Microsoft-Windows-UserDataAccess-UserDataService

166 events across 1 channel

Event	Title	Channel	Sample
1	Error: P1_HResult Location: P2_String Line Number: P3_UInt32.	Operational	N
2	Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.	Operational	N
3	Trace	Operational	N
101	Handle handle running down (path path) - client crash?	Operational	N
102	Opened data session object handle.	Operational	N
103	Closing data session object handle.	Operational	N
104	CanAppAccessStore: pAppOwnershipId->productId = AppOwnershipId, …	Operational	N
105	CanAppAccessStore: Can access store = Prop_Boolean_1.	Operational	N
106	Cannot convert blob to string for msg [Prop_UInt_1], prop [Prop_UInt_2]: size …	Operational	N
107	UDM Data migrated with status: [P1_HResult].	Operational	N
108	Call favorites data migrated with status: [P1_HResult].	Operational	N
201	Handle handle updated controls to max:maxnotify.	Operational	N
202	Handle handle requested requested messages, got returned, remaining remain (also …	Operational	N
203	Handle handle has readyCount ready notifications, (lost lost).	Operational	N
204	Handle handle: new notification type [type], id [id].	Operational	N
205	Id [id], StartTime [starttime].	Operational	N
206	Handle handle requested requested messages, got returned, remaining remain (also …	Operational	N
301	Caller handle asked to update missing object type:type id:id.	Operational	N
302	Caller handle asked to delete missing object type:type id:id.	Operational	N
303	Caller handle looked for properties on missing object type:type id:id.	Operational	N
304	Deleting ENUM object handle in rundown.	Operational	N
305	Deleting SESSION object handle in rundown.	Operational	N
306	Client does not have the following capbility [.	Operational	N
307	Client does not have the following privacy capability [.	Operational	N
308	Client privacy capability failed allowedCallers = [Prop_UInt_1], …	Operational	N
400	CalendarEventSink handle: Advise to Poom.	Operational	N
401	CalendarEventSink handle: Unadvise from Poom.	Operational	N
402	CalendarSearch: Prop_UInt_1 items returned.	Operational	N
403	Remote id not found: store=Prop_ULong, found=Prop_UInt.	Operational	N
404	Appointment cache skipped because of missing prop: Prop_ULong.	Operational	N
405	CalendarSearch: Prop_UInt_1 recurring appts found.	Operational	N
406	CalendarSearch: inserted item Prop_UInt_1, type Prop_UInt_2.	Operational	N
407	Appointment Cache notified: invalidate calendars [Prop_Boolean_1], invalidate …	Operational	N
501	Modifying Feed of Type Prop_UInt_1 for OLITEMID: Prop_UInt_2 Prop_UInt_3 …	Operational	N
502	Invalid Timestamp for Feed Item: remoteId.	Operational	N
503	Feed for contact remoteId as a part of operation operationId did not provide …	Operational	N
504	The following deep link is invalid: deepLink.	Operational	N
505	The following image url is too long: deepLink.	Operational	N
602	Invalid Pending Upload Request Indentifier Format Encountered	Operational	N
700	ChatStoreChangedEventSink handle: Advise to Messaging OM.	Operational	N
701	ChatStoreChangedEventSink handle: Unadvise from Messaging OM.	Operational	N
702	ChatStoreChanged event: event type [EventType], item type [ItemType].	Operational	N
705	Activation status change notification received for Capability Service.	Operational	N
706	Unknown activation status for Capability Service: ActivationStatus.	Operational	N
707	Request Capabilities: TelString.	Operational	N
708	Capabilities retrieved: TelString, capabilities are RcsCapabilityBits.	Operational	N
709	Notifying messaging app: PFN = {AppPackageFamilyName}; actions = …	Operational	N
711	ComposingStatusChangedEventSink handle: Advise to RCS.	Operational	N
712	ComposingStatusChangedEventSink handle: Unadvise from RCS.	Operational	N
713	ComposingStatusChanged event: source [RCS], chat id [RcsChatId], is group …	Operational	N
714	RcsEndUserMessageEventSink handle: Advise to End User Messages.	Operational	N
715	RcsEndUserMessageEventSink handle: Unadvise from End User Messages.	Operational	N
716	RcsServiceStatusChangedEventSink handle: Advise to RCS.	Operational	N
717	RcsServiceStatusChangedEventSink handle: Unadvise from RCS.	Operational	N
718	RcsServiceStatusChanged event: service type [serviceType], is supported …	Operational	N
719	Default messaging app fall back to: AppPackageFamilyName.	Operational	N
720	Rcs service initialization started	Operational	N
721	Rcs service is not available	Operational	N
722	Rcs service adapter initialized	Operational	N
723	Rcs service adapter released	Operational	N
724	Rcs service adapter lost connection	Operational	N
725	Chat: ChatOperationContextGetMessageProperties	Operational	N
726	Chat: ChatOperationContextGetMessageParticipants	Operational	N
727	Chat: ChatOperationContextGetMessageAttachments	Operational	N
728	Chat: ChatOperationContext_MarkAsSeen	Operational	N
729	Chat: GetChatMessageProperties	Operational	N
730	Chat: UdmSvcImpl_GetChatObjectProperties	Operational	N
731	Chat: ProcessChatUpdatesBegin	Operational	N
732	Chat: ProcessChatUpdatesEnd	Operational	N
733	Chat: UdmSvcImpl_UpdateChatObjects	Operational	N
734	Notifying filter app: PFN = {AppPackageFamilyName}.	Operational	N
735	Conversation does not exist.	Operational	N
736	One or more conversation properties were not found.	Operational	N
737	Got a ChatMessage without recipients.	Operational	N
738	ChatCapabilitiesContext::GetCachedChatCapabilities()	Operational	N
739	ChatCapabilitiesContext::GetCachedChatCapabilities() - Contact not found	Operational	N
740	ChatCapabilitiesContext::GetCachedChatCapabilities() - Found a cached contact	Operational	N
741	ChatCapabilitiesContext::GetCachedChatCapabilities() - capabilities = …	Operational	N
742	ChatCapabilitiesContext::GetCapabilitiesFromNetwork()	Operational	N
743	ChatCapabilitiesContext::_RequestCapabilities()	Operational	N
744	Conversation does not exist.	Operational	N
745	Got app manager instance.	Operational	N
746	Got default messaging application.	Operational	N
747	Got messaging app package family name.	Operational	N
748	Got transport IDs.	Operational	N
749	Got one default transport ID.	Operational	N
750	Got one default transport ID.	Operational	N
751	Flattened items to send.	Operational	N
752	ChatCapabilitiesContext::_FindCachedPhoneNumberCapabilities found = …	Operational	N
753	RcsMultipartMessageTracker::_OnChatOpenedWorker()	Operational	N
754	ChatAppManager::GetDefaultMessagingApp found default messaging app in registery.	Operational	N
755	ChatAppManager::GetDefaultMessagingApp ChatAppManager::GetAllMessagingApps() …	Operational	N
756	ChatAppManager::_GetDefaultMessagingAppInRegistry default app not found in …	Operational	N
757	ChatAppManager::SetDefaultMessagingAppInRegistry().	Operational	N
758	ChatAppManager::SetDefaultMessagingApp app already registered.	Operational	N
759	ChatAppManager::_SetDefaultMessagingAppInRegistry().	Operational	N
760	ChatAppManager::GetAllDefaultCapableMessagingApps().	Operational	N
761	Rcs service status adapter not available	Operational	N
762	RcsTransportChangedEventSink handle: Advise to RCS.	Operational	N
763	RcsTransportChangedEventSink handle: Unadvise from RCS.	Operational	N
764	RcsTransportChanged event	Operational	N
800	CallHistoryNotificationManager NotifyCallHistoryApps.	Operational	N
1000	Udm_IntializedSecurityInfoStart	Operational	N
1001	Udm_IntializedSecurityInfoStop	Operational	N
1002	Udm_OpenSessionStart	Operational	N
1003	Udm_OpenSessionStop	Operational	N
1004	Udm_OpenCallHistorySessionStart	Operational	N
1005	Udm_OpenCallHistorySessionStop	Operational	N
1100	Calendar_UpdateCalendarObjectsStart	Operational	N
1101	Calendar_UpdateCalendarObjectsStop	Operational	N
1104	Calendar_GetConflictInfoStart	Operational	N
1105	Calendar_GetConflictInfoStop	Operational	N
1106	Calendar_RespondMeetingRequestStart	Operational	N
1107	Calendar_RespondMeetingRequestStop	Operational	N
1108	Calendar_ProposeNewTimeStart	Operational	N
1109	Calendar_ProposeNewTimeStop	Operational	N
1110	Calendar_CreateForwardMessageStart	Operational	N
1111	Calendar_CreateForwardMessageStop	Operational	N
1112	Calendar_GetChangedAppointmentsSinceStart	Operational	N
1113	Calendar_GetChangedAppointmentsSinceStop	Operational	N
1114	Calendar_GetCalendarStoreEnumStart	Operational	N
1115	Calendar_GetCalendarStoreEnumStop	Operational	N
1116	Calendar_GetCalendarEnumStart	Operational	N
1117	Calendar_GetCalendarEnumStop	Operational	N
1118	Calendar_GetAppointmentEnumStart	Operational	N
1119	Calendar_GetAppointmentEnumStop	Operational	N
1120	Calendar_EnumMultiDayStart	Operational	N
1121	Calendar_EnumMultiDayStop	Operational	N
1122	Calendar_EnumSingleInstanceStart	Operational	N
1123	Calendar_EnumSingleInstanceStop	Operational	N
1124	Calendar_EnumRecurringStart	Operational	N
1125	Calendar_EnumRecurringStop	Operational	N
1126	Calendar_Search_OpenStart	Operational	N
1127	Calendar_Search_OpenStop	Operational	N
1128	Calendar_Search_FetchStart	Operational	N
1129	Calendar_Search_FetchStop	Operational	N
1200	Meeting_CreateOrModifyAppointmentStart	Operational	N
1201	Meeting_CreateOrModifyAppointmentStop	Operational	N
1202	Meeting_GetStreamPropertyStart	Operational	N
1203	Meeting_GetStreamPropertyStop	Operational	N
1204	App: AppName, Action: AccessedString.	Operational	N
1205	App: AppName, Action: AccessedString.	Operational	N
1206	Chat_GetChatConversationPropertiesStart	Operational	N
1207	Chat_GetChatConversationPropertiesStop	Operational	N
1208	Chat_GetMessageAttachmentsStart	Operational	N
1209	Chat_GetMessageAttachmentsStop	Operational	N
1210	Chat_GetMessageParticipantsStart	Operational	N
1211	Chat_GetMessageParticipantsStop	Operational	N
1212	Chat_ChatOperationContext_GetMessagePropertiesStart	Operational	N
1213	Chat_ChatOperationContext_GetMessagePropertiesStop	Operational	N
1214	Chat_ChatOperationContext_ModifyConversationItemStart	Operational	N
1215	Chat_ChatOperationContext_ModifyConversationItemStop	Operational	N
1216	Chat_ChatOperationContext_ModifyItemStart	Operational	N
1217	Chat_ChatOperationContext_ModifyItemStop	Operational	N
1218	User_DataModel_ServiceStart	Operational	N
1219	User_DataModel_ServiceStop	Operational	N
1220	Chat_DataModel_ServiceStart	Operational	N
1221	Chat_DataModel_ServiceStop	Operational	N
2001	Cleaning up stale data.	Operational	N
2002	Starting the knowledge defragmentation task for all sync partners	Operational	N
2003	Finished the knowledge defragmentation task.	Operational	N
2004	Starting the knowledge defragmentation task for all sync partners associated …	Operational	N
2005	Finished the knowledge defragmentation task for all sync partners associated …	Operational	N
2006	App Store Deleted: App Id [AppId], Reason [AppDataCleanupReason].	Operational	N
2007	App Store Grouping Deleted: App Id [AppId], Reason [AppDataCleanupReason].	Operational	N
2008	HandlePackageUninstall called for PFN: P1_UnicodeString.	Operational	N

Event ID 1: Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Error: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 2: Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Error Propagated: P1_HResult Location: P2_String Line Number: P3_UInt32.

Message #

Error Propagated: %1 Location: %2 Line Number: %3

Fields #

Name	Description
`P1_HResult` Int32
`P2_String` AnsiString
`P3_UInt32` UInt32

Event ID 3: Trace

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Trace

Fields #

Name	Description
`Message` Pointer

Event ID 101: Handle handle running down (path path) - client crash?

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle running down (path path) - client crash?

Message #

Handle %2 running down (path %1) - client crash?

Fields #

Name	Description
`path` UnicodeString
`handle` Pointer

Event ID 102: Opened data session object handle.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Opened data session object handle.

Message #

Opened data session object %1

Fields #

Name	Description
`handle` Pointer

Event ID 103: Closing data session object handle.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Closing data session object handle.

Message #

Closing data session object %1

Fields #

Name	Description
`handle` Pointer

Event ID 104: CanAppAccessStore: pAppOwnershipId->productId = AppOwnershipId, pStoreAppOwnershipId->productId = StoreAppOwnershipId.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CanAppAccessStore: pAppOwnershipId->productId = AppOwnershipId, pStoreAppOwnershipId->productId = StoreAppOwnershipId.

Message #

CanAppAccessStore: pAppOwnershipId->productId = %1, pStoreAppOwnershipId->productId = %2

Fields #

Name	Description
`AppOwnershipId` GUID
`StoreAppOwnershipId` GUID

Event ID 105: CanAppAccessStore: Can access store = Prop_Boolean_1.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CanAppAccessStore: Can access store = Prop_Boolean_1.

Message #

CanAppAccessStore: Can access store = %1

Fields #

Name	Description
`Prop_Boolean_1` Boolean

Event ID 106: Cannot convert blob to string for msg [Prop_UInt_1], prop [Prop_UInt_2]: size actual [Prop_UInt_3] vs.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Cannot convert blob to string for msg [Prop_UInt_1], prop [Prop_UInt_2]: size actual [Prop_UInt_3] vs. expected [Prop_UInt_4].

Message #

Cannot convert blob to string for msg [%1], prop [%2]: size actual [%3] vs. expected [%4]

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32
`Prop_UInt_4` UInt32

Event ID 107: UDM Data migrated with status: [P1_HResult].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

UDM Data migrated with status: [P1_HResult].

Message #

UDM Data migrated with status: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 108: Call favorites data migrated with status: [P1_HResult].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Call favorites data migrated with status: [P1_HResult].

Message #

Call favorites data migrated with status: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 201: Handle handle updated controls to max:maxnotify.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle updated controls to max:maxnotify.

Message #

Handle %1 updated controls to max:%2

Fields #

Name	Description
`handle` Pointer
`maxnotify` UInt32

Event ID 202: Handle handle requested requested messages, got returned, remaining remain (also said lost missed).

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle requested requested messages, got returned, remaining remain (also said lost missed).

Message #

Handle %1 requested %2 messages, got %3, %4 remain (also said lost %5)

Fields #

Name	Description
`handle` Pointer
`requested` UInt32
`returned` UInt32
`remaining` UInt32
`missed` Boolean

Event ID 203: Handle handle has readyCount ready notifications, (lost lost).

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle has readyCount ready notifications, (lost lost).

Message #

Handle %1 has %2 ready notifications, (lost %3)

Fields #

Name	Description
`handle` Pointer
`readyCount` UInt32
`lost` Boolean

Event ID 204: Handle handle: new notification type [type], id [id].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle: new notification type [type], id [id].

Message #

Handle %1: new notification type [%2], id [%3]

Fields #

Name	Description
`handle` Pointer
`type` UInt32
`id` UInt32

Event ID 205: Id [id], StartTime [starttime].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Id [id], StartTime [starttime].

Message #

Id [%1], StartTime [%2]

Fields #

Name	Description
`id` UInt32
`starttime` FILETIME

Event ID 206: Handle handle requested requested messages, got returned, remaining remain (also said lost missed).

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Handle handle requested requested messages, got returned, remaining remain (also said lost missed).

Message #

Handle %1 requested %2 messages, got %3, %4 remain (also said lost %5)

Fields #

Name	Description
`handle` Pointer
`requested` UInt32
`returned` UInt32
`remaining` UInt32
`missed` Boolean

Event ID 301: Caller handle asked to update missing object type:type id:id.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Caller handle asked to update missing object type:type id:id.

Message #

Caller %1 asked to update missing object type:%2 id:%3

Fields #

Name	Description
`handle` Pointer
`type` UInt32
`id` UInt32

Event ID 302: Caller handle asked to delete missing object type:type id:id.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Caller handle asked to delete missing object type:type id:id.

Message #

Caller %1 asked to delete missing object type:%2 id:%3

Fields #

Name	Description
`handle` Pointer
`type` UInt32
`id` UInt32

Event ID 303: Caller handle looked for properties on missing object type:type id:id.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Caller handle looked for properties on missing object type:type id:id.

Message #

Caller %1 looked for properties on missing object type:%2 id:%3

Fields #

Name	Description
`handle` Pointer
`type` UInt32
`id` UInt32

Event ID 304: Deleting ENUM object handle in rundown.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Deleting ENUM object handle in rundown.

Message #

Deleting ENUM object %1 in rundown

Fields #

Name	Description
`handle` Pointer

Event ID 305: Deleting SESSION object handle in rundown.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Deleting SESSION object handle in rundown.

Message #

Deleting SESSION object %1 in rundown

Fields #

Name	Description
`handle` Pointer

Event ID 306: Client does not have the following capbility [.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Client does not have the following capbility [{Prop_Type}].

Message #

Client does not have the following capbility [{Prop_Type}]

Fields #

Name	Description
`Prop_Type`

Event ID 307: Client does not have the following privacy capability [.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Client does not have the following privacy capability [{Prop_Type}].

Message #

Client does not have the following privacy capability [{Prop_Type}]

Fields #

Name	Description
`Prop_Type`

Event ID 308: Client privacy capability failed allowedCallers = [Prop_UInt_1], m_clientAPISecurityFlags = [Prop_UInt_2], m_clientAPISecurityFlagsForPrivacy = [Prop_UInt_3].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Client privacy capability failed allowedCallers = [Prop_UInt_1], m_clientAPISecurityFlags = [Prop_UInt_2], m_clientAPISecurityFlagsForPrivacy = [Prop_UInt_3].

Message #

Client privacy capability failed allowedCallers = [%1],  m_clientAPISecurityFlags = [%2],  m_clientAPISecurityFlagsForPrivacy = [%3]

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32

Event ID 400: CalendarEventSink handle: Advise to Poom.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CalendarEventSink handle: Advise to Poom.

Message #

CalendarEventSink %1: Advise to Poom

Fields #

Name	Description
`handle` Pointer

Event ID 401: CalendarEventSink handle: Unadvise from Poom.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CalendarEventSink handle: Unadvise from Poom.

Message #

CalendarEventSink %1: Unadvise from Poom

Fields #

Name	Description
`handle` Pointer

Event ID 402: CalendarSearch: Prop_UInt_1 items returned.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CalendarSearch: Prop_UInt_1 items returned. index = Prop_UInt_2, future items = Prop_UInt_3, past items = Prop_UInt_4.

Message #

CalendarSearch: %1 items returned. index = %2, future items = %3, past items = %4

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32
`Prop_UInt_4` UInt32

Event ID 403: Remote id not found: store=Prop_ULong, found=Prop_UInt.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Remote id not found: store=Prop_ULong, found=Prop_UInt.

Message #

Remote id not found: store=%1, found=%2

Fields #

Name	Description
`Prop_ULong` UInt64
`Prop_UInt` UInt32

Event ID 404: Appointment cache skipped because of missing prop: Prop_ULong.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Appointment cache skipped because of missing prop: Prop_ULong.

Message #

Appointment cache skipped because of missing prop: %1

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 405: CalendarSearch: Prop_UInt_1 recurring appts found.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CalendarSearch: Prop_UInt_1 recurring appts found. future items = Prop_UInt_2, past items = Prop_UInt_3.

Message #

CalendarSearch: %1 recurring appts found. future items = %2, past items = %3

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32

Event ID 406: CalendarSearch: inserted item Prop_UInt_1, type Prop_UInt_2.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CalendarSearch: inserted item Prop_UInt_1, type Prop_UInt_2.

Message #

CalendarSearch: inserted item %1, type %2

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32

Event ID 407: Appointment Cache notified: invalidate calendars [Prop_Boolean_1], invalidate cache [Prop_Boolean_2].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Appointment Cache notified: invalidate calendars [Prop_Boolean_1], invalidate cache [Prop_Boolean_2].

Message #

Appointment Cache notified: invalidate calendars [%1], invalidate cache [%2]

Fields #

Name	Description
`Prop_Boolean_1` Boolean
`Prop_Boolean_2` Boolean

Event ID 501: Modifying Feed of Type Prop_UInt_1 for OLITEMID: Prop_UInt_2 Prop_UInt_3 Prop_UInt_4.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Modifying Feed of Type Prop_UInt_1 for OLITEMID: Prop_UInt_2 Prop_UInt_3 Prop_UInt_4.

Message #

Modifying Feed of Type %1 for OLITEMID: %2 %3 %4

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32
`Prop_UInt_4` UInt32

Event ID 502: Invalid Timestamp for Feed Item: remoteId.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Invalid Timestamp for Feed Item: remoteId.

Message #

Invalid Timestamp for Feed Item: %1

Fields #

Name	Description
`remoteId` UnicodeString

Event ID 503: Feed for contact remoteId as a part of operation operationId did not provide enough items.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Feed for contact remoteId as a part of operation operationId did not provide enough items. requestAmnt were requested and providedAmnt were provided with qualifyingAmnt qualifying. Marking as failed.

Message #

Feed for contact %1 as a part of operation %2 did not provide enough items. %3 were requested and %4 were provided with %5 qualifying. Marking as failed.

Fields #

Name	Description
`remoteId` UnicodeString
`operationId` UInt32
`requestAmnt` UInt32
`providedAmnt` UInt32
`qualifyingAmnt` UInt32

Event ID 504: The following deep link is invalid: deepLink.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

The following deep link is invalid: deepLink.

Message #

The following deep link is invalid: %1

Fields #

Name	Description
`deepLink` UnicodeString

Event ID 505: The following image url is too long: deepLink.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

The following image url is too long: deepLink.

Message #

The following image url is too long: %1

Fields #

Name	Description
`deepLink` UnicodeString

Event ID 602: Invalid Pending Upload Request Indentifier Format Encountered

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Invalid Pending Upload Request Indentifier Format Encountered.

Message #

Invalid Pending Upload Request Indentifier Format Encountered

Event ID 700: ChatStoreChangedEventSink handle: Advise to Messaging OM.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatStoreChangedEventSink handle: Advise to Messaging OM.

Message #

ChatStoreChangedEventSink %1: Advise to Messaging OM

Fields #

Name	Description
`handle` Pointer

Event ID 701: ChatStoreChangedEventSink handle: Unadvise from Messaging OM.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatStoreChangedEventSink handle: Unadvise from Messaging OM.

Message #

ChatStoreChangedEventSink %1: Unadvise from Messaging OM

Fields #

Name	Description
`handle` Pointer

Event ID 702: ChatStoreChanged event: event type [EventType], item type [ItemType].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatStoreChanged event: event type [EventType], item type [ItemType].

Message #

ChatStoreChanged event: event type [%1], item type [%2]

Fields #

Name	Description
`EventType` UInt32
`ItemType` UInt32

Event ID 705: Activation status change notification received for Capability Service.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Activation status change notification received for Capability Service. New status: ActivationStatus.

Message #

Activation status change notification received for Capability Service. New status: %1

Fields #

Name	Description
`ActivationStatus` UInt32

Event ID 706: Unknown activation status for Capability Service: ActivationStatus.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Unknown activation status for Capability Service: ActivationStatus.

Message #

Unknown activation status for Capability Service: %1

Fields #

Name	Description
`ActivationStatus` UInt32

Event ID 707: Request Capabilities: TelString.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Request Capabilities: TelString.

Message #

Request Capabilities: %1

Fields #

Name	Description
`TelString` UnicodeString

Event ID 708: Capabilities retrieved: TelString, capabilities are RcsCapabilityBits.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Capabilities retrieved: TelString, capabilities are RcsCapabilityBits.

Message #

Capabilities retrieved: %1, capabilities are %2

Fields #

Name	Description
`TelString` UnicodeString
`RcsCapabilityBits` UInt32

Event ID 709: Notifying messaging app: PFN = {AppPackageFamilyName}; actions = {NotificationActions}.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Notifying messaging app: PFN = {AppPackageFamilyName}; actions = {NotificationActions}.

Message #

Notifying messaging app: PFN = {AppPackageFamilyName}; actions = {NotificationActions}

Fields #

Name	Description
`AppPackageFamilyName`
`NotificationActions`

Event ID 711: ComposingStatusChangedEventSink handle: Advise to RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ComposingStatusChangedEventSink handle: Advise to RCS.

Message #

ComposingStatusChangedEventSink %1: Advise to RCS

Fields #

Name	Description
`handle` Pointer

Event ID 712: ComposingStatusChangedEventSink handle: Unadvise from RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ComposingStatusChangedEventSink handle: Unadvise from RCS.

Message #

ComposingStatusChangedEventSink %1: Unadvise from RCS

Fields #

Name	Description
`handle` Pointer

Event ID 713: ComposingStatusChanged event: source [RCS], chat id [RcsChatId], is group [isGroup], teluri [TelString], is composing [isComposing].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ComposingStatusChanged event: source [RCS], chat id [RcsChatId], is group [isGroup], teluri [TelString], is composing [isComposing].

Message #

ComposingStatusChanged event: source [RCS], chat id [%1], is group [%2], teluri [%3], is composing [%4]

Fields #

Name	Description
`RcsChatId` UnicodeString
`isGroup` Boolean
`TelString` UnicodeString
`isComposing` Boolean

Event ID 714: RcsEndUserMessageEventSink handle: Advise to End User Messages.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsEndUserMessageEventSink handle: Advise to End User Messages.

Message #

RcsEndUserMessageEventSink %1: Advise to End User Messages

Fields #

Name	Description
`handle` Pointer

Event ID 715: RcsEndUserMessageEventSink handle: Unadvise from End User Messages.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsEndUserMessageEventSink handle: Unadvise from End User Messages.

Message #

RcsEndUserMessageEventSink %1: Unadvise from End User Messages

Fields #

Name	Description
`handle` Pointer

Event ID 716: RcsServiceStatusChangedEventSink handle: Advise to RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsServiceStatusChangedEventSink handle: Advise to RCS.

Message #

RcsServiceStatusChangedEventSink %1: Advise to RCS

Fields #

Name	Description
`handle` Pointer

Event ID 717: RcsServiceStatusChangedEventSink handle: Unadvise from RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsServiceStatusChangedEventSink handle: Unadvise from RCS.

Message #

RcsServiceStatusChangedEventSink %1: Unadvise from RCS

Fields #

Name	Description
`handle` Pointer

Event ID 718: RcsServiceStatusChanged event: service type [serviceType], is supported [isSupported].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsServiceStatusChanged event: service type [serviceType], is supported [isSupported].

Message #

RcsServiceStatusChanged event: service type [%1], is supported [%2]

Fields #

Name	Description
`serviceType` UInt32	Known values `1` Kernel Driver `2` File System Driver `4` Adapter `8` Recognizer Driver `16` Own Process `32` Share Process `256` Interactive
`isSupported` Boolean

Event ID 719: Default messaging app fall back to: AppPackageFamilyName.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Default messaging app fall back to: AppPackageFamilyName.

Message #

Default messaging app fall back to: %1

Fields #

Name	Description
`AppPackageFamilyName` UnicodeString

Event ID 720: Rcs service initialization started

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service initialization started.

Message #

Rcs service initialization started

Event ID 721: Rcs service is not available

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service is not available.

Message #

Rcs service is not available

Event ID 722: Rcs service adapter initialized

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service adapter initialized.

Message #

Rcs service adapter initialized

Event ID 723: Rcs service adapter released

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service adapter released.

Message #

Rcs service adapter released

Event ID 724: Rcs service adapter lost connection

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service adapter lost connection.

Message #

Rcs service adapter lost connection

Event ID 725: Chat: ChatOperationContextGetMessageProperties

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ChatOperationContextGetMessageProperties.

Message #

Chat: ChatOperationContextGetMessageProperties

Event ID 726: Chat: ChatOperationContextGetMessageParticipants

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ChatOperationContextGetMessageParticipants.

Message #

Chat: ChatOperationContextGetMessageParticipants

Event ID 727: Chat: ChatOperationContextGetMessageAttachments

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ChatOperationContextGetMessageAttachments.

Message #

Chat: ChatOperationContextGetMessageAttachments

Event ID 728: Chat: ChatOperationContext_MarkAsSeen

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ChatOperationContext_MarkAsSeen.

Message #

Chat: ChatOperationContext_MarkAsSeen

Event ID 729: Chat: GetChatMessageProperties

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: GetChatMessageProperties.

Message #

Chat: GetChatMessageProperties

Event ID 730: Chat: UdmSvcImpl_GetChatObjectProperties

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: UdmSvcImpl_GetChatObjectProperties.

Message #

Chat: UdmSvcImpl_GetChatObjectProperties

Event ID 731: Chat: ProcessChatUpdatesBegin

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ProcessChatUpdatesBegin.

Message #

Chat: ProcessChatUpdatesBegin

Event ID 732: Chat: ProcessChatUpdatesEnd

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: ProcessChatUpdatesEnd.

Message #

Chat: ProcessChatUpdatesEnd

Event ID 733: Chat: UdmSvcImpl_UpdateChatObjects

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Chat: UdmSvcImpl_UpdateChatObjects.

Message #

Chat: UdmSvcImpl_UpdateChatObjects

Event ID 734: Notifying filter app: PFN = {AppPackageFamilyName}.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Notifying filter app: PFN = {AppPackageFamilyName}.

Message #

Notifying filter app: PFN = {AppPackageFamilyName}

Fields #

Name	Description
`AppPackageFamilyName`

Event ID 735: Conversation does not exist.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Conversation does not exist. ConversationId: [Prop_ULong].

Message #

Conversation does not exist. ConversationId: [%1]

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 736: One or more conversation properties were not found.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

One or more conversation properties were not found. ConversationId: [Prop_ULong].

Message #

One or more conversation properties were not found. ConversationId: [%1]

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 737: Got a ChatMessage without recipients.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got a ChatMessage without recipients.

Message #

Got a ChatMessage without recipients.

Event ID 738: ChatCapabilitiesContext::GetCachedChatCapabilities()

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::GetCachedChatCapabilities().

Message #

ChatCapabilitiesContext::GetCachedChatCapabilities()

Event ID 739: ChatCapabilitiesContext::GetCachedChatCapabilities() - Contact not found

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::GetCachedChatCapabilities() - Contact not found.

Message #

ChatCapabilitiesContext::GetCachedChatCapabilities() - Contact not found

Event ID 740: ChatCapabilitiesContext::GetCachedChatCapabilities() - Found a cached contact

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::GetCachedChatCapabilities() - Found a cached contact.

Message #

ChatCapabilitiesContext::GetCachedChatCapabilities() - Found a cached contact

Event ID 741: ChatCapabilitiesContext::GetCachedChatCapabilities() - capabilities = Prop_ULong.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::GetCachedChatCapabilities() - capabilities = Prop_ULong.

Message #

ChatCapabilitiesContext::GetCachedChatCapabilities() - capabilities = %1

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 742: ChatCapabilitiesContext::GetCapabilitiesFromNetwork()

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::GetCapabilitiesFromNetwork().

Message #

ChatCapabilitiesContext::GetCapabilitiesFromNetwork()

Event ID 743: ChatCapabilitiesContext::_RequestCapabilities()

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::_RequestCapabilities().

Message #

ChatCapabilitiesContext::_RequestCapabilities()

Event ID 744: Conversation does not exist.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Conversation does not exist. Provider count: [Prop_UInt_1], First Provider id [Prop_UInt_2].

Message #

Conversation does not exist. Provider count: [%1], First Provider id [%2]

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32

Event ID 745: Got app manager instance.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got app manager instance. HResult: [P1_HResult].

Message #

Got app manager instance. HResult: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 746: Got default messaging application.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got default messaging application. HResult: [P1_HResult].

Message #

Got default messaging application. HResult: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 747: Got messaging app package family name.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got messaging app package family name. HResult: [P1_HResult].

Message #

Got messaging app package family name. HResult: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 748: Got transport IDs.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got transport IDs. HResult: [P1_HResult].

Message #

Got transport IDs. HResult: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 749: Got one default transport ID.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got one default transport ID. HResult: [P1_HResult] TransportID: [Prop_ULong].

Message #

Got one default transport ID. HResult: [%1] TransportID: [%2]

Fields #

Name	Description
`P1_HResult` Int32
`Prop_ULong` UInt64

Event ID 750: Got one default transport ID.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Got one default transport ID. HResult: [P1_HResult] TransportID: [Prop_ULong].

Message #

Got one default transport ID. HResult: [%1] TransportID: [%2]

Fields #

Name	Description
`P1_HResult` Int32
`Prop_ULong` UInt64

Event ID 751: Flattened items to send.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Flattened items to send. HResult: [P1_HResult].

Message #

Flattened items to send. HResult: [%1]

Fields #

Name	Description
`P1_HResult` Int32

Event ID 752: ChatCapabilitiesContext::_FindCachedPhoneNumberCapabilities found = [Prop_ULong].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatCapabilitiesContext::_FindCachedPhoneNumberCapabilities found = [Prop_ULong].

Message #

ChatCapabilitiesContext::_FindCachedPhoneNumberCapabilities found = [%1]

Fields #

Name	Description
`Prop_ULong` UInt64

Event ID 753: RcsMultipartMessageTracker::_OnChatOpenedWorker()

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsMultipartMessageTracker::_OnChatOpenedWorker().

Message #

RcsMultipartMessageTracker::_OnChatOpenedWorker()

Event ID 754: ChatAppManager::GetDefaultMessagingApp found default messaging app in registery.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::GetDefaultMessagingApp found default messaging app in registery.

Message #

ChatAppManager::GetDefaultMessagingApp found default messaging app in registery.

Event ID 755: ChatAppManager::GetDefaultMessagingApp ChatAppManager::GetAllMessagingApps() failed to find any messaging apps.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::GetDefaultMessagingApp ChatAppManager::GetAllMessagingApps() failed to find any messaging apps.

Message #

ChatAppManager::GetDefaultMessagingApp ChatAppManager::GetAllMessagingApps() failed to find any messaging apps.

Event ID 756: ChatAppManager::_GetDefaultMessagingAppInRegistry default app not found in registry.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::_GetDefaultMessagingAppInRegistry default app not found in registry.

Message #

ChatAppManager::_GetDefaultMessagingAppInRegistry default app not found in registry.

Event ID 757: ChatAppManager::SetDefaultMessagingAppInRegistry().

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::SetDefaultMessagingAppInRegistry().

Message #

ChatAppManager::SetDefaultMessagingAppInRegistry().

Event ID 758: ChatAppManager::SetDefaultMessagingApp app already registered.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::SetDefaultMessagingApp app already registered.

Message #

ChatAppManager::SetDefaultMessagingApp app already registered.

Event ID 759: ChatAppManager::_SetDefaultMessagingAppInRegistry().

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::_SetDefaultMessagingAppInRegistry().

Message #

ChatAppManager::_SetDefaultMessagingAppInRegistry().

Fields #

Name	Description
`P1_UnicodeString` UnicodeString

Event ID 760: ChatAppManager::GetAllDefaultCapableMessagingApps().

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

ChatAppManager::GetAllDefaultCapableMessagingApps(). - no default apps found.

Message #

ChatAppManager::GetAllDefaultCapableMessagingApps(). - no default apps found

Event ID 761: Rcs service status adapter not available

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Rcs service status adapter not available.

Message #

Rcs service status adapter not available

Event ID 762: RcsTransportChangedEventSink handle: Advise to RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsTransportChangedEventSink handle: Advise to RCS.

Message #

RcsTransportChangedEventSink %1: Advise to RCS

Fields #

Name	Description
`handle` Pointer

Event ID 763: RcsTransportChangedEventSink handle: Unadvise from RCS.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsTransportChangedEventSink handle: Unadvise from RCS.

Message #

RcsTransportChangedEventSink %1: Unadvise from RCS

Fields #

Name	Description
`handle` Pointer

Event ID 764: RcsTransportChanged event

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

RcsTransportChanged event.

Message #

RcsTransportChanged event

Event ID 800: CallHistoryNotificationManager NotifyCallHistoryApps.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

CallHistoryNotificationManager NotifyCallHistoryApps.

Message #

CallHistoryNotificationManager NotifyCallHistoryApps.

Event ID 1000: Udm_IntializedSecurityInfoStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_IntializedSecurityInfo
Opcode: Start

Event ID 1001: Udm_IntializedSecurityInfoStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_IntializedSecurityInfo
Opcode: Stop

Event ID 1002: Udm_OpenSessionStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_OpenSession
Opcode: Start

Event ID 1003: Udm_OpenSessionStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_OpenSession
Opcode: Stop

Event ID 1004: Udm_OpenCallHistorySessionStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_OpenCallHistorySession
Opcode: Start

Event ID 1005: Udm_OpenCallHistorySessionStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Udm_OpenCallHistorySession
Opcode: Stop

Event ID 1100: Calendar_UpdateCalendarObjectsStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_UpdateCalendarObjects
Opcode: Start

Event ID 1101: Calendar_UpdateCalendarObjectsStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_UpdateCalendarObjects
Opcode: Stop

Event ID 1104: Calendar_GetConflictInfoStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetConflictInfo
Opcode: Start

Event ID 1105: Calendar_GetConflictInfoStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetConflictInfo
Opcode: Stop

Event ID 1106: Calendar_RespondMeetingRequestStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_RespondMeetingRequest
Opcode: Start

Event ID 1107: Calendar_RespondMeetingRequestStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_RespondMeetingRequest
Opcode: Stop

Event ID 1108: Calendar_ProposeNewTimeStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_ProposeNewTime
Opcode: Start

Event ID 1109: Calendar_ProposeNewTimeStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_ProposeNewTime
Opcode: Stop

Event ID 1110: Calendar_CreateForwardMessageStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_CreateForwardMessage
Opcode: Start

Event ID 1111: Calendar_CreateForwardMessageStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_CreateForwardMessage
Opcode: Stop

Event ID 1112: Calendar_GetChangedAppointmentsSinceStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetChangedAppointmentsSince
Opcode: Start

Event ID 1113: Calendar_GetChangedAppointmentsSinceStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetChangedAppointmentsSince
Opcode: Stop

Event ID 1114: Calendar_GetCalendarStoreEnumStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetCalendarStoreEnum
Opcode: Start

Event ID 1115: Calendar_GetCalendarStoreEnumStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetCalendarStoreEnum
Opcode: Stop

Event ID 1116: Calendar_GetCalendarEnumStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetCalendarEnum
Opcode: Start

Event ID 1117: Calendar_GetCalendarEnumStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetCalendarEnum
Opcode: Stop

Event ID 1118: Calendar_GetAppointmentEnumStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetAppointmentEnum
Opcode: Start

Event ID 1119: Calendar_GetAppointmentEnumStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_GetAppointmentEnum
Opcode: Stop

Event ID 1120: Calendar_EnumMultiDayStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumMultiDay
Opcode: Start

Event ID 1121: Calendar_EnumMultiDayStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumMultiDay
Opcode: Stop

Event ID 1122: Calendar_EnumSingleInstanceStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumSingleInstance
Opcode: Start

Event ID 1123: Calendar_EnumSingleInstanceStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumSingleInstance
Opcode: Stop

Event ID 1124: Calendar_EnumRecurringStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumRecurring
Opcode: Start

Event ID 1125: Calendar_EnumRecurringStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_EnumRecurring
Opcode: Stop

Event ID 1126: Calendar_Search_OpenStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_Search_Open
Opcode: Start

Event ID 1127: Calendar_Search_OpenStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_Search_Open
Opcode: Stop

Event ID 1128: Calendar_Search_FetchStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_Search_Fetch
Opcode: Start

Event ID 1129: Calendar_Search_FetchStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Calendar_Search_Fetch
Opcode: Stop

Event ID 1200: Meeting_CreateOrModifyAppointmentStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Meeting_CreateOrModifyAppointment
Opcode: Start

Event ID 1201: Meeting_CreateOrModifyAppointmentStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Meeting_CreateOrModifyAppointment
Opcode: Stop

Event ID 1202: Meeting_GetStreamPropertyStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Meeting_GetStreamProperty
Opcode: Start

Event ID 1203: Meeting_GetStreamPropertyStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Meeting_GetStreamProperty
Opcode: Stop

Event ID 1204: App: AppName, Action: AccessedString.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

App: AppName, Action: AccessedString.

Message #

App: %1, Action: %2

Fields #

Name	Description
`AppName` AnsiString
`AccessedString` AnsiString

Event ID 1205: App: AppName, Action: AccessedString.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

App: AppName, Action: AccessedString.

Message #

App: %1, Action: %2

Fields #

Name	Description
`AppName` AnsiString
`AccessedString` AnsiString

Event ID 1206: Chat_GetChatConversationPropertiesStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetChatConversationProperties
Opcode: Start

Event ID 1207: Chat_GetChatConversationPropertiesStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetChatConversationProperties
Opcode: Stop

Event ID 1208: Chat_GetMessageAttachmentsStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetMessageAttachments
Opcode: Start

Event ID 1209: Chat_GetMessageAttachmentsStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetMessageAttachments
Opcode: Stop

Event ID 1210: Chat_GetMessageParticipantsStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetMessageParticipants
Opcode: Start

Event ID 1211: Chat_GetMessageParticipantsStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_GetMessageParticipants
Opcode: Stop

Event ID 1212: Chat_ChatOperationContext_GetMessagePropertiesStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_GetMessageProperties
Opcode: Start

Event ID 1213: Chat_ChatOperationContext_GetMessagePropertiesStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_GetMessageProperties
Opcode: Stop

Event ID 1214: Chat_ChatOperationContext_ModifyConversationItemStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_ModifyConversationItem
Opcode: Start

Event ID 1215: Chat_ChatOperationContext_ModifyConversationItemStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_ModifyConversationItem
Opcode: Stop

Event ID 1216: Chat_ChatOperationContext_ModifyItemStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_ModifyItem
Opcode: Start

Event ID 1217: Chat_ChatOperationContext_ModifyItemStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_ChatOperationContext_ModifyItem
Opcode: Stop

Event ID 1218: User_DataModel_ServiceStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: User_DataModel_Service
Opcode: Start

Event ID 1219: User_DataModel_ServiceStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: User_DataModel_Service
Opcode: Stop

Event ID 1220: Chat_DataModel_ServiceStart

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_DataModel_Service
Opcode: Start

Event ID 1221: Chat_DataModel_ServiceStop

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational
Task: Chat_DataModel_Service
Opcode: Stop

Event ID 2001: Cleaning up stale data.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Cleaning up stale data. Priority cleanup? [Prop_Boolean_1] Pending Installs? [Prop_Boolean_2].

Message #

Cleaning up stale data. Priority cleanup? [%1] Pending Installs? [%2]

Fields #

Name	Description
`Prop_Boolean_1` Boolean
`Prop_Boolean_2` Boolean

Event ID 2002: Starting the knowledge defragmentation task for all sync partners

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Starting the knowledge defragmentation task for all sync partners.

Message #

Starting the knowledge defragmentation task for all sync partners

Event ID 2003: Finished the knowledge defragmentation task.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Finished the knowledge defragmentation task. Examined Prop_UInt_1 stores and Prop_UInt_2 partners out of which defragmentation succeeded for Prop_UInt_3, partially succeeded for Prop_UInt_4 and failed for Prop_UInt_5.

Message #

Finished the knowledge defragmentation task. Examined %1 stores and %2 partners out of which defragmentation succeeded for %3, partially succeeded for %4 and failed for %5.

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32
`Prop_UInt_4` UInt32
`Prop_UInt_5` UInt32

Event ID 2004: Starting the knowledge defragmentation task for all sync partners associated with store Prop_Prop.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Starting the knowledge defragmentation task for all sync partners associated with store Prop_Prop.

Message #

Starting the knowledge defragmentation task for all sync partners associated with store %1

Fields #

Name	Description
`Prop_Prop` UInt32

Event ID 2005: Finished the knowledge defragmentation task for all sync partners associated with store Prop_UInt_1.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

Finished the knowledge defragmentation task for all sync partners associated with store . Examined partners out of which defragmentation succeeded for , partially succeeded for and failed for .

Message #

Finished the knowledge defragmentation task for all sync partners associated with store %1. Examined %2 partners out of which defragmentation succeeded for %3, partially succeeded for %4 and failed for %5.

Fields #

Name	Description
`Prop_UInt_1` UInt32
`Prop_UInt_2` UInt32
`Prop_UInt_3` UInt32
`Prop_UInt_4` UInt32
`Prop_UInt_5` UInt32

Event ID 2006: App Store Deleted: App Id [AppId], Reason [AppDataCleanupReason].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

App Store Deleted: App Id [AppId], Reason [AppDataCleanupReason].

Message #

App Store Deleted: App Id [%1], Reason [%2]

Fields #

Name	Description
`AppId` UnicodeString
`AppDataCleanupReason` UInt32

Event ID 2007: App Store Grouping Deleted: App Id [AppId], Reason [AppDataCleanupReason].

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

App Store Grouping Deleted: App Id [AppId], Reason [AppDataCleanupReason].

Message #

App Store Grouping Deleted: App Id [%1], Reason [%2]

Fields #

Name	Description
`AppId` UnicodeString
`AppDataCleanupReason` UInt32

Event ID 2008: HandlePackageUninstall called for PFN: P1_UnicodeString.

Provider: Microsoft-Windows-UserDataAccess-UserDataService
Channel: Operational

Description

HandlePackageUninstall called for PFN: P1_UnicodeString.

Message #

HandlePackageUninstall called for PFN: %1

Fields #

Name	Description
`P1_UnicodeString` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID fb19ee2c-0d22-4a2e-969e-dd41ae0ce1a9

Defined in UserDataService.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)