VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Invoking AcceptIncoming for VoIP call Prop_HexInt32.

Message #

Invoking AcceptIncoming for VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 121: Invoking RejectIncoming for VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Invoking RejectIncoming for VoIP call Prop_HexInt32.

Message #

Invoking RejectIncoming for VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 122: Invoking Hold for VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Invoking Hold for VoIP call Prop_HexInt32.

Message #

Invoking Hold for VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 123: Invoking Unhold for VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Invoking Unhold for VoIP call Prop_HexInt32.

Message #

Invoking Unhold for VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 124: Invoking End for VoIP call Prop_HexInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Invoking End for VoIP call Prop_HexInt32.

Message #

Invoking End for VoIP call %1

Fields #

Name	Description
`Prop_HexInt32` UInt32

Event ID 140: Opening audio routing RPC client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opening audio routing RPC client.

Message #

Opening audio routing RPC client

Event ID 141: Opened audio routing RPC client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opened audio routing RPC client.

Message #

Opened audio routing RPC client

Event ID 142: A new SMS Intercept application has been added

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

A new SMS Intercept application has been added.

Message #

A new SMS Intercept application has been added

Event ID 143: A new SMS Intercept application has been removed

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

A new SMS Intercept application has been removed.

Message #

A new SMS Intercept application has been removed

Event ID 144: A new SMS has arrived

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

A new SMS has arrived.

Message #

A new SMS has arrived

Event ID 145: A new SMS has been retrieved of length Prop_UInt_1.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

A new SMS has been retrieved of length Prop_UInt_1.

Message #

A new SMS has been retrieved of length %1

Fields #

Name	Description
`Prop_UInt_1` UInt32

Event ID 150: Opening phone call filter client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opening phone call filter client.

Message #

Opening phone call filter client

Event ID 151: Opened phone call filter client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opened phone call filter client.

Message #

Opened phone call filter client

Event ID 152: Opening SMS filter client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opening SMS filter client.

Message #

Opening SMS filter client

Event ID 153: Opened SMS filter client

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Opened SMS filter client.

Message #

Opened SMS filter client

Event ID 200: IncomingCallStart

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: IncomingCall
Opcode: Start

Event ID 201: StartCallStart

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: StartCall
Opcode: Start

Event ID 202: StartCallStop

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: StartCall
Opcode: Stop

Event ID 203: EndCallStart

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: EndCall
Opcode: Start

Event ID 204: SetAudioRoutingStart

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: SetAudioRouting
Opcode: Start

Event ID 205: SetAudioRoutingStop

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: SetAudioRouting
Opcode: Stop

Event ID 206: ProcessMuteStateNotificationStart

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ProcessMuteStateNotification
Opcode: Start

Event ID 207: ProcessMuteStateNotificationStart207

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ProcessMuteStateNotification
Opcode: Start

Event ID 301: Social object is missing UDM property: {Prop_UInt_1}.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Social object is missing UDM property: {Prop_UInt_1}.

Message #

Social object is missing UDM property: {Prop_UInt_1}

Fields #

Name	Description
`Prop_UInt_1`

Event ID 304: Social object has invalid value for UDM property: {Prop_UInt_1}.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Social object has invalid value for UDM property: {Prop_UInt_1}.

Message #

Social object has invalid value for UDM property: {Prop_UInt_1}

Fields #

Name	Description
`Prop_UInt_1`

Event ID 305: Saving feed of type=.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Saving feed of type={Prop_Type}; updateMode={Prop_Mode}; operationId={Prop_UInt_1}; itemCount={Prop_UInt_2}.

Message #

Saving feed of type={Prop_Type}; updateMode={Prop_Mode}; operationId={Prop_UInt_1}; itemCount={Prop_UInt_2}

Fields #

Name	Description
`Prop_Type`
`Prop_Mode`
`Prop_UInt_1`
`Prop_UInt_2`

Event ID 307: Social Originate Error: {Prop_UnicodeString}.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Social Originate Error: {Prop_UnicodeString}.

Message #

Social Originate Error: {Prop_UnicodeString}

Fields #

Name	Description
`Prop_UnicodeString`

Event ID 308: Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}.

Message #

Social Cancellation State(Cookie: {Prop_HexInt32}): {Prop_UnicodeString}

Fields #

Name	Description
`Prop_HexInt32`
`Prop_UnicodeString`

Event ID 401: Saving online picture remote id: [Prop_UnicodeString].

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Saving online picture remote id: [Prop_UnicodeString].

Message #

Saving online picture remote id: [%1]

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 402: Saving online video remote id: [Prop_UnicodeString]).

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Saving online video remote id: [Prop_UnicodeString]).

Message #

Saving online video remote id: [%1])

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 403: Saving online album remote id: [Prop_UnicodeString]).

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Saving online album remote id: [Prop_UnicodeString]).

Message #

Saving online album remote id: [%1])

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 404: Bulk saving Prop_UInt_1 albums.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Bulk saving Prop_UInt_1 albums.

Message #

Bulk saving %1 albums

Fields #

Name	Description
`Prop_UInt_1` UInt32

Event ID 405: Bulk saving Prop_UInt_1 media items.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Bulk saving Prop_UInt_1 media items.

Message #

Bulk saving %1 media items

Fields #

Name	Description
`Prop_UInt_1` UInt32

Event ID 406: Done bulk saving albums

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Done bulk saving albums.

Message #

Done bulk saving albums

Event ID 407: Done bulk saving media items

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

Done bulk saving media items.

Message #

Done bulk saving media items

Event ID 500: PhoneCallAnnotations: Starting location query.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

PhoneCallAnnotations: Starting location query. Phone number: Prop_UnicodeString.

Message #

PhoneCallAnnotations: Starting location query. Phone number: %1

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 501: PhoneCallAnnotations: Completing location query.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

PhoneCallAnnotations: Completing location query. Location: Prop_UnicodeString.

Message #

PhoneCallAnnotations: Completing location query. Location: %1

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 502: PhoneCallAnnotations: Starting RPC server with endpoint Prop_UnicodeString.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

PhoneCallAnnotations: Starting RPC server with endpoint Prop_UnicodeString.

Message #

PhoneCallAnnotations: Starting RPC server with endpoint %1

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 503: PhoneCallAnnotations: Stopping RPC server

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

PhoneCallAnnotations: Stopping RPC server.

Message #

PhoneCallAnnotations: Stopping RPC server

Event ID 600: The store for app Prop_Guid was not found.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

The store for app Prop_Guid was not found.

Message #

The store for app %1 was not found

Fields #

Name	Description
`Prop_Guid` GUID

Event ID 1000: [ChatApis] ChatMessageStoreChangedEventArgs Kind = Prop_UInt_1, Type = Prop_UInt_2.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageStoreChangedEventArgs Kind = Prop_UInt_1, Type = Prop_UInt_2.

Message #

[ChatApis] ChatMessageStoreChangedEventArgs Kind = %1, Type = %2

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32

Event ID 1001: [ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= Prop_UInt_1.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= Prop_UInt_1.

Message #

[ChatApis] ChatConversationReaderImpl::ReadBatchWithCountAsync batch count= %1

Fields #

Name	Description
`Prop_UInt_1` UInt32

Event ID 1002: [ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= Prop_UInt_1.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= Prop_UInt_1.

Message #

[ChatApis] ChatMessageReaderImpl::_ReadBatchImpl batch count= %1

Fields #

Name	Description
`Prop_UInt_1` UInt32

Event ID 1003: [ChatApis] ChatMessageStoreImpl::MarkMessageReadAsync

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageStoreImpl::MarkMessageReadAsync.

Message #

[ChatApis] ChatMessageStoreImpl::MarkMessageReadAsync

Event ID 1004: [ChatApis] ChatMessageStoreImpl::RetrySendMessageAsync

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageStoreImpl::RetrySendMessageAsync.

Message #

[ChatApis] ChatMessageStoreImpl::RetrySendMessageAsync

Event ID 1005: [ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsync

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsync.

Message #

[ChatApis] ChatApis::ChatMessageStoreImpl_SendMessageAsync

Event ID 1006: [ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete. HRESULT=P1_HResult.

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync Session->EnsureConnected complete. HRESULT=%1

Fields #

Name	Description
`P1_HResult` Int32

Event ID 1007: [ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports. HRESULT=P1_HResult.

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync Completed RPC call to UdmSvc_GetChatTransports. HRESULT=%1

Fields #

Name	Description
`P1_HResult` Int32

Event ID 1008: [ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=Prop_ULong.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=Prop_ULong.

Message #

[ChatApis] ChatMessageManager::GetTransportsAsync TransportCount=%1

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 1009: [ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = Prop_UnicodeString.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = Prop_UnicodeString.

Message #

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp MessagingPackage = %1

Fields #

Name	Description
`Prop_UnicodeString` UnicodeString

Event ID 1010: [ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = Prop_UInt_1, Expected = Prop_UInt_2.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = Prop_UInt_1, Expected = Prop_UInt_2.

Message #

[ChatApis] ChatNavigation::_LaunchUriForDefaultChatApp LaunchStatus = %1, Expected = %2

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32

Event ID 1011: [ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCachedCapabilitiesAsync

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCachedCapabilitiesAsync.

Message #

[ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCachedCapabilitiesAsync

Event ID 1012: [ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCapabilitiesFromNetworkAsync

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCapabilitiesFromNetworkAsync.

Message #

[ChatApis] ChatApis::ChatCapabilitiesManagerStaticImpl_GetCapabilitiesFromNetworkAsync

Event ID 1013: [ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed = Prop_BOOL.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

[ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed = Prop_BOOL.

Message #

[ChatApis] ChatSyncConfigurationImpl::_IsMessageSyncAllowed IsMessageSyncAllowed = %1

Fields #

Name	Description
`Prop_BOOL` Boolean

Event ID 1500: ChatMessagesReadBatchWithCountAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessagesReadBatchWithCountAsync_START
Opcode: Start

Event ID 1501: ChatMessagesReadBatchWithCountAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessagesReadBatchWithCountAsync_STOP
Opcode: Stop

Event ID 1502: ChatConversationsReadBatchWithCountAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationsReadBatchWithCountAsync_START
Opcode: Start

Event ID 1503: ChatConversationsReadBatchWithCountAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationsReadBatchWithCountAsync_STOP
Opcode: Stop

Event ID 1504: ChatMessageRead_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageRead_START
Opcode: Start

Event ID 1505: ChatMessageRead_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageRead_STOP
Opcode: Stop

Event ID 1506: ChatMessageStoreInitialize_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageStoreInitialize_START
Opcode: Start

Event ID 1507: ChatMessageStoreInitialize_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageStoreInitialize_STOP
Opcode: Stop

Event ID 1508: ChatConversationReadAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationReadAsync_START
Opcode: Start

Event ID 1509: ChatConversationReadAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationReadAsync_STOP
Opcode: Stop

Event ID 1510: ChatConversationThreadingReadAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationThreadingReadAsync_START
Opcode: Start

Event ID 1511: ChatConversationThreadingReadAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatConversationThreadingReadAsync_STOP
Opcode: Stop

Event ID 1512: ChatMessageManagerGetTransportsAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageManagerGetTransportsAsync_START
Opcode: Start

Event ID 1513: ChatMessageManagerGetTransportsAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageManagerGetTransportsAsync_STOP
Opcode: Stop

Event ID 1514: ChatMessageManagerGetTransportAsync_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageManagerGetTransportAsync_START
Opcode: Start

Event ID 1515: ChatMessageManagerGetTransportAsync_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: ChatMessageManagerGetTransportAsync_STOP
Opcode: Stop

Event ID 2000: UdmSessionHandleEnsureConnected_START

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: UdmSessionHandleEnsureConnected_START
Opcode: Start

Event ID 2001: UdmSessionHandleEnsureConnected_STOP

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational
Task: UdmSessionHandleEnsureConnected_STOP
Opcode: Stop

Event ID 10000: 3rd party log: {Prop_Caller} - {Prop_UnicodeString}.

Provider: Microsoft-Windows-UserDataAccess-UserDataApis
Channel: Operational

Description

3rd party log: {Prop_Caller} - {Prop_UnicodeString}.

Message #

3rd party log: {Prop_Caller} - {Prop_UnicodeString}

Fields #

Name	Description
`Prop_Caller`
`Prop_UnicodeString`

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID b9b2de3c-3fbd-4f42-8ff7-33c3bad35fd4

Defined in AppointmentApis.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)