Microsoft-WS-Licensing

EventTitleChannelSampleRule
5[ServiceCall] Service Call initiated for {ID} [Session ID].DiagnosticNN
6[ServiceCall] Service Call complete for {ID} [Session ID].DiagnosticNN
161Windows Store ignored the server Info.AdminNN
180[Service] Service initialization failed - result code: {HRESULT}.AdminNN
181[Service] WSService was restarted while there is a pending rearm reboot …AdminNN
184Windows Store Developer License OAuth Failed.AdminNN
186WSService failed to get license for a product.AdminNN
187WSClient failed to get licenses on update request.AdminNN
188There is no valid license present for productID: {guid}.AdminNN
189Licenses were requested for {Requested} product categories and valid licenses …AdminNN
190Windows Store simulated license initialized for {psz}.AdminNN
191WSService reported that the hardware changed.AdminNN
192WSService failed to collect hardware data.AdminNN
202[TLR] Success: {ResultCode} [Result Code].DebugNN
203[TLR] Error: {ResultCode} [Error Code].DebugNN
204[TLR] TLR began evaluating {ItemCount} [package count] packages with level …DebugNN
205[TLR] TLR completed evaluating all packages with level {TLRLevel} [TLR level]; …DebugNN
206[TLR] A TLR with level {TLRLevel} [TLR level] has been rescheduled for …DebugNN
211[TLR] Get Package completeDiagnosticNN
213[TLR] Set Package completeDiagnosticNN
254Windows Store has reported that the package origin for {PackageName} has changed …AdminNN
255Windows Store has reported that the package origin for {PackageName} has changed …AdminNN
256Windows Store has reported one or more files in package {PackageName} appear to …AdminNN
257Windows Store has reported that the block map for package {PackageName} appears …AdminNN
258The acquisition of the developer license failed.AdminNN
259The acquisition of the developer license failed.AdminNN
260Windows Store was unable to load the previous package list.AdminNN
261Windows Store was unable to load the latest package list.AdminNN
262Windows Store was unable to load the package list.AdminNN
263Windows Store was unable to load the full package list from AppX.AdminNN
264Windows Store was unable to update the remediation state for package …AdminNN
270Windows Store reported AppX failed to return a valid path for a package.AdminNN
271Windows Store reported AppX returned an empty path for package {PackageName}.AdminNN
280Windows Store reported that the developer license has been updated and is …AdminNN
281Windows Store reported that the developer license is no longer active.AdminNN
290Windows Store reported that the product license for {PackageFamily} has been …AdminNN
291Windows Store reported that the product license for {PackageFamily} is no longer …AdminNN
300Windows Store has successfully evaluated package {PackageName} - the package …AdminNN
301Windows Store detected a change to package {PackageName} - the package appears …AdminNN
302Windows Store reported that the package {PackageName} was not found and cannot …AdminNN
310Windows Store detected a package health issue with package {PackageName} - the …AdminNN
311Windows Store detected a license issue with package {PackageName} - the package …AdminNN
312Windows Store detected that package {PackageName} is being installed without a …AdminNN
315Windows Store has begun evaluating files for package {PackageName}.AdminNN
316Windows Store has completed evaluating files for package {PackageName}.AdminNN
320Windows Store rearm complete.AdminNN
512Windows Store failed to sync machine licenses.AdminNN
514Windows Store failed to recreate trusted store.AdminNN

Event ID 5: [ServiceCall] Service Call initiated for {ID} [Session ID].

#
Channel
Diagnostic

Fields #

NameDescription
ID

Event ID 6: [ServiceCall] Service Call complete for {ID} [Session ID].

#
Channel
Diagnostic

Fields #

NameDescription
ID

Event ID 161: Windows Store ignored the server Info.

#
Channel
Admin

Description

Windows Store ignored the server Info. Client nonce is: {ClientNonce}; server nonce is: {ReplayedNonce}.

Message #

Windows Store ignored the server Info. Client nonce is: {ClientNonce}; server nonce is: {ReplayedNonce}

Fields #

NameDescription
ClientNonce
ReplayedNonce

Event ID 180: [Service] Service initialization failed - result code: {HRESULT}.

#
Channel
Admin

Fields #

NameDescription
HRESULT

Event ID 181: [Service] WSService was restarted while there is a pending rearm reboot required.

#
Channel
Admin

Description

[Service] WSService was restarted while there is a pending rearm reboot required. Caller: {psz}.

Message #

[Service] WSService was restarted while there is a pending rearm reboot required.  Caller: {psz}

Fields #

NameDescription
psz

Event ID 184: Windows Store Developer License OAuth Failed.

#
Channel
Admin

Description

Windows Store Developer License OAuth Failed. HR = {HRESULT}; ErrorId = {ErrorId}; ErrorDescription = {ErrorDescription}.

Message #

Windows Store Developer License OAuth Failed. HR = {HRESULT}; ErrorId = {ErrorId}; ErrorDescription = {ErrorDescription}

Fields #

NameDescription
HRESULT
ErrorId
ErrorDescription

Event ID 186: WSService failed to get license for a product.

#
Channel
Admin

Description

WSService failed to get license for a product. productID: {WUGuid}. Error code: {HRESULT}.

Message #

WSService failed to get license for a product. productID: {WUGuid}. Error code: {HRESULT}

Fields #

NameDescription
WUGuid
HRESULT

Event ID 187: WSClient failed to get licenses on update request.

#
Channel
Admin

Description

WSClient failed to get licenses on update request. Error code: {HRESULT}.

Message #

WSClient failed to get licenses on update request. Error code: {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 188: There is no valid license present for productID: {guid}.

#
Channel
Admin

Fields #

NameDescription
guid

Event ID 189: Licenses were requested for {Requested} product categories and valid licenses were found for {Actual} categories.

#
Channel
Admin

Fields #

NameDescription
Requested
Actual

Event ID 190: Windows Store simulated license initialized for {psz}.

#
Channel
Admin

Fields #

NameDescription
psz

Event ID 191: WSService reported that the hardware changed.

#
Channel
Admin

Event ID 192: WSService failed to collect hardware data.

#
Channel
Admin

Description

WSService failed to collect hardware data. Stage: {Stage}. Error code: {ErrorCode}.

Message #

WSService failed to collect hardware data. Stage: {Stage}. Error code: {ErrorCode}

Fields #

NameDescription
Stage
ErrorCode

Event ID 202: [TLR] Success: {ResultCode} [Result Code].

#
Channel
Debug

Description

[TLR] Success: {ResultCode} [Result Code]. TLR completed evaluation for package family {PackageName} [Package Family] and {SubPackageCount} [Related Packages Count] full packages.

Message #

[TLR] Success: {ResultCode} [Result Code]. TLR completed evaluation for package family {PackageName} [Package Family] and {SubPackageCount} [Related Packages Count] full packages

Fields #

NameDescription
ResultCode
PackageName
SubPackageCount

Event ID 203: [TLR] Error: {ResultCode} [Error Code].

#
Channel
Debug

Description

[TLR] Error: {ResultCode} [Error Code]. TLR failed to evalute package family {PackageName} [Package Family] and {SubPackageCount} [Related Packages Count] full packages.

Message #

[TLR] Error: {ResultCode} [Error Code]. TLR failed to evalute package family {PackageName} [Package Family] and {SubPackageCount} [Related Packages Count] full packages

Fields #

NameDescription
ResultCode
PackageName
SubPackageCount

Event ID 204: [TLR] TLR began evaluating {ItemCount} [package count] packages with level {TLRLevel} [TLR level].

#
Channel
Debug

Fields #

NameDescription
ItemCount
TLRLevel

Event ID 205: [TLR] TLR completed evaluating all packages with level {TLRLevel} [TLR level]; with {SucceededCount} [success count]; {FailedCount} [failure count]...

#
Channel
Debug

Description

[TLR] TLR completed evaluating all packages with level {TLRLevel} [TLR level]; with {SucceededCount} [success count]; {FailedCount} [failure count]; and {CanceledCount} [canceled count].

Message #

[TLR] TLR completed evaluating all packages with level {TLRLevel} [TLR level]; with {SucceededCount} [success count]; {FailedCount} [failure count]; and {CanceledCount} [canceled count]

Fields #

NameDescription
TLRLevel
SucceededCount
FailedCount
CanceledCount

Event ID 206: [TLR] A TLR with level {TLRLevel} [TLR level] has been rescheduled for {RestartTime} [Restart time].

#
Channel
Debug

Fields #

NameDescription
TLRLevel
RestartTime

Event ID 211: [TLR] Get Package complete

#
Channel
Diagnostic

Event ID 213: [TLR] Set Package complete

#
Channel
Diagnostic

Event ID 254: Windows Store has reported that the package origin for {PackageName} has changed from {InitialOrigin} to {NewOrigin}.

#
Channel
Admin

Fields #

NameDescription
PackageName
InitialOrigin
NewOrigin

Event ID 255: Windows Store has reported that the package origin for {PackageName} has changed from {InitialOrigin} to {NewOrigin}.

#
Channel
Admin

Message #

Windows Store has reported that the package origin for {PackageName} has changed from {InitialOrigin} to {NewOrigin}.  This may indicate the package has been altered and you may need to re-install the package.

Fields #

NameDescription
PackageName
InitialOrigin
NewOrigin

Event ID 256: Windows Store has reported one or more files in package {PackageName} appear to be altered starting with file {FileName}.

#
Channel
Admin

Description

Windows Store has reported one or more files in package {PackageName} appear to be altered starting with file {FileName}. Please re-install the package.

Message #

Windows Store has reported one or more files in package {PackageName} appear to be altered starting with file {FileName}.  Please re-install the package.

Fields #

NameDescription
PackageName
FileName

Event ID 257: Windows Store has reported that the block map for package {PackageName} appears to be altered.

#
Channel
Admin

Description

Windows Store has reported that the block map for package {PackageName} appears to be altered. Please re-install the package.

Message #

Windows Store has reported that the block map for package {PackageName} appears to be altered.  Please re-install the package.

Fields #

NameDescription
PackageName

Event ID 258: The acquisition of the developer license failed.

#
Channel
Admin

Description

The acquisition of the developer license failed. The error was: {ErrorString}. Result code {HRESULT}.

Message #

The acquisition of the developer license failed. The error was: {ErrorString}. Result code {HRESULT}

Fields #

NameDescription
ErrorString
HRESULT

Event ID 259: The acquisition of the developer license failed.

#
Channel
Admin

Description

The acquisition of the developer license failed. Result code {HRESULT}.

Message #

The acquisition of the developer license failed. Result code {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 260: Windows Store was unable to load the previous package list.

#
Channel
Admin

Description

Windows Store was unable to load the previous package list.Result code: {HRESULT}.

Message #

Windows Store was unable to load the previous package list.Result code: {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 261: Windows Store was unable to load the latest package list.

#
Channel
Admin

Description

Windows Store was unable to load the latest package list.Result code: {HRESULT}.

Message #

Windows Store was unable to load the latest package list.Result code: {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 262: Windows Store was unable to load the package list.

#
Channel
Admin

Description

Windows Store was unable to load the package list.Result code: {HRESULT}.

Message #

Windows Store was unable to load the package list.Result code: {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 263: Windows Store was unable to load the full package list from AppX.

#
Channel
Admin

Description

Windows Store was unable to load the full package list from AppX.Result code: {HRESULT}.

Message #

Windows Store was unable to load the full package list from AppX.Result code: {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 264: Windows Store was unable to update the remediation state for package {PackageName}.

#
Channel
Admin

Description

Windows Store was unable to update the remediation state for package {PackageName}.Result code: {ResultCode}.

Message #

Windows Store was unable to update the remediation state for package {PackageName}.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 270: Windows Store reported AppX failed to return a valid path for a package.

#
Channel
Admin

Description

Windows Store reported AppX failed to return a valid path for a package. Package: {PackageName}Error: {ResultCode}.

Message #

Windows Store reported AppX failed to return a valid path for a package. Package: {PackageName}Error: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 271: Windows Store reported AppX returned an empty path for package {PackageName}.

#
Channel
Admin

Fields #

NameDescription
PackageName

Event ID 280: Windows Store reported that the developer license has been updated and is active.

#
Channel
Admin

Description

Windows Store reported that the developer license has been updated and is active.Status: {Status}Expiration date: {Expiration}Result code: {Reason}.

Message #

Windows Store reported that the developer license has been updated and is active.Status: {Status}Expiration date: {Expiration}Result code: {Reason}

Fields #

NameDescription
StatusNTSTATUS reference
Expiration
Reason

Event ID 281: Windows Store reported that the developer license is no longer active.

#
Channel
Admin

Description

Windows Store reported that the developer license is no longer active.Status: {Status}.Expiration date: {Expiration}Result code: {Reason}.

Message #

Windows Store reported that the developer license is no longer active.Status: {Status}.Expiration date: {Expiration}Result code: {Reason}

Fields #

NameDescription
StatusNTSTATUS reference
Expiration
Reason

Event ID 290: Windows Store reported that the product license for {PackageFamily} has been updated and is active.

#
Channel
Admin

Message #

Windows Store reported that the product license for {PackageFamily} has been updated and is active.Status: {Status}Expiration date: {Expiration}Product Id: {ProductId}License Type: {LicenseType}Result code: {Reason}

Fields #

NameDescription
PackageFamily
StatusNTSTATUS reference
Expiration
ProductId
LicenseType
Reason

Event ID 291: Windows Store reported that the product license for {PackageFamily} is no longer active.

#
Channel
Admin

Message #

Windows Store reported that the product license for {PackageFamily} is no longer active.Status: {Status}Expiration date: {Expiration}Product Id: {ProductId}License Type: {LicenseType}Result code: {Reason}

Fields #

NameDescription
PackageFamily
StatusNTSTATUS reference
Expiration
ProductId
LicenseType
Reason

Event ID 300: Windows Store has successfully evaluated package {PackageName} - the package appears correct and licensed.

#
Channel
Admin

Description

Windows Store has successfully evaluated package {PackageName} - the package appears correct and licensed.Result code: {ResultCode}.

Message #

Windows Store has successfully evaluated package {PackageName} - the package appears correct and licensed.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 301: Windows Store detected a change to package {PackageName} - the package appears correct and licensed.

#
Channel
Admin

Description

Windows Store detected a change to package {PackageName} - the package appears correct and licensed.Result code: {ResultCode}.

Message #

Windows Store detected a change to package {PackageName} - the package appears correct and licensed.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 302: Windows Store reported that the package {PackageName} was not found and cannot be verified - the package was likely uninstalled since the last check.

#
Channel
Admin

Description

Windows Store reported that the package {PackageName} was not found and cannot be verified - the package was likely uninstalled since the last check.Result code: {ResultCode}.

Message #

Windows Store reported that the package {PackageName} was not found and cannot be verified - the package was likely uninstalled since the last check.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 310: Windows Store detected a package health issue with package {PackageName} - the package must be repaired before you can use it.

#
Channel
Admin

Description

Windows Store detected a package health issue with package {PackageName} - the package must be repaired before you can use it.Result code: {ResultCode}.

Message #

Windows Store detected a package health issue with package {PackageName} - the package must be repaired before you can use it.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 311: Windows Store detected a license issue with package {PackageName} - the package must be licensed before you can use it.

#
Channel
Admin

Description

Windows Store detected a license issue with package {PackageName} - the package must be licensed before you can use it.Result code: {ResultCode}.

Message #

Windows Store detected a license issue with package {PackageName} - the package must be licensed before you can use it.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 312: Windows Store detected that package {PackageName} is being installed without a valid AppStore license.

#
Channel
Admin

Message #

Windows Store detected that package {PackageName} is being installed without a valid AppStore license.This may be expected for some packages; but the package itself cannot be run.Result code: {ResultCode}

Fields #

NameDescription
PackageName
ResultCode

Event ID 315: Windows Store has begun evaluating files for package {PackageName}.

#
Channel
Admin

Fields #

NameDescription
PackageName

Event ID 316: Windows Store has completed evaluating files for package {PackageName}.

#
Channel
Admin

Description

Windows Store has completed evaluating files for package {PackageName}.Evaluated file count: {FileCount}Result code: {ResultCode}.

Message #

Windows Store has completed evaluating files for package {PackageName}.Evaluated file count: {FileCount}Result code: {ResultCode}

Fields #

NameDescription
PackageName
FileCount
ResultCode

Event ID 320: Windows Store rearm complete.

#
Channel
Admin

Description

Windows Store rearm complete. Result code {HRESULT}.

Message #

Windows Store rearm complete.  Result code {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 512: Windows Store failed to sync machine licenses.

#
Channel
Admin

Description

Windows Store failed to sync machine licenses. Result code {HRESULT}.

Message #

Windows Store failed to sync machine licenses. Result code {HRESULT}

Fields #

NameDescription
HRESULT

Event ID 514: Windows Store failed to recreate trusted store.

#
Channel
Admin

Description

Windows Store failed to recreate trusted store. Result code {HRESULT}.

Message #

Windows Store failed to recreate trusted store. Result code {HRESULT}

Fields #

NameDescription
HRESULT