Microsoft-Windows-WorkFolders
Event ID 0: The Windows Work Folders service is running.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-WorkFolders",
"guid": "{34A3697E-0F10-4E48-AF3C-F869B5BABEBB}",
"event_source_name": "",
"event_id": 0,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T03:58:29.6144658+00:00",
"event_record_id": 1,
"correlation": {},
"execution": {
"process_id": 14616,
"thread_id": 14340
},
"channel": "Microsoft-Windows-WorkFolders/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {},
"message": "The Windows Work Folders service is running."
}
Event ID 1: The Windows Work Folders service is stopping.
#Example Event #
{
"system": {
"provider": "Microsoft-Windows-WorkFolders",
"guid": "{34A3697E-0F10-4E48-AF3C-F869B5BABEBB}",
"event_source_name": "",
"event_id": 1,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": -9223372036854775808,
"time_created": "2026-05-30T04:15:21.9924849+00:00",
"event_record_id": 2,
"correlation": {},
"execution": {
"process_id": 14616,
"thread_id": 14340
},
"channel": "Microsoft-Windows-WorkFolders/Operational",
"computer": "JD-WIN11-22H2-1.ludus.domain",
"security": {
"user_id": "S-1-5-19"
}
},
"event_data": {},
"message": "The Windows Work Folders service is stopping."
}
Event ID 2: A sync partnership was created between LocalFolder and ServerURI (ServerPartnershipId).
#Event ID 3: A sync partnership between LocalFolder and ServerURI (ServerPartnershipId) was deleted.
#Event ID 4: Resuming sync between LocalFolder and ServerURI (ServerPartnershipId).
#Event ID 5: Attempting to apply the following Work Folders Group Policy configuration.
#Event ID 6: Attempting to remove the following Work Folders Group Policy configuration.
#Event ID 7: Configuring Work Folders through Group Policy with the following options.
#Event ID 8: Configuration of Work Folders through Group Policy succeeded.
#Event ID 9: While applying Work Folders configuration through Group Policy, an existing Work Folders configuration was found.
#Event ID 10: Configuration of Work Folders through Group Policy failed.
#Event ID 11: There was a problem removing the Work Folders configuration when applying Group Policy.
#Event ID 12: There was a problem communicating with the Windows Work Folders service.
#Event ID 13: There was a problem retrieving your Work Folders Group Policy configuration.
#Event ID 14: There was a problem retrieving your current Work Folders configuration.
#Event ID 15: There was a problem comparing the existing Work Folders configuration to the configuration being applied by Group Policy.
#Event ID 16: Server discovery on DiscoveryURL found server ServerURL.
#Event ID 17: Sync Share discovery succeeded.
#Event ID 18: The discovery URL was found from the user's email address.
#Event ID 19: This PC is incompatible with the Work Folders server and must be upgraded.
#Event ID 502: A sync partnership between LocalFolder and ServerURI (ServerPartnershipId) failed to create with HResultStr.
#Event ID 503: A sync partnership between LocalFolder and ServerURI (ServerPartnershipId) failed to delete with HResultStr.
#Event ID 516: Server discovery on DiscoveryURL failed with HResultStr.
#Event ID 517: Sync Share discovery failed.
#Event ID 518: Searching for a discovery URL from the user's email address failed.
#Event ID 1000: Some files cannot be downloaded.
#Event ID 1001: Failed to get an ADFS access token from the server.
#Event ID 1002: Failed to get an ADFS refresh token from the server.
#Event ID 1100: Work Folders sucessfully uploaded a file.
#Event ID 1101: Work Folders failed to upload a file.
#Event ID 1102: Work Folders sucessfully downloaded a file.
#Event ID 1103: Work Folders failed to download a file.
#Event ID 1104: Work Folders sucessfully uploaded a change batch.
#Event ID 1105: Work Folders failed to upload a change batch.
#Event ID 1106: Work Folders sucessfully downloaded a change batch.
#Event ID 1107: Work Folders failed to download a change batch.
#Event ID 2000: Work Folders couldn't detect changed files using the USN change journal, so it's scanning all files for changes.
#Event ID 2001: Sync started.
#Event ID 2002: Sync completed.
#Event ID 2003: Sync batch upload completed.
#Event ID 2004: Sync batch download completed.
#Event ID 2005: HTTP request failure.
#Event ID 2006: Work Folders skipped uploading a file because of an error.
#Event ID 2007: Work Folders will skip downloading files because the user doesn't have enough free space on the drive where Work Folders is located.
#Event ID 2008: Couldn't authenticate the user.
#Event ID 2009: Work Folders successfully synchronized an item.
#Event ID 2010: Work Folders failed to synchronize an item.
#Event ID 2011: Work Folders successfully updated the current state of an item.
#Event ID 2012: Work Folders failed to update the current state of an item.
#Event ID 2013: Work Folders detected a conflict on an item and decided a conflict resolution.
#Description
Work Folders detected a conflict on an item and decided a conflict resolution. Concurrency conflict: ConcurrencyConflict; Source item name: SourceItemName; Source sync ID: SourceSyncGID; Destination item name: DestinationItemName; Destination sync ID: DestinationSyncGID; Data winner: DataWinner; Namespace winner: NamespaceWinner; Attributes winner: AttributesWinner; Tie breaker winner: TieBreakerWinner
Message #
Fields #
| Name | Description |
|---|---|
ConcurrencyConflict Boolean | |
SourceItemName UnicodeString | |
SourceSyncGID GUID | |
DestinationItemName UnicodeString | |
DestinationSyncGID GUID | |
DataWinner UnicodeString | |
NamespaceWinner UnicodeString | |
AttributesWinner UnicodeString | |
TieBreakerWinner UnicodeString |
Event ID 2015: task_02015
#Fields #
| Name | Description |
|---|---|
LocalReplicaRoot UnicodeString | |
HResultStr UnicodeString | |
HResult Int32 |
Event ID 2016: Work Folders successfully fetched file content for a file.
#Event ID 2017: Work Folders failed to fetch file content for a file.
#Event ID 2018: Work Folders cancelled fetching file content for a file.
#Event ID 2019: Work Folders successfully removed file content from disk a file.
#Event ID 2020: Work Folders failed to remove file content from disk a file.
#Event ID 2021: Work Folders successfully repaired a broken file.
#Event ID 2022: Work Folders failed to repair a broken file.
#Event ID 2023: Work Folders could not find a broken file on the server.
#Event ID 2024: The on-demand file access setting has changed.
#Description
The on-demand file access setting has changed. On-demand file access is now Disabled.
Message #
Event ID 2025: The on-demand file access setting has changed.
#Description
The on-demand file access setting has changed. On-demand file access is now Enabled.
Message #
Event ID 2026: Work Folders successfully converted a file to enable on-demand functionality.
#Event ID 2027: Work Folders failed to convert a file to enable on-demand functionality.
#Event ID 2100: Sync failed.
#Event ID 2101: Work Folders suspended sync.
#Event ID 2102: Work Folders resumed syncing.
#Event ID 2103: Work Folders sync stopped because the Enterprise ID for this PC was remotely revoked by the issuing authority.
#Description
Work Folders sync stopped because the Enterprise ID for this PC was remotely revoked by the issuing authority. Access to files in Work Folders is blocked on this PC. To resume syncing, in the Work Folders Control Panel, click Stop using Work Folders and then recreate the Work Folders synchronization partnership. Partnership: SyncPartnershipId
Message #
Fields #
| Name | Description |
|---|---|
SyncPartnershipId UnicodeString |
Event ID 2104: Work Folders detected a database corruption and recovered.
#Event ID 2105: Work Folders detected a database corruption and recovery failed.
#Event ID 2106: Work Folders detected that the server database has been recreated.
#Event ID 2107: Work Folders detected that an error occured that requires the database to be recreated.
#Event ID 2108: Work Folders synchronization metadata is stale.
#Event ID 2109: The Work Folders synchronization metadata was created.
#Event ID 2110: The Work Folders synchronization metadata could not be created.
#Event ID 2111: The Work Folders synchronization metadata was deleted.
#Event ID 2112: The Work Folders synchronization metadata could not be deleted.
#Event ID 2113: Work Folders failed to update the current state of an item.
#Event ID 2114: Work Folders failed to synchronize an item.
#Event ID 2115: Work Folders detected a database version that is incompatible and recovered it.
#Event ID 2116: Work Folders detected a database version that is incompatible and recovery failed.
#Event ID 2117: Work Folders failed to connect with Cloud Files.
#Event ID 2118: Work Folders failed to disconnect with Cloud Files.
#Event ID 2119: Work Folders failed to register with Cloud Files.
#Event ID 2120: Work Folders failed to unregister with Cloud Files.
#Event ID 8000: Starting sync.
#Event ID 8001: Work Folders is looking for changed files.
#Event ID 8002: Starting to download files.
#Event ID 8003: Starting to upload files.
#Event ID 8004: Finished syncing.
#Event ID 8005: Starting reconciliation sync.
#Event ID 8006: Finished reconciliation sync.
#Event ID 8007: Starting sync knowledge upload.
#Event ID 8008: Starting data transfer for file download.
#Event ID 8009: Applying downloaded files.
#Event ID 8010: Starting sync knowledge download.
#Event ID 8011: Creating a change batch for upload.
#Event ID 8012: Starting data transfer for file upload.
#Event ID 8013: Work Folders successfully connected with Cloud Files.
#Event ID 8014: Work Folders successfully disconnected with Cloud Files.
#Event ID 8015: Work Folders successfully registered with Cloud Files.
#Event ID 8016: Work Folders successfully unregistered with Cloud Files.
#Event ID 8017: Work Folders detected files that cannot be uploaded.
#Description
Work Folders detected files that cannot be uploaded. File repair started.
Message #
Event ID 8018: Work Folders file repair completed.
#Event ID 8019: Starting cleanup before reconciliation.
#Event ID 8020: Finished cleanup before reconciliation.
#Event ID 9001: Credentials required for the user.
#Fields #
| Name | Description |
|---|---|
hc_stateid UInt32 | |
Application UnicodeString |
Event ID 9002: Work Folders detected a sync error.
#Event ID 9003: Work Folders detected a file error.
#Provenance
ETW provider GUID 34a3697e-0f10-4e48-af3c-f869b5babebb
Defined in WorkFoldersSvc.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB