Microsoft-Windows-UserSettingsBackup-BackupUnitProcessor

Event	Title	Channel	Sample	Rule
1	Error ErrorCode occurred.	Operational	N	N
2	An operation did not complete as expected.	Operational	N	N
3	See event details for more information.	Operational	N	N
4	Failed to discover backup units for user UserId (type: UserIdType) as specified …	Operational	N	N
5	An exception occurrred while trying to perform an operation.	Operational	N	N
6	Could not open local security group Name (SID: SID).	Operational	N	N
7	Could not create local security group Name (SID: SID).	Operational	N	N
8	Could not add user userId to local security group Name (SID: SID).	Operational	N	N
9	An error occurred while backing up or restoring data.	Operational	N	N

Event ID 1: Error ErrorCode occurred.

Channel: Operational

Description

Error ErrorCode occurred. See event details for more information.

Message #

Error %2 occurred. See event details for more information.

Fields #

Name	Description
`Type` UInt32
`ErrorCode` UInt32
`Message` UnicodeString
`File` AnsiString
`LineNumber` UInt32

Event ID 2: An operation did not complete as expected.

Channel: Operational

Description

An operation did not complete as expected. See event details for more information.

Message #

An operation did not complete as expected. See event details for more information.

Fields #

Name	Description
`Message` UnicodeString
`File` AnsiString
`LineNumber` UInt32

Event ID 3: See event details for more information.

Channel: Operational

Fields #

Name	Description
`Message` UnicodeString
`File` AnsiString
`LineNumber` UInt32

Event ID 4: Failed to discover backup units for user UserId (type: UserIdType) as specified user id did not match any user discovered by the backup unit processor.

Channel: Operational

Message #

Failed to discover backup units for user %1 (type: %2) as specified user id did not match any user discovered by the backup unit processor.

Fields #

Name	Description
`UserId` UnicodeString
`UserIdType` UInt32
`UserIdTypeText` AnsiString

Event ID 5: An exception occurrred while trying to perform an operation.

Channel: Operational

Description

An exception occurrred while trying to perform an operation. See event details for more information.

Message #

An exception occurrred while trying to perform an operation. See event details for more information.

Fields #

Name	Description
`OperationTag` UnicodeString
`ExceptionType` AnsiString
`TranslatedErrorCode` Int32
`OriginalErrorCode` UInt32
`ExceptionMessage` UnicodeString

Event ID 6: Could not open local security group Name (SID: SID).

Channel: Operational

Message #

Could not open local security group %1 (SID: %2)

Fields #

Name	Description
`Name` UnicodeString
`SID` UnicodeString
`IsWellKnown` Boolean
`TranslatedErrorCode` Int32
`Message` UnicodeString

Event ID 7: Could not create local security group Name (SID: SID).

Channel: Operational

Message #

Could not create local security group %1 (SID: %2)

Fields #

Name	Description
`Name` UnicodeString
`SID` UnicodeString
`IsWellKnown` Boolean
`TranslatedErrorCode` Int32
`Message` UnicodeString

Event ID 8: Could not add user userId to local security group Name (SID: SID).

Channel: Operational

Message #

Could not add user %3 to local security group %1 (SID: %2)

Fields #

Name	Description
`Name` UnicodeString
`SID` UnicodeString
`userId` UnicodeString
`IsWellKnown` Boolean
`TranslatedErrorCode` Int32
`Message` UnicodeString

Event ID 9: An error occurred while backing up or restoring data.

Channel: Operational

Description

An error occurred while backing up or restoring data. See event details for more information.

Message #

An error occurred while backing up or restoring data. See event details for more information.

Fields #

Name	Description
`BackupUnitProcessorMode` AnsiString
`ErrorCauseType` UnicodeString
`ErrorCauseLocation` UnicodeString
`ErrorType` AnsiString
`TranslatedErrorCode` Int32
`HandlerResponse` AnsiString

Provenance

ETW provider GUID dc84bbf4-cded-56ef-bf3b-e2051d5589d5

Defined in UserSettingsBackup.BackupUnitProcessor.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB