Microsoft-Windows-WinRT-Error
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | OriginateError | Error | Y | N |
| 2 | OriginateLanguageError | Error | Y | N |
| 3 | TransformError | Error | Y | N |
| 4 | ClearError | Error | N | N |
Event ID 1: OriginateError
#Fields #
| Name | Description |
|---|---|
HRESULT Int32 | |
ErrorMesage UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WinRT-Error",
"guid": "{a86f8471-c31d-4fbc-a035-665d06047b03}",
"event_source_name": "",
"event_id": "1",
"version": "0",
"level": "4",
"task": "1",
"opcode": "0",
"keywords": 9223372036854775809,
"time_created": "2026-03-15T04:33:29.885970800+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{f69ce168-615e-4378-9e36-8a1f45d81654}"
},
"execution": {
"process_id": "1208",
"thread_id": "12836"
},
"channel": "Microsoft-Windows-Runtime/Error",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"HRESULT": "-2147024894",
"ErrorMesage": ""
},
"message": ""
}
Event ID 2: OriginateLanguageError
#Fields #
| Name | Description |
|---|---|
HRESULT Int32 | |
ErrorMesage UnicodeString | |
LanguageErrorPointer Pointer |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Runtime/Error",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 2,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 7988,
"thread_id": 7136
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-WinRT-Error",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 09:57:23.386Z",
"version": 0
},
"event_data": {
"ErrorMesage": "",
"HRESULT": -2147023888,
"LanguageErrorPointer": "0x0"
},
"message": ""
}
Event ID 3: TransformError
#Fields #
| Name | Description |
|---|---|
OriginalHRESULT Int32 | |
NewHRESULT Int32 | |
ErrorMesage UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-WinRT-Error",
"guid": "{a86f8471-c31d-4fbc-a035-665d06047b03}",
"event_source_name": "",
"event_id": "3",
"version": "0",
"level": "4",
"task": "3",
"opcode": "0",
"keywords": 9223372036854775809,
"time_created": "2026-03-15T04:33:29.886835500+00:00",
"event_record_id": 0,
"correlation": {
"ActivityID": "{f69ce168-615e-4378-9e36-8a1f45d81654}"
},
"execution": {
"process_id": "1208",
"thread_id": "12836"
},
"channel": "Microsoft-Windows-Runtime/Error",
"computer": "",
"security": {
"user_id": ""
}
},
"event_data": {
"OriginalHRESULT": "-2147024894",
"NewHRESULT": "-2147023838",
"ErrorMesage": ""
},
"message": ""
}
Event ID 4: ClearError
#Provenance
ETW provider GUID a86f8471-c31d-4fbc-a035-665d06047b03
Defined in combase.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB