wincheck rc8.57

May 29, 2017, 10:24 am

≫ Next: how to find PspUniqueJobIdTable

≪ Previous: wnf kernelmode callbacks

download
mirror
Changelog:

add support of numerous versions of windows 10 insider preview - up to 16193
add dumping of FilterConnectionPorts
add support of RFG (and v2 too)
add dumping of ntdll!ProtectedPolicies
add dumping of kernel etw traces (-wmi option)
add dumping of EPROCESS.WnfContext
add dumping of WNF kernelmode callbacks (-wnf option)

↧

how to find PspUniqueJobIdTable

June 5, 2017, 9:46 am

≫ Next: EPROCESS.MitigationFlags in w10 build 16215

≪ Previous: wincheck rc8.57

In his cool presentation Alex Ionescu said:

PspUniqueJobIdTable - no way to open/enumerate

Sure there are always some ways. Lets see xrefs to PspUniqueJobIdTable:

PspJobDelete
NtCreateJobObject
PspInitializeJobStructures

no exported functions in this list (well, NtCreateJobObject can be considered as such). Looks deep in PspJobDelete:

loc_14001B6B4:                          ; CODE XREF: PspJobDelete+2A3
                                        ; PspJobDelete+17FEA8
  test    dword ptr [rbx+518h], 40000000h ; EJOB.JobFlags
  jnz     loc_14019B3AD

loc_14001B6C4:                          ; CODE XREF: PspJobDelete+17FEB6

  mov     rax, gs:188h
  dec     word ptr [rax+1E4h]
  mov     eax, [rbx+4C4h]               ; EJOB.JobId
  test    eax, eax
  jz      short loc_14001B701
  mov     rcx, cs:PspUniqueJobIdTable
  mov     edx, eax
  call    ExMapHandleToPointer

There is very long and noticeable signature for testing of EJOB.JobFlags with value 0x40000000: 18 05 00 00 00 00 00 40
If you searching it in .text section you get only 5-6 matches. Now question is how to get offset to EJOB.JobFlags. It can be done from exported function PsGetCurrentSilo:

PsGetCurrentSilo proc near
  mov     rax, gs:188h
  cmp     qword ptr [rax+7C8h], 0FFFFFFFFFFFFFFFDh
  jnz     short loc_1400B61BF
  mov     rax, [rax+220h]               ; KTHREAD.Process
  mov     rax, [rax+3B0h]               ; EPROCESS.Job
  test    rax, rax
  jz      short locret_1400B61BE

loc_1400B61A6:                          ; CODE XREF: PsGetCurrentSilo+3Cj
  test    dword ptr [rax+518h], 40000000h ; EJOB.JobFlags

And few words about enumerating - it`s just good old HANDLE_TABLE, so we can use ExEnumHandleTable and get all Jobs IDs

↧

EPROCESS.MitigationFlags in w10 build 16215

June 16, 2017, 8:56 am

≫ Next: DelegatedNtdll

≪ Previous: how to find PspUniqueJobIdTable

Lets see EPROCESS.Flags3 in w10 build 16193:

unsigned long Flags3;
unsigned long Minimal:0:1;
unsigned long ReplacingPageRoot:1:1;
unsigned long DisableNonSystemFonts:2:1;
unsigned long AuditNonSystemFontLoading:3:1;
unsigned long Crashed:4:1;
unsigned long JobVadsAreTracked:5:1;
unsigned long VadTrackingDisabled:6:1;
unsigned long AuxiliaryProcess:7:1;
unsigned long SubsystemProcess:8:1;
unsigned long IndirectCpuSets:9:1;
unsigned long InPrivate:a:1;
unsigned long ProhibitRemoteImageMap:b:1;
unsigned long ProhibitLowILImageMap:c:1;
unsigned long SignatureMitigationOptIn:d:1;
unsigned long DisableDynamicCodeAllowOptOut:e:1;
unsigned long EnableFilteredWin32kAPIs:f:1;
unsigned long AuditFilteredWin32kAPIs:10:1;
unsigned long PreferSystem32Images:11:1;
unsigned long RelinquishedCommit:12:1;
unsigned long Reserved:13:1;
unsigned long HighGraphicsPriority:14:1;
unsigned long CommitFailLogged:15:1;
unsigned long ReserveFailLogged:16:1;
unsigned long DisableDynamicCodeAllowRemoteDowngrade:17:1;
unsigned long LoaderIntegrityContinuityEnabled:18:1;
unsigned long LoaderIntegrityContinuityAudit:19:1;
unsigned long ControlFlowGuardExportSuppressionEnabled:1a:1;
unsigned long FatalAccessTerminationRequested:1b:1;
unsigned long DisableSystemAllowedCpuSet:1c:1;
unsigned long ControlFlowGuardStrict:1d:1;

and compare it with EPROCESS.Flags3 in w10 build 16215:

unsigned long Flags3;
unsigned long Minimal:0:1;
unsigned long ReplacingPageRoot:1:1;
unsigned long Crashed:2:1;
unsigned long JobVadsAreTracked:3:1;
unsigned long VadTrackingDisabled:4:1;
unsigned long AuxiliaryProcess:5:1;
unsigned long SubsystemProcess:6:1;
unsigned long IndirectCpuSets:7:1;
unsigned long RelinquishedCommit:8:1;
unsigned long HighGraphicsPriority:9:1;
unsigned long CommitFailLogged:a:1;
unsigned long ReserveFailLogged:b:1;
unsigned long SystemProcess:c:1;

dramatic difference
it seems that in build 16215 all secure related settings was moved to EPROCESS.MitigationFlags at offset 0x3d8 which is just DWORD (perhaps bitmask with _PS_MITIGATION_OPTION as bitindex). quick search shows pair of exported functions and lots of using in PspApplyMitigationOptions/NtSetInformationProcess/NtQueryInformationProcess

PsIsWin32KFilterAuditEnabledForProcess

 mov     edi, edi
 push    ebp
 mov     ebp, esp
 mov     eax, [ebp+arg_0]
 mov     eax, [eax+3D8h]
 shr     eax, 0Fh
 and     al, 1
 pop     ebp
 retn    4

PsIsWin32KFilterAuditEnabledForProcess

 mov     edi, edi
 push    ebp
 mov     ebp, esp
 mov     eax, [ebp+arg_0]
 mov     eax, [eax+3D8h]
 shr     eax, 0Eh
 and     al, 1
 pop     ebp
 retn    4

↧

DelegatedNtdll

July 6, 2017, 9:02 am

≫ Next: win32k calls filtering on w10

≪ Previous: EPROCESS.MitigationFlags in w10 build 16215

It seems that since est. w10 build 15007 you can have more than one loaded 32bit ntdll.dll
Function LdrpLoadDelegatedNtdll query key DelegatedNtdll via LdrQueryImageFileKeyOption then appends this value to \\SystemRoot\\system32\\ and loads it. Sure this required changes in callbacks propagation logic

There is table LdrpDelegatedNtdllExports which just hold pairs of exported symbol and offset to it "delegated" ptr:

LdrInitializeThunk -> LdrDelegatedLdrInitializeThunk
RtlUserThreadStart -> LdrDelegatedRtlUserThreadStart
RtlDispatchAPC -> LdrDelegatedRtlDispatchAPC
KiUserExceptionDispatcher -> LdrDelegatedKiUserExceptionDispatcher
KiUserApcDispatcher -> LdrDelegatedKiUserApcDispatcher
KiUserCallbackDispatcher -> LdrDelegatedKiUserCallbackDispatcher
KiRaiseUserExceptionDispatcher -> LdrDelegatedKiRaiseUserExceptionDispatcher
LdrSystemDllInitBlock -> LdrDelegatedSystemDllInitBlock
LdrpChildNtdll -> LdrpChildNtdllPointer
LdrParentInterlockedPopEntrySList -> LdrpParentInterlockedPopEntrySListPointer
LdrParentRtlInitializeNtUserPfn -> LdrpParentRtlInitializeNtUserPfnPointer
LdrParentRtlResetNtUserPfn -> LdrpParentRtlResetNtUserPfnPointer
LdrParentRtlRetrieveNtUserPfn -> LdrpParentRtlRetrieveNtUserPfnPointer

Lets see how this "delegated" pfns works

for example function KiUserExceptionDispatcher

_KiUserExceptionDispatcher@8 proc near
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  4

  cmp     _LdrDelegatedKiUserExceptionDispatcher, 0
  jz      short loc_6A28DB27
  mov     ecx, _LdrDelegatedKiUserExceptionDispatcher
  call    ds:___guard_check_icall_fptr

  jmp     ecx
loc_6A28DB27:

...

Image base of "delegated" ntdll stored in LdrpDelegatedNtdllBase

↧

win32k calls filtering on w10

July 13, 2017, 9:11 am

≫ Next: wincheck rc8.58

≪ Previous: DelegatedNtdll

Lets see on some functions from W32pServiceTableFilter on w10 build 16215:
stub_UserSetSensorPresence:

  push    ebp
  mov     ebp, esp
  push    2 ; call index
  call    _IsWin32KSyscallFiltered@4    ; IsWin32KSyscallFiltered(x)
  test    al, al
  jz      short loc_1361D
  lea     ecx, aNtusersetsenso          ; "NtUserSetSensorPresence"
  mov     edx, 2
  call    @NtUserWin32kSysCallFilterStub@8 ; NtUserWin32kSysCallFilterStub(x,x)
  call    _PsIsWin32KFilterEnabled@0    ; PsIsWin32KFilterEnabled()
  test    al, al
  jz      short loc_1361D
  lea     edx, _W32pServiceTableFilter
  mov     ecx, cs:_W32pServiceLimitFilter
  mov     eax, 2 ; call index
  lea     edx, [edx+ecx*4]
  movsx   eax, byte ptr [eax+edx]
  or      eax, eax
  jle     short loc_13619
  mov     eax, 0C000001Ch ;

STATUS_INVALID_SYSTEM_SERVICE
loc_13619: 
  mov     esp, ebp
  pop     ebp
  retn
loc_1361D: ; call original function
  mov     esp, ebp
  pop     ebp
  jmp     _NtUserSetSensorPresence@4    ; NtUserSetSensorPresence(x)

In some case this stub just pass control to original function (NtUserSetSensorPresence in this case) if IsWin32KSyscallFiltered or PsIsWin32KFilterEnabled returned 0, returns STATUS_INVALID_SYSTEM_SERVICE or just do nothing. Last condition depends from byte stored with call index behind W32pServiceTableFilter, so we can write simple idc script to dump all functions which will return STATUS_INVALID_SYSTEM_SERVICE:

#include 

static main(void)
{
  auto  cnt, addr, tab, ftab, i, fp, name;
  addr = LocByName("_W32pServiceLimitFilter");
  if ( addr == BADADDR )
  {
    Warn("Cannot find W32pServiceLimitFilter");
    return;
  }
  cnt = Dword(addr);
  tab = LocByName("_W32pServiceTableFilter");
  if ( tab == BADADDR )
  {
    Warn("Cannot find W32pServiceTableFilter");
    return;
  }
  ftab = cnt * 4 + tab;
  fp = fopen("wf32.dmp", "w");
  for ( i = 0; i < cnt; i++, tab = tab + 4, ftab = ftab + 1 )
  {
    if ( Byte(ftab) )
    {
      addr = Dword(tab);
      name = Name(addr);
      fprintf(fp, "[%d] \"%s\",\n", i, name);
    }
  }
  fclose(fp);
}

Just short cut from output file wf32.dmp:

[3] "__stub_GdiWidenPath@4",
[4] "__stub_GdiUpdateColors@4",
[5] "__stub_GdiUnrealizeObject@4",

Now lets look at IsWin32KSyscallFiltered function from win32kbase.sys:

callIdx= dword ptr  8

  mov     edi, edi
  push    ebp
  mov     ebp, esp
  call    ds:__imp__PsGetWin32KFilterSet@0 ; PsGetWin32KFilterSet()
  cmp     eax, 6
  jb      short loc_CCD70
  mov     al, 1
  jmp     short loc_CCD96

loc_CCD70:

  push    esi
  mov     esi, ?gaWin32KFilterBitmap@@3PAPAEA[eax*4] ; uchar * * gaWin32KFilterBitmap
  test    esi, esi
  jz      short loc_CCD93
  mov     edx, [ebp+callIdx]
  mov     al, 1
  mov     ecx, edx
  shr     edx, 3
  and     ecx, 7
  shl     al, cl
  test    [edx+esi], al
  setnz   al
  jmp     short loc_CCD95

loc_CCD93: 
  xor     al, al

loc_CCD95:

  pop     esi

loc_CCD96: 
  pop     ebp
  retn    4

If PsGetWin32KFilterSet returned more than 5 then this call will be filtered. In other case we have 6 bitmaps in gaWin32KFilterBitmap where each bit responsible for filtering some call. Pseudocode looks like:

DWORD bitmap_index = PsGetWin32KFilterSet();
if ( bitmap_index > 6 )
return 1;
PBYTE mask_array = gaWin32KFilterBitmap[bitmap_index];
if ( NULL == mask_array )
return 0;
DWORD mask_idx = callidx >> 3;
return (mask_array[mask_idx] & (1 << (callidx & 7));

Sample of content for one of Win32KFilterBitmap:

Win32KFilterBitmap[1] at 8F974D08
00000000  FF 6C F9 47-6D FF 9A C6|C3 3B DC 55-FC A1 1E C9  яlщGmяљЖГ;ЬUьЎ.Й
00000010  DD 6E 06 94-46 54 30 4E|6B 4D C0 27-53 FA 91 FE  Эn.”FT0NkMА'Sъ‘ю
00000020  5E 71 E0 59-80 8C 20 04|BC D4 20 46-52 10 48 00  ^qаYЂЊ .јФ FR.H.
00000030  17 A0 63 B0-7D EB C3 43|1C 71 A8 5F-5B B0 BF D8  . c°}лГC.qЁ_[°їШ
00000040  49 AD 38 F8-E8 1B C4 8A|A6 E9 E5 FF-C7 38 DA E0  I8ши.ДЉ¦йеяЗ8Ъа
00000050  FF FF 7F 73-AB A8 01 F5|FF FF FF FF-9F 3F E8 1F  яяs«Ё.хяяяяџ?и.
00000060  80 21 80 A0-E1 F0 B9 FD|CF FF 21 40-84 DE FF F7  Ђ!Ђ бр№эПя!@„Юяч
00000070  F1 FF F3 FF-FF BF FF FF|5F F2 FD E6-DF FE 9F 04  сяуяяїяя_тэжЯюџ.
00000080  00 D2 DF 38-FE FF BD BD|13 FC FF FF-FF F1 9F FF  .ТЯ8юяЅЅ.ьяяясџя
00000090  EF FB                                            пы

 [0] NtUserGetOwnerTransformedMonitorRect
 [1] NtUserYieldTask
 [2] NtUserSetSensorPresence
 [3] NtGdiWidenPath
 [4] NtGdiUpdateColors
 [5] NtGdiUnrealizeObject
 [6] NtGdiUnmapMemFont
 [7] NtGdiUnloadPrinterDriver
 [10] NtGdiScaleRgn

On more old builds of windows 10 there are 3 exported bitmaks arrays: gWin32KFilterBitArraySet1, gWin32KFilterBitArraySet2 and gWin32KFilterBitArraySet3. Sample of content from build 15058:

gWin32KFilterBitArraySet1 at 8F527248
00000000  FF 6C F9 47-6D FF 9A C6|C3 3B DC 55-FC A1 1E C9  яlщGmяљЖГ;ЬUьЎ.Й
00000010  DD 6E 06 94-46 54 30 4E|6B 4D C0 27-53 FA 91 FE  Эn.”FT0NkMА'Sъ‘ю
00000020  5E 71 E0 59-80 8C 20 04|BC D4 20 92-14 04 12 C0  ^qаYЂЊ .јФ ’...А
00000030  05 E8 18 6C-DF FA F0 10|47 1C EA D7-16 EC 2F 3B  .и.lЯър.G.кЧ.м/;
00000040  A9 15 83 8F-BE 41 56 34|4D 2F FF 3F-C6 D1 06 FF  ©.ѓЏѕAV4M/я?ЖС.я
00000050  FF FF 9B 5B-45 0D A8 FF|FF FF FF FF-FC 41 FF 01  яя›[E.ЁяяяяяьAя.
00000060  18 02 08 1A-0E 9F DB FF|FC 9F 02 46-E8 FD EF E3  .....џЫяьџ.Fиэпг
00000070  FF E7 FF FE-FF BF EC FB|CD BF FD 3F-09 00 A4 BF  язяюяїмыНїэ?..¤ї
00000080  71 FC FF 7B-7B 27 FC FF|FF FF F8 CF-FF F7        qья{{'ьяяяшПяч

 [0] NtUserGetOwnerTransformedMonitorRect
 [1] NtUserYieldTask
 [2] NtUserSetSensorPresence
 [3] NtGdiWidenPath
 [4] NtGdiUpdateColors
 [5] NtGdiUnrealizeObject
 [6] NtGdiUnmapMemFont
 [7] NtGdiUnloadPrinterDriver
 [10] NtGdiScaleRgn

↧

wincheck rc8.58

August 9, 2017, 7:54 am

≫ Next: WNF IDs from perf_nt_c.dll

≪ Previous: win32k calls filtering on w10

download
mirror
Changelog:

add support of numerous versions of windows 10 insider preview - up to 16257
add -j option to dump jobs
add -dwf option to dump win32k filtering bitmaps
add support of DelegatedNtdll
add dumping of kprocess.LdtBaseAddress &LdtTableLength (based on this paper)

↧

WNF IDs from perf_nt_c.dll

August 18, 2017, 8:01 am

≫ Next: ETW private loggers

≪ Previous: wincheck rc8.58

ripped wnf names from perf_nt_c.dll

A3BC0875 - 4191012C WNF_AOW_BOOT_PROGRESS
This state is incremented when a discrete part of the AoW boot sequence has completed. Security: WNF_STATE_SUBSCRIBE (1) by everyone (WD) and app containers (S-1-15-2-1); WNF_STATE_SUBSCRIBE | WNF_STATE_PUBLISH (3) by Local System (SY) and the Interactive User account (IU).
A3BC0875 - 41C6072C WNF_AI_USERTILE
AppInstallation state name to receive RAW notifications
A3BC0875 - 41877C2C WNF_A2A_APPURIHANDLER_INSTALLED
An app implementing windows.AppUriHandler contract has been installed
A3BC0875 - 41C60F2C WNF_AA_LOCKDOWN_CHANGED
Mobile lockdown configuration has been changed
A3BC08B5 - 2821B2C WNF_AUDC_CPUSET_ID
This state holds the CPU Set ID for audio threads. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC1075 - 2821B2C WNF_AUDC_PHONECALL_ACTIVE
This state indicates an active phone call, which can be from a cellular call or active Communications category audio streams
A3BC1875 - 2821B2C WNF_AUDC_TUNER_DEVICE_AVAILABILITY
This notification indicates whether or not the tuner endpoint is available.
A3BC2075 - 2821B2C WNF_AUDC_HEALTH_PROBLEM
State for problems detected in the audio core.
A3BC2875 - 2821B2C WNF_AUDC_CPUSET_ID_SYSTEM
This state keeps other system services apprised of the audio-reserved CPU set ID.
A3BC0875 - 4187182C WNF_AVA_SOUNDDETECTOR_PATTERN_MATCH
This notification is used to signal that a match has been detected for Voice Activation
A3BC0875 - 28A182C WNF_AVLC_DRIVER_REQUEST
A driver requst permission for volume limit change.
A3BC1075 - 28A182C WNF_AVLC_VOLUME_WARNING_ACCEPTED
This event propagates the user's choice from the warning dialog.
A3BC1875 - 28A182C WNF_AVLC_SHOW_VOLUMELIMITWARNING
This event informs the system that we need to show reached volume limit warning message
A3BC0875 - A8E0D2C WNF_ACHK_SP_CORRUPTION_DETECTED
Event fired when we scan the System Partition and find corruption.
A3BC0875 - 4196032F WNF_BMP_BG_PLAYSTATE_CHANGED
The background media player's playstate has changed.
A3BC1075 - 4196032F WNF_BMP_BG_PLAYBACK_REVOKED
The following tasks aren't able to play under current policy
A3BC8075 - 41C61D22 WNF_OS_IP_OVER_USB_AVAILABLE
IP Over USB Availability. SDDL comes from ID_CAP_EVERYONE and IpOverUsb in %SDXROOT%\src\baseos\prod\packages\MfgIpOverUsb\MfgIpOverUsb.pkg.xml
A3BC8875 - 41C61D22 WNF_OS_IU_PROGRESS_REPORT
Update progress reporting status. SDDL comes from ID_CAP_BASEOS_UPDATEAPI in %SDXROOT%\src\baseos\prod\packages\imgupd\MainOS\ImgUpd.pkg.xml
A3BC0875 - 4183182B WNF_FVE_DE_SUPPORT
This event triggers when Device Encryption support status is evaluated, and receives the result of that evaluation.
A3BC1075 - 4183182B WNF_FVE_DE_MANAGED_VOLUMES_COUNT
This event triggers when the BitLocker service detects a change in the count of DE-managed volumes, and includes the count of such volumes.
A3BC1875 - 4183182B WNF_FVE_WIM_HASH_GENERATION_TRIGGER
This event triggers or signals to stop WIM hash generation task.
A3BC2075 - 4183182B WNF_FVE_WIM_HASH_GENERATION_COMPLETION
This event signals completion of WIM hash generation.
A3BC2875 - 4183182B WNF_FVE_WIM_HASH_DELETION_TRIGGER
This event triggers WIM hash deletion.
A3BC3075 - 4183182B WNF_FVE_BDESVC_TRIGGER_START
This event trigger-starts BdeSvc service.
A3BC3875 - 4183182B WNF_FVE_STATE_CHANGE
This event triggers on every BitLocker state change.
A3BC4075 - 4183182B WNF_FVE_MDM_POLICY_REFRESH
This event triggers where RequireDeviceEncryption policy arrives under the BitLocker area.
A3BC4875 - 4183182B WNF_FVE_REQUIRE_SDCARD_ENCRYPTION
This event triggers SD card encrytion policy arrival notification.
A3BC5075 - 4183182B WNF_FVE_SDCARD_ENCRYPTION_REQUEST
This event triggers SecTask to enable/disable SD Card encryption.
A3BC5875 - 4183182B WNF_FVE_SDCARD_ENCRYPTION_STATUS
This event indicates completion of SD Card encryption/decryption request.
A3BC0875 - 992022F WNF_BLTH_BLUETOOTH_STATUS
State name for Bluetooth overall status notification. Flags from the BLUETOOTH_GLOBAL_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTConnMgr in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
A3BC1075 - 992022F WNF_BLTH_BLUETOOTH_AUDIO_GATEWAY_STATUS
State name for Bluetooth Audio Gateway status notification. A 32-bit bitmask of BLUETOOTH_AUDIO_GATEWAY_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTAGService in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
A3BC1875 - 992022F WNF_BLTH_BLUETOOTH_MAP_STATUS
State name for Bluetooth MAP status notification. A 32-bit bitmask of BLUETOOTH_MAP_STATUS enum are returned.
A3BC2075 - 992022F WNF_BLTH_BLUETOOTH_CONNECTION_STATE_CHANGE
Indicates when a Bluetooth Device gets connected and disconnected
A3BC2875 - 992022F WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_REQUEST
Indicates that a legacy Gatt client request is present. The local radio and remote device BTH_ADDR are returned.
A3BC3075 - 992022F WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_INVALIDATE_TOKEN
Indicates that a legacy Gatt client request was no longer present. The previously granted access token to be revoked is returned.
A3BC0875 - 1589012F WNF_BOOT_DIRTY_SHUTDOWN
The state is published once the previous shutdown was not clean.
A3BC1075 - 1589012F WNF_BOOT_INVALID_TIME_SOURCE
The state is published if system time is initialized with a backup time source.
A3BC1875 - 1589012F WNF_BOOT_MEMORY_PARTITIONS_RESTORE
The state reflects memory partiton restoration state (nothing to restore, restore in progress, restore completed, failure)
A3BC0875 - 418F1C2F WNF_BRI_ACTIVE_WINDOW
Notifies brightness classes of the active window in order to apply their brightness preferences
A3BC0875 - 41C6072F WNF_BI_BROKER_WAKEUP_CHANNEL
Background work execution trigger
A3BC1075 - 41C6072F WNF_BI_USER_LOGON_CHANNEL
BI user logon system state notification channel
A3BC1875 - 41C6072F WNF_BI_USER_LOGOFF_CHANNEL
BI user logoff system state notification channel
A3BC2075 - 41C6072F WNF_BI_SESSION_CONNECT_CHANNEL
BI session connect system state notification channel
A3BC2875 - 41C6072F WNF_BI_SESSION_DISCONNECT_CHANNEL
BI session disconnect system state notification channel
A3BC3075 - 41C6072F WNF_BI_APPLICATION_UNINSTALL_CHANNEL
BI application uninstall system state notification channel
A3BC3875 - 41C6072F WNF_BI_APPLICATION_SERVICING_START_CHANNEL
BI application servicing start system state notification channel
A3BC4075 - 41C6072F WNF_BI_APPLICATION_SERVICING_STOP_CHANNEL
BI application servicing stop system state notification channel
A3BC4875 - 41C6072F WNF_BI_LOCK_SCREEN_UPDATE_CHANNEL
BI lock screen update system state notification channel
A3BC5075 - 41C6072F WNF_BI_EVENT_DELETION
BI event deletion system state notification channel
A3BC5875 - 41C6072F WNF_BI_PSM_TEST_HOOK_CHANNEL
PSM policy test hook
A3BC6075 - 41C6072F WNF_BI_QUIET_MODE_UPDATE_CHANNEL
BI Quiet Mode update system state notification channel
A3BC6835 - 41C6072F WNF_BI_BI_READY
Indicates that BI is ready and also publish channels list for each session
A3BC7075 - 41C6072F WNF_BI_NOTIFY_NEW_SESSION
BI notify new session system state notification channel
A3BC7875 - 41C6072F WNF_BI_QUERY_APP_USAGE
PSM notification to clients for querying application performance usage
A3BC08B5 - D920D2E WNF_CCTL_BUTTON_REQUESTS
A button press has caused a request.
A3BC0875 - 41960A2E WNF_CDP_CDPSVC_READY
Indicates CDP Service is ready
A3BC1075 - 41960A2E WNF_CDP_CDPSVC_STOPPING
Indicates CDP Service is stopping
A3BC1835 - 41960A2E WNF_CDP_CDPUSERSVC_READY
Indicates CDP User Service is ready
A3BC2035 - 41960A2E WNF_CDP_CDPUSERSVC_STOPPING
Indicates CDP User Service is stopping
A3BC2875 - 41960A2E WNF_CDP_CDP_MESSAGES_QUEUED
Indicates CDP service queued the message(s) for designated applications
A3BC3075 - 41960A2E WNF_CDP_CDP_ACTIVITIES_RECIEVED
Indicates CDP service received new activities
A3BC3875 - 41960A2E WNF_CDP_USERAUTH_POLICY_CHANGE
Indicates that the user has changed the CDP policy
A3BC4075 - 41960A2E WNF_CDP_CDP_NOTIFICATION_ACTION_FORWARD_FAILURE
Indicates failure either delivering or invoking a Notification Action on a remote device
A3BC4835 - 41960A2E WNF_CDP_USER_ROME_SETTING_CHANGE
Indicates that the user has changed Rome SDK authorization setting
A3BC5035 - 41960A2E WNF_CDP_USER_NEAR_SHARE_SETTING_CHANGE
Indicates that the user has changed Near Share authorization setting
A3BC0875 - D8A0B2E WNF_CELL_POWER_STATE_MODEM0
Modem power state of the first modem, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC1075 - D8A0B2E WNF_CELL_SIGNAL_STRENGTH_BARS_CAN0
Number of bars (0..5) of signal strength for the first cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC1875 - D8A0B2E WNF_CELL_SYSTEM_TYPE_CAN0
System type of the first cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC2075 - D8A0B2E WNF_CELL_REGISTRATION_STATUS_CAN0
Current registration status of the first cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC2875 - D8A0B2E WNF_CELL_UICC_STATUS_SLOT0
Status of the UICC in the first slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC3075 - D8A0B2E WNF_CELL_AIRPLANEMODE
The current state of airplanemode. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC3875 - D8A0B2E WNF_CELL_OPERATOR_NAME_CAN0
Current serving operator for the first cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC4075 - D8A0B2E WNF_CELL_CDMA_ACTIVATION_CAN0
Activation, PRL, and provisioning state for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC4875 - D8A0B2E WNF_CELL_NETWORK_TIME_CAN0
NITZ information for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC5075 - D8A0B2E WNF_CELL_AVAILABLE_OPERATORS_CAN0
List of available operators for the first cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC5875 - D8A0B2E WNF_CELL_DEVICE_INFO_CAN0
Device info (RIL_GetDeviceInfo) for the first cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC6475 - D8A0B2E WNF_CELL_DATA_ENABLED_BY_USER_MODEM0
Cellular data enabled state as set by user. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC6875 - D8A0B2E WNF_CELL_PHONE_NUMBER_CAN0
Phone number (MSISDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC7075 - D8A0B2E WNF_CELL_VOICEMAIL_NUMBER_CAN0
Voicemail number (MBDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC7C75 - D8A0B2E WNF_CELL_REGISTRATION_PREFERENCES_CAN0
Registration preferences for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC8075 - D8A0B2E WNF_CELL_CAN_STATE_CAN0
Can state (between CellManager and CellUX) for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC8C75 - D8A0B2E WNF_CELL_USER_PREFERRED_POWER_STATE_MODEM0
Power state of the modem as last preferred by the user, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC9075 - D8A0B2E WNF_CELL_AIRPLANEMODE_DETAILS
The current state of airplanemode details. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC9875 - D8A0B2E WNF_CELL_POSSIBLE_DATA_ACTIVITY_CHANGE_MODEM0
This is triggered if cellcore suspects that data activity may have been affected. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCA475 - D8A0B2E WNF_CELL_SYSTEM_CONFIG
Root state describing cellular system configuration (all modems and their cans). SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCA875 - D8A0B2E WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN0
Detailed registration status of the first cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_EVERYONE, ID_CAP_ISV_CAMERA, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCB075 - D8A0B2E WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN0
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCB875 - D8A0B2E WNF_CELL_PERSO_STATUS_CAN0
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCC075 - D8A0B2E WNF_CELL_HOME_OPERATOR_CAN0
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_ISV_CAMERA and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCC875 - D8A0B2E WNF_CELL_HOME_PRL_ID_CAN0
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCE875 - D8A0B2E WNF_CELL_UTK_SETUP_MENU_SLOT0
UICC toolkit setup menu notification for slot 0. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCF075 - D8A0B2E WNF_CELL_UTK_PROACTIVE_CMD
UICC toolkit proactive command notification for all slots. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BCF875 - D8A0B2E WNF_CELL_CSP_WWAN_PLUS_READYNESS
CM CSPWWAN+ readyness state. SDDL comes from ID_CAP_CMCSPWWAN_PLUS in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BD0075 - D8A0B2E WNF_CELL_CALLFORWARDING_STATUS_CAN0
Call-forwarding status for the first cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD0C75 - D8A0B2E WNF_CELL_RADIO_TYPE_MODEM0
Modem radio type of the first modem, values defined by RILRADIOCONFIGURATIONRADIOTYPE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD1075 - D8A0B2E WNF_CELL_SIGNAL_STRENGTH_BARS_CAN1
Number of bars (0..5) of signal strength for the second cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD1875 - D8A0B2E WNF_CELL_SYSTEM_TYPE_CAN1
System type of the second cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD2075 - D8A0B2E WNF_CELL_REGISTRATION_STATUS_CAN1
Current registration status of the second cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD2875 - D8A0B2E WNF_CELL_UICC_STATUS_SLOT1
Status of the UICC in the second slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD4075 - D8A0B2E WNF_CELL_OPERATOR_NAME_CAN1
Current serving operator for the second cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD4875 - D8A0B2E WNF_CELL_CDMA_ACTIVATION_CAN1
Activation, PRL, and provisioning state for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD5075 - D8A0B2E WNF_CELL_NETWORK_TIME_CAN1
NITZ information for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD5875 - D8A0B2E WNF_CELL_AVAILABLE_OPERATORS_CAN1
List of available operators for the second cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD6075 - D8A0B2E WNF_CELL_DEVICE_INFO_CAN1
Device info (RIL_GetDeviceInfo) for the second cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD7075 - D8A0B2E WNF_CELL_PHONE_NUMBER_CAN1
Phone number (MSISDN) for the second cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD8C75 - D8A0B2E WNF_CELL_REGISTRATION_PREFERENCES_CAN1
Registration preferences for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD9075 - D8A0B2E WNF_CELL_CAN_STATE_CAN1
Can state (between CellManager and CellUX) for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BD9875 - D8A0B2E WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN1
Detailed registration status of the second cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CELL_WNF, ID_CAP_EVERYONE, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDA075 - D8A0B2E WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN1
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDA875 - D8A0B2E WNF_CELL_HOME_OPERATOR_CAN1
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDB075 - D8A0B2E WNF_CELL_HOME_PRL_ID_CAN1
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDD075 - D8A0B2E WNF_CELL_UTK_SETUP_MENU_SLOT1
UICC toolkit setup menu notification for slot 1. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDE075 - D8A0B2E WNF_CELL_CALLFORWARDING_STATUS_CAN1
Call-forwarding status for the second cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDE875 - D8A0B2E WNF_CELL_PERSO_STATUS_CAN1
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDF475 - D8A0B2E WNF_CELL_CONFIGURED_LINES_CAN0
Configured lines for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BDFC75 - D8A0B2E WNF_CELL_CONFIGURED_LINES_CAN1
Configured lines for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE0075 - D8A0B2E WNF_CELL_UICC_STATUS_DETAILS_SLOT0
Status details of the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE0875 - D8A0B2E WNF_CELL_UICC_STATUS_DETAILS_SLOT1
Status details of the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE1075 - D8A0B2E WNF_CELL_PREFERRED_LANGUAGES_SLOT0
Preferred languages in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE1875 - D8A0B2E WNF_CELL_PREFERRED_LANGUAGES_SLOT1
Preferred languages in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE2075 - D8A0B2E WNF_CELL_IMSI_CAN0
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE2875 - D8A0B2E WNF_CELL_IMSI_CAN1
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE3075 - D8A0B2E WNF_CELL_LEGACY_SETTINGS_MIGRATION
Migration action for legacy cellcore settings. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE3875 - D8A0B2E WNF_CELL_UICC_ATR_SLOT0
Answer to reset from the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE4075 - D8A0B2E WNF_CELL_UICC_ATR_SLOT1
Answer to reset from the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE4875 - D8A0B2E WNF_CELL_UICC_SIMSEC_SLOT0
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 0. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE5075 - D8A0B2E WNF_CELL_UICC_SIMSEC_SLOT1
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 1. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE5875 - D8A0B2E WNF_CELL_CAN_CONFIGURATION_SET_COMPLETE_MODEM0
Indication that all executors have been configured and that there are no outstanding configurations pending in the modem. SDDL comes from WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE6075 - D8A0B2E WNF_CELL_REGISTRATION_CHANGED_TRIGGER_MV
This is published when cellcore needs MV to kick in. SDDL comes from ID_CAP_EVERYONE, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE7075 - D8A0B2E WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN0
Signal-strength details for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE7875 - D8A0B2E WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN1
Signal-strength details for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE6875 - D8A0B2E WNF_CELL_EMERGENCY_CALLBACK_MODE_STATUS
Indication about the current emergency callback mode. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE8075 - D8A0B2E WNF_CELL_IMS_STATUS_CAN0
Current IMS registration for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE8875 - D8A0B2E WNF_CELL_IMS_STATUS_CAN1
Current IMS registration for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE9075 - D8A0B2E WNF_CELL_IWLAN_AVAILABILITY_CAN0
iWLAN availability for Can 0, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BE9875 - D8A0B2E WNF_CELL_IWLAN_AVAILABILITY_CAN1
iWLAN availability for Can 1, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BEA475 - D8A0B2E WNF_CELL_PS_MEDIA_PREFERENCES_CAN0
PS Media preferences for Can 0, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BEAC75 - D8A0B2E WNF_CELL_PS_MEDIA_PREFERENCES_CAN1
PS Media preferences for Can 1, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BEB075 - D8A0B2E WNF_CELL_WIFI_CALL_SETTINGS_CAN0
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BEB875 - D8A0B2E WNF_CELL_WIFI_CALL_SETTINGS_CAN1
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
A3BC0875 - F87193A WNF_WWAN_OBJECT_LIST
Table of all modems and executors under it.
A3BC1075 - F87193A WNF_WWAN_EUICC_ARRIVAL
This event is published by WwanSvc to indicate the arrival of an eUICC.
A3BC1875 - F87193A WNF_WWAN_CELLULAR_STATE_SNAPSHOT_CHANGE
This event is published by WwanSvc to indicate a change in cellular state snapshot.
A3BC2075 - F87193A WNF_WWAN_TASK_TRIGGER
State name triggering WiFiTask from WwanSvc.
A3BC0875 - 1395033E WNF_SMSR_READY
Sms Router Broker is ready.
A3BC1075 - 1395033E WNF_SMSR_WWAN_READ_DONE
Sms Router Broker is ready.
A3BC1875 - 1395033E WNF_SMSR_NEW_MESSAGE_RECEIVED
Sms Router received a new incoming SMS message.
A3BC0875 - 12960F2E WNF_CAPS_CENTRAL_ACCESS_POLICIES_CHANGED
Central Access Policies have been updated
A3BC0875 - 118F022E WNF_CLIP_CONTENT_CHANGED
This notification is triggered when contents on the clipboard change
A3BC0875 - D85082E WNF_CFCL_SC_CONFIGURATIONS_CHANGED
Triggered each time one or more flight configurations changes.
A3BC1075 - D85082E WNF_CFCL_SC_CONFIGURATIONS_DELETED
Triggered each time one or more flight configurations is deleted.
A3BC1875 - D85082E WNF_CFCL_SC_CONFIGURATIONS_ADDED
Triggered each time one or more flight configurations is added.
A3BC0835 - D8E1D2E WNF_CSHL_COMPOSER_LAUNCH_READY
Core shell has initialized, including all of its services (e.g. TLAVM), and the Product Composer can be launched. If the event has not been fired, then CoreShell is still initializing and the Composer cannot be launched. Payload is a DWORD to inidicate it has been fired.
A3BC1035 - D8E1D2E WNF_CSHL_UI_AUTOMATION
On UI Automation.
A3BC1835 - D8E1D2E WNF_CSHL_CURSOR_MANAGER_READY
Cursor Manager is initialized.
A3BC2035 - D8E1D2E WNF_CSHL_VIEWHOSTING_READY
Fired every time a Composer registers with TLAVM and inidicates that the composer is ready to host applications. If the event has not been fired, then no composer is ready to host applications. Payload is a DWORD to inidicate it has been fired.
A3BC2835 - D8E1D2E WNF_CSHL_PRODUCT_READY
Fired every time a Product Composer has finished initializing and indicates that Shell has entered normal operations (i.e. not in restricted mode or running OOBE/PostUpdateUX). If the event has not been fired, then the Product Composer is still initializing. Payload is a DWORD to inidicate it has been fired.
A3BC0875 - 41C60129 WNF_DO_MANAGER_ACTIVE
This event triggers when the Delivery Optimization service manager is active or idle
A3BC0875 - 41870C29 WNF_DBA_DEVICE_ACCESS_CHANGED
This event triggers when the user changes device access for an applocation or the user
A3BC0875 - 4187083E WNF_SFA_AUTHENTICATION_STAGE_CHANGED
This event signals when authentication stage change.
A3BC0C75 - 418B1D29 WNF_DSM_DSMAPPINSTALLED
Notification for when an app is installed so we can register a device background task if necessary.
A3BC1475 - 418B1D29 WNF_DSM_DSMAPPREMOVED
Notification for when an app is removed so we can clean up any registered device background tasks if necessary.
A3BC0875 - 41800329 WNF_DMF_MIGRATION_STARTED
Signals that Migration started. DWORD[1] = {started flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
A3BC1075 - 41800329 WNF_DMF_MIGRATION_COMPLETE
Signals that Migration completed. DWORD[2] = {completed flag, status}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
A3BC1875 - 41800329 WNF_DMF_MIGRATION_PROGRESS
Current Migration state. DWORD[4] = {Phase, Total Phases, Step, Total Steps}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
A3BC2075 - 41800329 WNF_DMF_UX_COMPLETE
Signals when data migration is complete after reboot and update results need to be displayed. DWORD[1] = {completed flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml and DuPostUpdateUX in %SDXROOT%\src\devmgmt\du\packages\UX\UX.pkg.xml
A3BC0C75 - 41C61629 WNF_DX_STEREO_CONFIG
State stores the current stereo cpl setting. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC1035 - 41C61629 WNF_DX_MODE_CHANGE_NOTIFICATION
Triggered by kernel when mode change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC1835 - 41C61629 WNF_DX_OCCLUSION_CHANGE_NOTIFICATION
Triggered by kernel when any occlusion related OS state change happens.
A3BC2035 - 41C61629 WNF_DX_NETWORK_DISPLAY_STATE_CHANGE_NOTIFICATION
Triggered by kernel when the state of a network display device is changed.
A3BC2835 - 41C61629 WNF_DX_MONITOR_CHANGE_NOTIFICATION
Triggered by kernel when monitor change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC30B5 - 41C61629 WNF_DX_VIDMM_TRIM_NOTIFICATION
Triggered by kernel when video memory has to be trimmed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC3875 - 41C61629 WNF_DX_VIDMM_BUDGETCHANGE_NOTIFICATION
Triggered by kernel when video memory budget for an application changes. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC4075 - 41C61629 WNF_DX_HARDWARE_CONTENT_PROTECTION_TILT_NOTIFICATION
Triggered by hardware content protection tilt detection. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
A3BC4875 - 41C61629 WNF_DX_INTERNAL_PANEL_DIMENSIONS
Stores information about the physical dimensions (in mm) of the integrated panel if available, and 0's if not.
A3BC5035 - 41C61629 WNF_DX_MODERN_OUTPUTDUPLICATION
Triggered when a lowbox application starts or stops using OutputDuplication.
A3BC5835 - 41C61629 WNF_DX_DISPLAY_CONFIG_CHANGE_NOTIFICATION
Triggered by kernel when a change is made to the display configuration.
A3BC60B5 - 41C61629 WNF_DX_DEVICE_REMOVAL
Triggered when a device has been removed for any reason, not just adapter removal.
A3BC6835 - 41C61629 WNF_DX_MODERN_OUTPUTDUPLICATION_CONTEXTS
Triggered when a lowbox application starts or stops using OutputDuplication and provides list of active lowbox contexts
A3BC7035 - 41C61629 WNF_DX_COLOR_PROFILE_CHANGE
Triggered when the default color profile for any attached display changes.
A3BC0875 - A950729 WNF_DISK_SCRUB_REQUIRED
This event signals when a disk that requires scrubbing is brought online
A3BC0875 - A811629 WNF_DXGK_ADAPTER_TDR_NOTIFICATION
Triggered by the kernel when any adapter receives a TDR or PNP event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC1075 - 41950029 WNF_DNS_ALL_SERVER_TIMEOUT
When all the DNS Servers Timeout, this event is notified
A3BC0835 - 418B1929 WNF_DWM_RUNNING
Triggered when the dwm starts/terminates
A3BC1035 - 418B1929 WNF_DWM_HOLOGRAPHIC_COMPOSITOR_LOW_FRAMERATE
Triggered when exclusive mode apps are presenting at a low framerate to the holographic composoitor
A3BC0835 - 41960A28 WNF_EDP_TAGGED_APP_LAUNCHED
The application was launched in the specified mode under the specified Enterprise context.
A3BC10F5 - 41960A28 WNF_EDP_IDENTITY_REVOKED
The keys associated with a data protection identity were removed.
A3BC1875 - 41960A28 WNF_EDP_DPL_KEYS_STATE
Current state of the Data Protection under Lock private keys
A3BC2035 - 41960A28 WNF_EDP_CLIPBOARD_METADATA_CHANGED
Either a copy or override operation occurred, leading to clipboard metadata changes. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
A3BC2835 - 41960A28 WNF_EDP_DIALOG_CANCEL
An EDP blocking dialog has been canceled programmatically.
A3BC3035 - 41960A28 WNF_EDP_APP_UI_ENTERPRISE_CONTEXT_CHANGED
Application UI EDP context has been changed for the process.
A3BC3875 - 41960A28 WNF_EDP_AAD_REAUTH_REQUIRED
The AAD token used by EDP has expired.
A3BC4475 - 41960A28 WNF_EDP_ENTERPRISE_CONTEXTS_UPDATED
The EDP enterprise contexts have been updated.
A3BC4875 - 41960A28 WNF_EDP_PROCESS_UI_ENFORCEMENT
EDP process UI enforcement global state
A3BC50B5 - 41960A28 WNF_EDP_PROCESS_TLS_INDEX
EDP thread UI enforcement. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
A3BC5875 - 41960A28 WNF_EDP_DPL_KEYS_DROPPING
Data Protection under Lock private keys will be dropped from memory shortly.
A3BC6075 - 41960A28 WNF_EDP_MISSING_CREDENTIALS
EDP cred service cannot access credentials required
A3BC6875 - 41960A28 WNF_EDP_PURGE_APP_LEARNING_EVT
Purge application learning events cache
A3BC0875 - 41950828 WNF_EFS_SERVICE_START
This event trigger-starts EFS service.
A3BC1075 - 41950828 WNF_EFS_SOFTWARE_HIVE_AVAILABLE
EFS service needs to check GP at boot, which requires the SOFTWARE hive in HKLM. This signals its availability when EFS worker thread detects it.
A3BC0875 - 13920028 WNF_ENTR_DEVICELOCK_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Device Lock policy area. SDDL comes from NgcctnrSvc in %SDXROOT%\src\baseos\prod\packages\ngc\ngc.pkg.xml and ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml, %sdxroot%\onecoreuap\admin\dm\wap\service\dmwappushservice.wm.xml
A3BC1075 - 13920028 WNF_ENTR_WIFI_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Wifi policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC1875 - 13920028 WNF_ENTR_SYSTEM_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the System policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xmlSDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC2075 - 13920028 WNF_ENTR_CONNECTIVITY_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Connectivity policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC2875 - 13920028 WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Experience policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC3075 - 13920028 WNF_ENTR_ACCOUNTS_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Accounts policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC3875 - 13920028 WNF_ENTR_SECURITY_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Security policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC4075 - 13920028 WNF_ENTR_BROWSER_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Browser policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC4875 - 13920028 WNF_ENTR_UPDATE_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Update policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC5075 - 13920028 WNF_ENTR_CAMERA_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Camera policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC5875 - 13920028 WNF_ENTR_APPLICATIONMANAGEMENT_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the ApplicationManagement policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC6075 - 13920028 WNF_ENTR_REQUIRE_DEVICE_ENCRYPTION_POLICY_VALUE_CHANGED
Current changed security policy RequireDeviceEncryption value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC6875 - 13920028 WNF_ENTR_PUSH_NOTIFICATION_RECEIVED
An MDM Push notification has been received. SDDL comes from ID_CAP_CSP_DMCLIENT in %SDXROOT%\src\devmgmt\dm\packages\dmapps\dmapps.pkg.xml
A3BC7075 - 13920028 WNF_ENTR_SEARCH_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the Search policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC7875 - 13920028 WNF_ENTR_ABOVELOCK_POLICY_VALUE_CHANGED
Current changed policy values represented as bits for the AboveLock policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC8075 - 13920028 WNF_ENTR_ALLOWAPPLICATIONS_POLICY_VALUE_CHANGED
A Dataprotection AllowApplications provider policy value has changed.
A3BC8875 - 13920028 WNF_ENTR_EDPENFORCEMENTLEVEL_POLICY_VALUE_CHANGED
A Dataprotection EDPEnforcementLevel provider policy value has changed.
A3BC9075 - 13920028 WNF_ENTR_WAP_MESSAGE_FOR_DMWAPPUSHSVC_READY
A WAP message has been received that dmwappushsvc needs to handle.
A3BC9875 - 13920028 WNF_ENTR_CONTEXT_STATE_CHANGE
An enterprise context has changed it's state
A3BCA075 - 13920028 WNF_ENTR_PUSH_RECEIVED
An enterprise WNS based push was received
A3BCA875 - 13920028 WNF_ENTR_ALLOWINPUTPANEL_POLICY_VALUE_CHANGED
A TextInput AllowInputPanel provider policy value has changed.
A3BCB075 - 13920028 WNF_ENTR_SEARCH_ALLOW_USING_DIACRITICS
Allow use of diacritics for indexing.
A3BCB875 - 13920028 WNF_ENTR_SEARCH_ALWAYS_USE_AUTO_LANG_DETECTION
Always use automatic language detection when indexing content and properties.
A3BCC075 - 13920028 WNF_ENTR_SEARCH_DISABLE_REMOVABLE_DRIVE_INDEXING
Do not allow locations on removable drives to be added to libraries.
A3BCC875 - 13920028 WNF_ENTR_SEARCH_PREVENT_INDEXING_LOW_DISK_SPACE_MB
Stop indexing in the event of limited hard drive space.
A3BCD075 - 13920028 WNF_ENTR_SEARCH_ALLOW_INDEXING_ENCRYPTED_STORES_OR_ITEMS
Allow indexing of encrypted files.
A3BCD875 - 13920028 WNF_ENTR_BLUETOOTH_POLICY_VALUE_CHANGED
Bluetooth policy configuration has changed. SDDL comes from ID_CAP_POLICY_MANAGER in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BCE075 - 13920028 WNF_ENTR_EDPNETWORKING_POLICY_VALUE_CHANGED
A Dataprotection networking policy value has changed.
A3BCE875 - 13920028 WNF_ENTR_REQUIRE_DPL_POLICY_VALUE_CHANGED
DataProtection Require Protection Under Lock Config policy change.
A3BCF075 - 13920028 WNF_ENTR_WINDOWS_DEFENDER_POLICY_VALUE_CHANGED
Windows Defender policy configuration has changed.
A3BCF875 - 13920028 WNF_ENTR_ALLOWALLTRUSTEDAPPS_POLICY_VALUE_CHANGED
ApplicationManagement AllowAllTrustedApps provider policy value has changed.
A3BD0075 - 13920028 WNF_ENTR_ALLOWSHAREDUSERDATA_POLICY_VALUE_CHANGED
ApplicationManagement AllowSharedUserAppData provider policy value has changed.
A3BD0875 - 13920028 WNF_ENTR_RESTRICTAPPTOSYTEMVOLUME_POLICY_VALUE_CHANGED
ApplicationManagement RestrictAppToSystemVolume provider policy value has changed.
A3BD1075 - 13920028 WNF_ENTR_RESTRICTAPPDATATOSYTEMVOLUME_POLICY_VALUE_CHANGED
ApplicationManagement RestrictAppDataToSystemVolume provider policy value has changed.
A3BD1875 - 13920028 WNF_ENTR_ALLOWDEVELOPERUNLOCK_POLICY_VALUE_CHANGED
ApplicationManagement AllowDeveloperUnlock provider policy value has changed.
A3BD2075 - 13920028 WNF_ENTR_ALLOWUPDATESERVICE_POLICY_VALUE_CHANGED
Update AllowUpdateService provider policy value has changed.
A3BD2875 - 13920028 WNF_ENTR_UPDATESERVICEURL_POLICY_VALUE_CHANGED
Update UpdateServiceUrl provider policy value has changed.
A3BD3075 - 13920028 WNF_ENTR_ALLOWNONMICROSOFTSIGNEDUPDATE_POLICY_VALUE_CHANGED
Update AllowNonMicrosoftSignedUpdate provider policy value has changed.
A3BD3875 - 13920028 WNF_ENTR_ALLOW_WBA_EXECUTION_POLICY_VALUE_CHANGED
DisableWBA policy value has changed.
A3BD4075 - 13920028 WNF_ENTR_DOMAIN_NAMES_FOR_EMAIL_SYNC_POLICY_VALUE_CHANGED
The domains for which email is disabled have changed.
A3BD4875 - 13920028 WNF_ENTR_ALLOWCELLULARDATAROAMING_POLICY_VALUE_CHANGED
The AllowCellularDataRoaming policy value has changed.
A3BD5075 - 13920028 WNF_ENTR_ALLOWCELLULARDATA_POLICY_VALUE_CHANGED
The AllowCellularData policy value has changed.
A3BD5C75 - 13920028 WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED
EDPEnforcementLevel cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
A3BD6475 - 13920028 WNF_ENTR_PROTECTEDDOMAINNAMES_CACHED_POLICY_VALUE_CHANGED
EnterpriseProtectedDomainNames cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
A3BD6875 - 13920028 WNF_ENTR_ALLOWMESSAGESYNC_POLICY_VALUE_CHANGED
The AllowMessageSync policy value has changed.
A3BD7075 - 13920028 WNF_ENTR_DISABLEADVERTISINGID_POLICY_VALUE_CHANGED
Privacy DisableAdvertisingId policy value has changed.
A3BD7875 - 13920028 WNF_ENTR_EVALUATE_EDP_CONFIGURATION_STATE
EnterpriseDataProtection (EDP) state has changed.
A3BD8475 - 13920028 WNF_ENTR_APPHVSI_CACHED_POLICY_VALUE_CHANGED
AllowAppHVSI cached policy has changed.
A3BD8875 - 13920028 WNF_ENTR_NETWORKISOLATION_POLICY_VALUE_CHANGED
A NetworkIsolation area policy value has changed.
A3BD9075 - 13920028 WNF_ENTR_EVALUATE_APPHVSI_CONFIGURATION_STATE
AppHVSI (Hypervisor-based Virtualized Security Isolation) state has changed.
A3BD9C75 - 13920028 WNF_ENTR_EDPSHOWICONS_CACHED_POLICY_VALUE_CHANGED
EdpShowIcons policy value has changed.
A3BDB075 - 13920028 WNF_ENTR_ALLOWWIFI_POLICY_VALUE_CHANGED
AllowWifi policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BDB875 - 13920028 WNF_ENTR_ALLOWMANUALWIFICONFIGURATION_POLICY_VALUE_CHANGED
AllowManualWifiConfiguration policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BDC075 - 13920028 WNF_ENTR_SEARCH_ALLOW_INDEXER
Allow windows indexer.
A3BDC875 - 13920028 WNF_ENTR_ALLOWWIFIDIRECT_POLICY_VALUE_CHANGED
AllowWifiDirect policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BDD075 - 13920028 WNF_ENTR_ALLOWPROJECTIONTOPC_POLICY_VALUE_CHANGED
AllowProjectionToPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BDD875 - 13920028 WNF_ENTR_ALLOWMESSAGE_MMS_POLICY_VALUE_CHANGED
The AllowMessageMMS policy value has changed.
A3BDE075 - 13920028 WNF_ENTR_ALLOWMESSAGE_RCS_POLICY_VALUE_CHANGED
The AllowMessageRCS policy value has changed.
A3BDE875 - 13920028 WNF_ENTR_EDPSMB_POLICY_VALUE_CHANGED
SMBAutoEncryptedFileExtensions policy value has changed.
A3BDF075 - 13920028 WNF_ENTR_APPHVSI_POLICY_VALUE_CHANGED
Any AppHVSI policy value is changed
A3BDF875 - 13920028 WNF_ENTR_ALLOWSET24HOURCLOCK_POLICY_VALUE_CHANGED
The AllowSet24HourClock policy value has changed.
A3BE0075 - 13920028 WNF_ENTR_ALLOWPROJECTIONFROMPC_POLICY_VALUE_CHANGED
AllowProjectionFromPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A3BC0875 - 41911A28 WNF_ETW_SUBSYSTEM_INITIALIZED
ETW subsystem initialized
A3BC0875 - 2831628 WNF_EXEC_OSTASKCOMPLETION_REVOKED
This event signal when a task completion has been revoked due to memory pressure
A3BC1875 - 2831628 WNF_EXEC_THERMAL_LIMITER_CLOSE_APPLICATION_VIEWS
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates all application views should be closed
A3BC2075 - 2831628 WNF_EXEC_THERMAL_LIMITER_TERMINATE_BACKGROUND_TASKS
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates background tasks should be terminated
A3BC2875 - 2831628 WNF_EXEC_THERMAL_LIMITER_DISPLAY_WARNING
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates a warning should be displayed to the user
A3BC3075 - 2831628 WNF_EXEC_THERMAL_LIMITER_STOP_MRC
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates MRC should be stopped
A3BC0875 - 4195083A WNF_WFS_SETTINGS
Family Safety settings have changed
A3BC1075 - 4195083A WNF_WFS_TIMEREMAININGALERTS
Family Safety time remaining alerts to warn the user the allocated time is running out. The data is published as json blob with fileds U.SID for User SID as wide character and TR for time remaining in minutes as int value
A3BC1875 - 4195083A WNF_WFS_FAMILYMEMBERLOGIN
Family member login event
A3BC0875 - A840A2B WNF_FDBK_QUESTION_NOTIFICATION
This event contains a feedback question for the user. Payload is a JSON string specifying the feedback question.
A3BC0875 - 1287083A WNF_WFAS_FIREWALL_NETWORK_CHANGE_READY
Free network available or not
A3BC0875 - 159F022B WNF_FLYT_IDS_CHANGED
Triggered every time there is a change in flight IDs
A3BC0875 - 4192022B WNF_FLT_RUNDOWN_WAIT
Wait for rundown release in Filter Manager may be blocked by a suspended Modern application
A3BC0875 - 4182012B WNF_FOD_STATE_CHANGE
Installation status of Features on demand
A3BC0875 - D941D2B WNF_FSRL_TIERED_VOLUME_DETECTED
This event signals when a tiered volume is mounted
A3BC1075 - D941D2B WNF_FSRL_OPLOCK_BREAK
Oplock break acknowledgement may be blocked by a suspended Modern application
A3BC0875 - 41850121 WNF_LOC_DEVICE_BROKER_ACCESS_CHANGED
This event triggers when the user changes Geolocation access for an application or the user.
A3BC1075 - 41850121 WNF_LOC_RESERVED_WNF_EVENT
Do not use this WNF event, it is deprecated. Was WIN32_API_ACCESS_CHANGED.
A3BC1875 - 41850121 WNF_LOC_SHOW_SYSTRAY
This event triggers when there is an event that accesses location data -- this trigger starts LocationNotifications.exe which is a systray app.
A3BC0875 - 41950821 WNF_LFS_STATE
This is triggered when an app is making use of the location service. It has two possible data values associated to it: BOOL TRUE: one or more applications are using location. BOOL FALSE: no application is using location.
A3BC1075 - 41950821 WNF_LFS_RUNNING_STATE
This state is used to notify when the location service starts or stops running
A3BC1875 - 41950821 WNF_LFS_MASTERSWITCH_STATE
This state is used to notify when the phone location master switch status changes with BOOL as payload. TRUE indicating master switch is ON and FALSE indicating master switch is OFF
A3BC2075 - 41950821 WNF_LFS_GEOFENCETRACKING_STATE
This state is used to notify Geofence tracking state for the geofences added by the applications. TRUE if atleast one geofence is actively being tracked and FALSE if there are no geofences being tracked.
A3BC2875 - 41950821 WNF_LFS_RESERVED_WNF_EVENT_2
Do not use this WNF event, it is deprecated. Was WNF_LFS_BACKGROUND_PERMISSIONCHANGE_STATE
A3BC3075 - 41950821 WNF_LFS_POSITION_AVAILABLE
This state is used to notify when a new freely available position can be queried from the location framework.
A3BC3875 - 41950821 WNF_LFS_CLIENT_RECALCULATE_PERMISSIONS
This state is published whenever the permissions of an active client have changed. Every client on the system receives it, and should run domain-specific logic to see what the impact is (e.g., reconnect location session when permission re-allowed).
A3BC4075 - 41950821 WNF_LFS_PERMISSION_TO_SHOW_ICON_CHANGED
This event notifies when the permission regarding the ability to show the location notification icon has changed. The current state needs to be queried for as it is different for each user.
A3BC4875 - 41950821 WNF_LFS_ACTION_DIALOG_AVAILABLE
This event notifies when a new action dialog is available
A3BC5075 - 41950821 WNF_LFS_SIGNIFICANT_LOCATION_EVENT
This event notifies when there's a significant change in the location of the device.
A3BC5875 - 41950821 WNF_LFS_VISITS_SIGNIFICANT_LOCATION_EVENT
This event notifies when there's a visit or a significant change in the location of the device.
A3BC6075 - 41950821 WNF_LFS_LOCATION_MDM_AREA_POLICY_CHANGED
This event is fired when an MDM Location policy change occurs.
A3BC6875 - 41950821 WNF_LFS_LOCATION_MDM_POLICY_ENABLELOCATION_CHANGED
This event is fired when an MDM EnableLocation policy change occurs.
A3BC0875 - 41950223 WNF_NLS_ACP_CHANGED
This state is notified when the ANSI codepage changes - The data value is a UINT that indicates the new ANSI codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC1075 - 41950223 WNF_NLS_OEMCP_CHANGED
This state is notified when the OEM codepage changes - The data value is a UINT that indicates the new OEM codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC1835 - 41950223 WNF_NLS_USER_DEFAULT_LOCALE_CHANGED
This state is notified when the user default locale changes - The data value is an LCID that indicates the new locale. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC2035 - 41950223 WNF_NLS_USER_UILANG_CHANGED
This state is notified when the user default UI language changes - The data value is a LANGID that indicates the new UI language. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC2835 - 41950223 WNF_NLS_LOCALE_INFO_CHANGED
This state is notified when the locale info changes by means of calling SetLocaleInfo - The data value is a DWORD that indicates the LCTYPE that changed. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC3035 - 41950223 WNF_NLS_GEOID_CHANGED
This state is notified when the user Geo ID changes by means of calling SetUserGeoID - The data value is a DWORD that indicates the new GeoID. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC3875 - 41950223 WNF_NLS_LANG_UPDATE_LAUNCH
Notification indicating lang update launcher needs to be started. SDDL comes from ID_CAP_EVERYONE, ID_CAP_NTSERVICES and ID_CAP_INPUT_LOCALES in %SDXROOT%\src\uxplat\Input\Packages\InputServer\InputServer.pkg.xml
A3BC4075 - 41950223 WNF_NLS_SETTINGS_REPLICATOR_LAUNCH
Notification indicating NLS/MUI user settings replicator needs to be started. - The data value is the replication cookie GUID (binary). SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC4875 - 41950223 WNF_NLS_SETTINGS_REPLICATION_COMPLETE
Notification indicating NLS/MUI user settings replication has completed. - The data value is an HRESULT. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC0875 - 389022A WNF_GLOB_USERPROFILE_LANGLIST_CHANGED
This state is notified when the globalization user profile has changed via SetUserProfileLanguagesWP. There is nothing in the payload - call GetUserProfileLanguagesWP to get the updated user profile language list. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC0875 - D891E2A WNF_GPOL_SYSTEM_CHANGES
System policy has been updated
A3BC10F5 - D891E2A WNF_GPOL_USER_CHANGES
User policy has been updated
A3BC0875 - 41950F25 WNF_HAS_VERIFY_HEALTH_CERT
This event signals a request to get (if needed) and verify Health Certificate with HAS
A3BC0835 - E8A0125 WNF_HOLO_USER_DISPLAY_CONTEXT
Event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
A3BC1035 - E8A0125 WNF_HOLO_USER_INPUT_CONTEXT
Event raised when the input context changes (ex. from 3D input to 2D Desktop input). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
A3BC1835 - E8A0125 WNF_HOLO_SHELL_STATE
Event raised when the Holographic Shell running state changes (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState
A3BC2035 - E8A0125 WNF_HOLO_INPUT_FOCUS_CHANGE
This event signals when input focus changes to a different window. Data is a MPCInputFocusChange struct.
A3BC2835 - E8A0125 WNF_HOLO_FORCE_ROOM_BOUNDARY
If payload is non-zero, room boundary is forced to be visible.
A3BC3035 - E8A0125 WNF_HOLO_STREAMING_STATE
This event signals whether streaming is active. Data contains a bool indicating if streaming is active.
A3BC3835 - E8A0125 WNF_HOLO_ROOM_BOUNDARY_DATA_CHANGED
This event signals that the persisted room boundary data has changed.
A3BC4035 - E8A0125 WNF_HOLO_ROOM_BOUNDARY_VISIBILITY
A non-zero payload indicates the room boundary is visible to the user. Writable by DWM and System.
A3BC4835 - E8A0125 WNF_HOLO_SHELL_INPUT_3DSWITCH_DISABLE
This event signals when various input types should be disabled from natively working in the Windows Holographic shell, useful for apps that simulate GGV via mouse and/or gamepad. Data contains a DWORD of bitflags from Windows::Internal::Shell::Holographic::ShellInput3DSwitchDisableFlags.
A3BC0875 - 418A1825 WNF_HVL_CPU_MGMT_PARTITION
This state signals NTOS has CPU management privileges in the current partition.
A3BC0875 - 17961725 WNF_HYPV_HOST_WMI_OBJECT_PROVIDER_STATE
The state of Hyper-V's host-only WMI object provider.
A3BC1075 - 17961725 WNF_HYPV_HOST_WMI_EVENT_PROVIDER_STATE
The state of Hyper-V's host-only WMI event provider.
A3BC0835 - F950324 WNF_IMSN_MONITORMODECHANGED
A monitor has changed immersive modes
A3BC1035 - F950324 WNF_IMSN_LAUNCHERVISIBILITY
The immersive launcher's visibility has changed
A3BC1835 - F950324 WNF_IMSN_IMMERSIVEMONITORCHANGED
The monitor the immersive environment is running on has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC3035 - F950324 WNF_IMSN_KILL_LOGICAL_FOCUS
User-perceived focus has left an edit box.
A3BC3835 - F950324 WNF_IMSN_PROJECTIONDISPLAYAVAILABLE
Projection display availability has changed
A3BC0835 - 128F1B24 WNF_IUIS_SCALE_CHANGED
The immersive UI scale has changed for the current session.
A3BC0835 - 418B1D24 WNF_ISM_LAST_USER_ACTIVITY
Last recorded user activity
A3BC0875 - 41920124 WNF_IOT_EMBEDDED_MODE_POLICY_VALUE_CHANGED
Embedded mode policy value has changed.
A3BC1075 - 41920124 WNF_IOT_STARTUP_SETTINGS_CHANGED
settings for the foreground app and/or iot startup type background tasks have changed
A3BC0875 - 6880F21 WNF_LANG_FOD_INSTALLATION_STARTED
Installation of language features on demand was started (either through Settings or through installation task).
A3BC0875 - 41C60321 WNF_LM_PACKAGE_SUSPEND_REQUIRED
A running package's license is now invalid and the package must be suspended or terminated.
A3BC1075 - 41C60321 WNF_LM_CONTENT_LICENSE_CHANGED
A content license's state has been modified.
A3BC1875 - 41C60321 WNF_LM_ROOT_LICENSE_CHANGED
A root license's state has been modified.
A3BC2075 - 41C60321 WNF_LM_OPTIONAL_PACKAGE_SUSPEND_REQUIRED
A running optional package's license is lost.
A3BC2875 - 41C60321 WNF_LM_APP_LICENSE_EVENT
Multi-purpose event for app license notifications.
A3BC3075 - 41C60321 WNF_LM_OFFLINE_PC_CHANGED
A offline pc state has been changed.
A3BC3875 - 41C60321 WNF_LM_LICENSE_REFRESHED
Licenses have been refreshed.
A3BC0875 - 41850721 WNF_LIC_NO_APPLICABLE_LICENSES_FOUND
Failed to launch the modern app because no valid licenses and leases were found
A3BC1075 - 41850721 WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_OUT_OF_TOLERANCE
The device license hardware ID is out of tolerance with the device's hardware ID
A3BC1875 - 41850721 WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_IN_TOLERANCE
The hardware ID has changed but is still with in tolerance with the device's hardware ID
A3BC2075 - 41850721 WNF_LIC_DEVICE_LICENSE_UPDATED
A new device license with a different device ID was installed
A3BC2875 - 41850721 WNF_LIC_DEVICE_LICENSE_REMOVED
The device license was uninstalled
A3BC3075 - 41850721 WNF_LIC_DEVICE_LICENSE_MISSING
The required device license was nout found
A3BC3875 - 41850721 WNF_LIC_INT_DEVICE_LICENSE_EXPIRED
The integration device license has expired and can no longer be used to verify or decrypt modern app licenses.
A3BC4075 - 41850721 WNF_LIC_LOCAL_MIGRATED_LICENSES_FOUND
Found a local migrated license which needs to be refereshed with a store signed license.
A3BC4875 - 41850721 WNF_LIC_MANAGE_DEVICE_REGISTRATION_AND_REACTIVATION
The MDM Licensing Device Registration Policy has been refreshed.
A3BC5075 - 28F0222 WNF_OLIC_OS_EDITION_CHANGE
OS Edition has changed.
A3BC5875 - 28F0222 WNF_OLIC_OS_LICENSE_POLICY_CHANGE
OS Policy has changed.
A3BC6075 - 28F0222 WNF_OLIC_OS_LICENSE_TERMS_ACCEPTED
The License Terms can be considered as accepted on this device.
A3BC0835 - F810121 WNF_LOGN_EOA_FLYOUT_POSITION
Indicates where the ease of access flyout should appear in LogonUI and User Oobe, the data type is RECT. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
A3BC1035 - F810121 WNF_LOGN_SLIDE_TO_SHUTDOWN
Indicates that a shutdown has been triggered via Slide-to-shutdown. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
A3BC1835 - F810121 WNF_LOGN_RETURN_TO_LOCK
Indicates that user intends to interact with the lock screen (e.g. for Projection or Cortana) and LogonUI should return to the lock screen.
A3BC2035 - F810121 WNF_LOGN_PINPAD_VISIBLE
Indicates that the mobile pinpad is visible.
A3BC1075 - 12960F20 WNF_MAPS_MAPLOADER_PROGRESS
Current progress of the MapLoader background engine.
A3BC1875 - 12960F20 WNF_MAPS_MAPLOADER_STATUS_CHANGE
The new status of ODML.
A3BC2075 - 12960F20 WNF_MAPS_MAPLOADER_PACKAGE_CHANGE
A map package has been added or removed or repositioned in the list.
A3BC0875 - 288173E WNF_SYNC_REQUEST_PROBE
Sync sets this value to request a wifi probe due to SSL error. SDDL comes from ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC0875 - 41941B20 WNF_MUR_MEDIA_UI_REQUEST_WLAN
Interface to Media-UI-request-State mapping for WLAN (802.1x) interfaces
A3BC1075 - 41941B20 WNF_MUR_MEDIA_UI_REQUEST_LAN
Interface to Media-UI-request-State mapping for LAN (802.3) interfaces
A3BC0835 - 41871D20 WNF_MSA_ACCOUNTSTATECHANGE
Notification for alerting client apps that the connected account ticketing state has changed
A3BC0875 - 41C60320 WNF_MM_BAD_MEMORY_PENDING_REMOVAL
This notification is raised when the memory manager is unable to automatically offline a bad memory page
A3BC0875 - 41921C20 WNF_MRT_QUALIFIER_CONTRAST_CHANGED
This state is notified when the constrast qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
A3BC1075 - 41921C20 WNF_MRT_QUALIFIER_THEME_CHANGED
This state is notified when the theme qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
A3BC1C75 - 41921C20 WNF_MRT_PERSISTENT_QUALIFIER_CHANGED
This state is notified when some persistent qualifier changed its value. Payload is qualifier@package_name with a max length of 512 bytes (256 WCHARs including null terminator). Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
A3BC2075 - 41921C20 WNF_MRT_MERGE_SYSTEM_PRI_FILES
This state is notified when system PRI files are merged. Payload has a max length of 128 bytes (64 WCHARs including null terminator) and consists of 'start [starting timestamp]' or 'done [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
A3BC2875 - 41921C20 WNF_MRT_SYSTEM_PRI_MERGE
This state is notified when a system PRI file is merged. Payload has a max length of 512 bytes (256 WCHARs including null terminator) and consists of either 'start [path] [starting timestamp]' or '{done,skipped} [path] [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC0835 - 17950F23 WNF_NASV_USER_PRESENT
NaAuth User Presence Status
A3BC1075 - 17950F23 WNF_NASV_SERVICE_RUNNING
NaAuth Service Running
A3BC0875 - 41840D23 WNF_NCB_APP_AVAILABLE
NCB indication of CCT or Socket Broker Based App availability.
A3BC0875 - 128F0A23 WNF_NDIS_ADAPTER_ARRIVAL
NDIS finds a network adapter that needs to be configured by NetSetupSvc.
A3BC1075 - 128F0A23 WNF_NDIS_CORRUPTED_STORE
NDIS detects corruption in the binding store.
A3BC0875 - 418B0223 WNF_NLM_VPN_RECONNECT_CHANGE
This event is signalled by rasman about reconnect VPN state change and is used by NLM
A3BC1075 - 418B0223 WNF_NLM_INTERNET_PRESENT
This event is signalled by NLM when the aggregated network conditions indicate that a connection to the internet is present
A3BC0875 - 41850923 WNF_NGC_PREGEN_TRIGGER
This event signals when an caller wants to trigger KeyPregenTask.
A3BC1075 - 41850923 WNF_NGC_AIKCERT_TRIGGER
This event signals when an caller wants to trigger AikCertEnrollTask.
A3BC1875 - 41850923 WNF_NGC_PRO_CSP_POLICY_CHANGED
This event is fired when a policy change occurs in the NGC Pro CSP.
A3BC2075 - 41850923 WNF_NGC_PREGEN_DELAY_TRIGGER
This event signals when an caller wants to trigger KeyPregenTask with some delay.
A3BC2875 - 41850923 WNF_NGC_GESTURE_AUTHENTICATED
This event signals when NGC container service (ngcctnrsvc) authenticates a gesture.
A3BC3075 - 41850923 WNF_NGC_CRYPTO_MDM_POLICY_CHANGED
This event is fired when an MDM cryptographic policy change occurs.
A3BC3875 - 41850923 WNF_NGC_CREDENTIAL_REFRESH_REQUIRED
This event is fired when an activity occurs that requires the NGC PIN cred prov to refresh its credential state.
A3BC0875 - 41870223 WNF_NLA_CAPABILITY_CHANGE
This event is notified when NCSI detects a capability change
A3BC1075 - 41870223 WNF_NLA_ENTER_SUSPECT_STATE
This event notifies NCSI that it should enter the suspect state
A3BC1875 - 41870223 WNF_NLA_TASK_TRIGGER
State name triggering WiFiTask from NlaSvc
A3BC08F5 - 41881E3A WNF_WPN_USER_PLATFORM_READY
This WNF state indicates to users of WPN endpoints (except AppEndpoint) that platform is ready to use. This state can also be used to know if WPN platform restarted.
A3BC10F5 - 41881E3A WNF_WPN_PLATFORM_INITIALIZED
This WNF state can be used by first party Apps / Services to determine when WPN platform is ready to handle app related requests like posting toast / tile and getting channel uri.
A3BC1875 - 41881E3A WNF_WPN_SYSTEM_PLATFORM_READY
State indicating that system notification platform has been registered and ready to user.
A3BC0875 - C951E23 WNF_NPSM_SERVICE_STARTED
This notification is to indicate that the NPSM service has started up.
A3BC0875 - 41851D2E WNF_CSC_SERVICE_START
CSC Service start trigger
A3BC0835 - 4840122 WNF_OOBE_SHL_MAGNIFIER_QUERY
Notification from ISM to OOBE to query the user whether to activate the always-on Magnifier in OOBE
A3BC1035 - 4840122 WNF_OOBE_SHL_MAGNIFIER_CONFIRM
Notification from OOBE to ISM whether the user confirms to activate the always-on Magnifier in OOBE
A3BC1875 - 4840122 WNF_OOBE_SHL_MONITOR_STATE
Notification to User OOBE monitor on where the progress is
A3BC2035 - 4840122 WNF_OOBE_SHL_SPEECH_CONTROLLER
Notification of speech controller state change. Payload is state type plus string of length 512
A3BC0875 - 5941822 WNF_OVRD_OVERRIDESCALEUPDATED
The window's override scale has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC0875 - 41C6013D WNF_PO_SCENARIO_CHANGE
Sent when the WDI session corresponding to a power scenario changes
A3BC1075 - 41C6013D WNF_PO_COMPOSITE_BATTERY
Sent when the composite battery is updated
A3BC1875 - 41C6013D WNF_PO_POWER_STATE_CHANGE
Sent after WNF_PO_COMPOSITE_BATTERY when batteries are added or removed and when one or more batteries' AC, charging, or discharging states changes
A3BC2075 - 41C6013D WNF_PO_ENERGY_SAVER_STATE
Triggered when Energy Saver state changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
A3BC2875 - 41C6013D WNF_PO_ENERGY_SAVER_SETTING
Triggered when Energy Saver setting changes
A3BC3075 - 41C6013D WNF_PO_ENERGY_SAVER_OVERRIDE
Triggered to indicate Energy Saver override settings
A3BC3875 - 41C6013D WNF_PO_THERMAL_STANDBY
Triggered to indicate CR3 condition
A3BC4075 - 41C6013D WNF_PO_THERMAL_SHUTDOWN_OCCURRED
Sent when the previous shutdown was due to a thermal trip
A3BC4875 - 41C6013D WNF_PO_THERMAL_HIBERNATE_OCCURRED
Sent when the previous hibernate was due to a thermal trip
A3BC5075 - 41C6013D WNF_PO_DISCHARGE_ESTIMATE
Estimated time until full discharge in seconds
A3BC5C75 - 41C6013D WNF_PO_DISCHARGE_START_FILETIME
Filetime of last known start of discharge
A3BC6075 - 41C6013D WNF_PO_CHARGE_ESTIMATE
Estimated time until full charge in seconds
A3BC6875 - 41C6013D WNF_PO_THERMAL_OVERTHROTTLE
Triggered to indicate excessive thermal throttling
A3BC7075 - 41C6013D WNF_PO_USER_AWAY_PREDICTION
Sent to indicate whenever user-away prediction is updated.
A3BC7835 - 41C6013D WNF_PO_DISPLAY_REQUEST_ACTIVE
Sent to indicate whether a display request is active in the current session.
A3BC8075 - 41C6013D WNF_PO_BATTERY_CHARGE_LEVEL
Triggered when battery charge crosses well-known charge level boundaries.
A3BC8875 - 41C6013D WNF_PO_SLEEP_STUDY_USER_PRESENCE_CHANGED
Sent when the global user presence changes.
A3BC9075 - 41C6013D WNF_PO_BACKGROUND_ACTIVITY_POLICY
Sent when the background activity policy changes.
A3BC9875 - 41C6013D WNF_PO_BATTERY_DISCHARGING
Triggered when battery is being discharged, irrespective of AC/DC state of the system.
A3BCA075 - 41C6013D WNF_PO_PRIMARY_DISPLAY_VISIBLE_STATE
Visible state of the primary display as MONITOR_DISPLAY_STATE
A3BCA875 - 41C6013D WNF_PO_PRIMARY_DISPLAY_LOGICAL_STATE
Logical state of the primary display as MONITOR_LOGICAL_DISPLAY_STATE
A3BCB075 - 41C6013D WNF_PO_PREVIOUS_SHUTDOWN_STATE
Sent on every boot to notify previous shutdown state
A3BCB875 - 41C6013D WNF_PO_MODERN_STANDBY_EXIT_INITIATED
Triggered at the start of a transition to exit modern standby
A3BCC075 - 41C6013D WNF_PO_SW_HW_DRIPS_DIVERGENCE
Sent when SW DRIPS is more than HW DRIPS by a specific threshold
A3BCC875 - 41C6013D WNF_PO_DRIPS_DEVICE_CONSTRAINTS_REGISTERED
Sent once platform idle states and associated device constraints have been registered
A3BCD075 - 41C6013D WNF_PO_BASIC_BRIGHTNESS_ENGINE_DISABLED
One time system-wide transition to switch from the basic brightness engine to the high-precision brightness engine.
A3BCD875 - 41C6013D WNF_PO_BRIGHTNESS_ALS_OFFSET
ALS brightness offset consumed by the basic brightness engine.
A3BCE075 - 41C6013D WNF_PO_VIDEO_INITIALIALIZED
Set to TRUE when the video system is initialized.
A3BCE875 - 41C6013D WNF_PO_OVERLAY_POWER_SCHEME_UPDATE
Notification for power-setting overlay scheme change.
A3BCF075 - 41C6013D WNF_PO_CAD_STICKY_DISABLE_CHARGING
Set when an you want IOCTL_CAD_DISABLE_CHARGING to behave in a sticky manner
A3BCF875 - 41C6013D WNF_PO_POWER_BUTTON_STATE
Describes the current state of the power button.
A3BC0875 - 96003D WNF_PNPA_DEVNODES_CHANGED
This corresponds to a DBT_DEVNODES_CHANGED message
A3BC1035 - 96003D WNF_PNPA_DEVNODES_CHANGED_SESSION
This corresponds to a DBT_DEVNODES_CHANGED message
A3BC1875 - 96003D WNF_PNPA_VOLUMES_CHANGED
This corresponds to a drive letter arrival/removal message
A3BC2035 - 96003D WNF_PNPA_VOLUMES_CHANGED_SESSION
This corresponds to a drive letter arrival/removal message
A3BC2875 - 96003D WNF_PNPA_HARDWAREPROFILES_CHANGED
This corresponds to a hardware profiles changed message
A3BC3035 - 96003D WNF_PNPA_HARDWAREPROFILES_CHANGED_SESSION
This corresponds to a hardware profiles changed message
A3BC3875 - 96003D WNF_PNPA_PORTS_CHANGED
This corresponds to a ports changes message
A3BC4035 - 96003D WNF_PNPA_PORTS_CHANGED_SESSION
This corresponds to a ports changes message
A3BC0875 - 396003D WNF_PNPB_AWAITING_RESPONSE
This corresponds to kernel PNP waiting synchronously for user-mode clients
A3BC0875 - 296003D WNF_PNPC_REBOOT_REQUIRED
This corresponds to a reboot of the system needs to be performed due to a device installation
A3BC1075 - 296003D WNF_PNPC_DEVICE_INSTALL_REQUESTED
Device installation is requested.
A3BC1875 - 296003D WNF_PNPC_CONTAINER_CONFIG_REQUESTED
A change that requires a device container to be updated has occured.
A3BC0875 - 17891C3D WNF_PROV_TURN_COMPLETE
Fired when a full set of packages are processed.
A3BC0875 - 41C61D3D WNF_PS_WAKE_CHARGE_RESOURCE_POLICY
This corresponds to an application that has eclipsed job wake charge resource policy
A3BC0875 - 41851C3E WNF_SRC_SYSTEM_RADIO_CHANGED
This event signals when system radio is changed
A3BC0875 - 41C6033F WNF_RM_MEMORY_MONITOR_USAGE_LEVEL
Supplies the current RM memory monitor memory usage level. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC1075 - 41C6033F WNF_RM_GAME_MODE_ACTIVE
Supplies the process ID of the current game mode recipient, or 0 if no recipient is active
A3BC0875 - 1294023A WNF_WLRS_SETTINGS
Windows or application settings have changed in Live Storage
A3BC1075 - 1294023A WNF_WLRS_USERTILE
Usertile has changed in Live Storage
A3BC1875 - 1294023A WNF_WLRS_COLLECTIONINTEREST
Collection interest has changed in Live Storage
A3BC0875 - 7851E3F WNF_RPCF_FWMAN_RUNNING
This event signals when the RPC firewall manager is initialized
A3BC0875 - 12821A3F WNF_RTDS_RPC_INTERFACE_TRIGGER_CHANGED
An RPC service trigger has been added or removed
A3BC1875 - 12821A3F WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED
A named pipe service trigger has been added or removed
A3BC0875 - 418B0D3E WNF_SCM_AUTOSTART_STATE
This event triggers to indicate SCM autostart state
A3BC0875 - 41950C3E WNF_SBS_UPDATE_AVAILABLE
This event signals that there is an update available to the Secure Boot variables.
A3BC0875 - 41851D3A WNF_WSC_SECURITY_CENTER_USER_NOTIFICATION
A notification dialog should be shown to the user.
A3BC0875 - 41890A3E WNF_SDO_ORIENTATION_CHANGE
This event triggers when there is a simple device orientation change. It's data value is one of the SimpleDeviceOrientation enum values. Rights: SensorService can publish, Everyone can subscribe.
A3BC0C75 - 41960B29 WNF_DEP_OOBE_COMPLETE
This event triggers when the system has completed OOBE (Windows Welcome)
A3BC1475 - 41960B29 WNF_DEP_UNINSTALL_DISABLED
This event triggers when the Uninstall of the system has been disabled
A3BC0875 - D83063E WNF_SHEL_IMMERSIVE_SHELL_RUNNING
This event signals when the Immersive Shell is started
A3BC1035 - D83063E WNF_SHEL_NOTIFICATIONS
Set to 0 or more to indicate whether there are any unseen notifications in the notification center. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable the notification on OneCore
A3BC1875 - D83063E WNF_SHEL_LOGON_COMPLETE
This system-scope event is signaled each time a user's desktop becomes ready. Consider using WNF_SHEL_SESSION_LOGON_COMPLETE for a session-scoped version.
A3BC2475 - D83063E WNF_SHEL_OOBE_USER_LOGON_COMPLETE
This event signals when logon of the first user after OOBE is complete
A3BC2875 - D83063E WNF_SHEL_VEEVENT_DISPATCHER_CLIENT_PIPE_CLOSED
TDL dispatcher pipe has been closed
A3BC3075 - D83063E WNF_SHEL_TILECHANGE
This event is signalled when there is a tile change to a background task
A3BC3835 - D83063E WNF_SHEL_NOTIFICATION_SETTINGS_CHANGED
Event signals when toast notification settings have changed.
A3BC4075 - D83063E WNF_SHEL_SOFTLANDING_RULE_TRIGGERED
This event signals when a SoftLanding rule is triggered
A3BC4875 - D83063E WNF_SHEL_START_LAYOUT_READY
This event signals when Start Experience Host completes loading the Start menu layout
A3BC5075 - D83063E WNF_SHEL_APPRESOLVER_SCAN
Event signals a full app resolver scan has been invoked.
A3BC5835 - D83063E WNF_SHEL_LOCKSCREEN_ACTIVE
Set to 0 or 1 to indicate whether the lock screen is active. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write.
A3BC6075 - D83063E WNF_SHEL_START_APPLIFECYCLE_INSTALL_FINISHED
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_INSTALL_FINISHED event from TDL
A3BC6875 - D83063E WNF_SHEL_START_APPLIFECYCLE_DOWNLOAD_STARTED
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_DOWNLOAD_STARTED event from TDL
A3BC7075 - D83063E WNF_SHEL_APPLICATION_STATE_UPDATE
Event is for the shell to notify when app layout state is changed. Payload is ShellApplicationStateWnf struct.
A3BC7875 - D83063E WNF_SHEL_FOCUS_CHANGE
This event signals when focus changes to a different process, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
A3BC8075 - D83063E WNF_SHEL_GAMECONTROLLER_LISTENER_INFO
This event signals to toggle exclusive gamepad listening on and off, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
A3BC8875 - D83063E WNF_SHEL_GAMECONTROLLER_FOCUS_INFO
This event signals to toggle exclusive gamepad input on and off
A3BC9475 - D83063E WNF_SHEL_ENTERPRISE_START_LAYOUT_POLICY_VALUE_CHANGED
This even signals when Start layout MDM policy has been applied
A3BC9875 - D83063E WNF_SHEL_CORTANA_APPINDEX_UPDATED
Event signals when the apps have been pushed to the indexer has completed
A3BCA075 - D83063E WNF_SHEL_SOFTLANDING_RULES_UPDATED
This event signals when SoftLanding rules folder is updated
A3BCA835 - D83063E WNF_SHEL_NOTIFICATIONS_CRITICAL
This event signals that a critical notification such as an incoming call was posted. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable notification on OneCore
A3BCB035 - D83063E WNF_SHEL_START_VISIBILITY_CHANGED
This event signals when Start visibility changes
A3BCB875 - D83063E WNF_SHEL_TRAY_SEARCHBOX_VISIBILITY_CHANGED
Set to 0 or 1 to indicate whether the searchbox is visibile in the tray. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write.
A3BCC075 - D83063E WNF_SHEL_DEVICE_UNLOCKED
This event signals that the device is unlocked in the current session
A3BCC875 - D83063E WNF_SHEL_PLACES_CHANGED
This event signals the changes in places' database (clientgraph)
A3BCD075 - D83063E WNF_SHEL_SUSPEND_APP_BACKGROUND_ACTIVITY
Event is for the shell to notify when app background activity should be suspended. Payload is DWORD set to 1 or 0.
A3BCD875 - D83063E WNF_SHEL_CREATIVE_EVENT_TRIGGERED
This event signals a creative event has been triggered
A3BCE075 - D83063E WNF_SHEL_JUMPLIST_CHANGED
Event signals that the jumplist for an app has changed. Payload is a struct containing the current sessionId as well as a string representing the aumid of the app whose jumplist was updated.
A3BCE875 - D83063E WNF_SHEL_START_APPLIFECYCLE_UNINSTALL_FINISHED
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_UNINSTALL_FINISHED event from TDL
A3BCF075 - D83063E WNF_SHEL_GAMECONTROLLER_NEXUS_INFO
This event signals whenever the nexus button policy changes.
A3BCF875 - D83063E WNF_SHEL_SETTINGS_CHANGED
This event signals when a settings toggle has changed
A3BD0035 - D83063E WNF_SHEL_TOAST_PUBLISHED
This event signals when a new toast is published
A3BD0835 - D83063E WNF_SHEL_SOFTLANDING_PUBLISHED
This event signals when a new soft landing tip is published
A3BD1075 - D83063E WNF_SHEL_REQUEST_CORTANA_SETTINGSCONSTRAINTINDEX_BUILD
Event signals when an app requests cortana to build the settings constraint index
A3BD1835 - D83063E WNF_SHEL_DICTATION_RUNNING
This is the state of dictation. SDDL comes from dwm.exe in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml and WPNarrator in %SDXROOT%\src\media\apps\packages\Apps\WPNarrator.pkg.xml. And Phone DefApps group is required too.
A3BD2075 - D83063E WNF_SHEL_DDC_COMMAND_AVAILABLE
This event signals when a parsed command is ready for processing
A3BD2875 - D83063E WNF_SHEL_DDC_WNS_COMMAND
This event signals when a command has been delivered via WNS
A3BD3075 - D83063E WNF_SHEL_DDC_SMS_COMMAND
This event signals when a command has been delivered via SMS
A3BD3875 - D83063E WNF_SHEL_DEVICE_LOCKED
This event signals that the device is locked in the current session
A3BD4075 - D83063E WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_ACTIVATED
This event signals a subscription has been activated.
A3BD4875 - D83063E WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_UPDATED
This event signals the content of one or more subscriptions has been updated.
A3BD5075 - D83063E WNF_SHEL_LOCKSCREEN_IMAGE_CHANGED
This event signals that lock screen image had changed. It contains the user sid whose image was changed
A3BD5875 - D83063E WNF_SHEL_SCREEN_COVERED
Set to 0 (uncovered or unknown) or 1 (covered).
A3BD6075 - D83063E WNF_SHEL_DDC_CONNECTED_ACCOUNTS_CHANGED
This event signals when connected accounts have changed and register device should be called
A3BD6835 - D83063E WNF_SHEL_OOBE_ENABLE_PROVISIONING
This event signals when OOBE in a Shell should enable its provisioning flow
A3BD7035 - D83063E WNF_SHEL_LOCK_APP_SHOWN
This event signals that the Lock application has been presented to the user. It contains an instance cookie as specified from LogonUI.
A3BD7835 - D83063E WNF_SHEL_LOCK_APP_REQUESTING_UNLOCK
This event signals that the Lock application is requesting to unlock so the user can enter credentials.
A3BD8075 - D83063E WNF_SHEL_TILEINSTALL
This event is signalled when there is a tile install to a background task
A3BD8875 - D83063E WNF_SHEL_TILEUPDATE
This event is signalled when there is a tile update to a background task
A3BD9075 - D83063E WNF_SHEL_TILEUNINSTALL
This event is signalled when there is a tile uninstall to a background task
A3BD9835 - D83063E WNF_SHEL_ABOVE_LOCK_APP_ACTIVE
This event is signalled when there is an app launched (1) or terminated (0) above lock. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed access.
A3BDA035 - D83063E WNF_SHEL_RADIALCONTROLLER_EXPERIENCE_RESTART
This event is signalled when the RadialController Experience has restarted to allow registered API component to re-establish connection and repopulate state
A3BDA835 - D83063E WNF_SHEL_ABOVE_LOCK_BIO_ACTIVE
This event is signalled when there is bio feedback active (1) or inactive (0) above lock
A3BDB035 - D83063E WNF_SHEL_CORTANA_SPEECH_CANCELHANDSFREE_REQUESTED
This event can be signalled when a handsfree device needs to request Cortana to cancel speech activity.
A3BDB875 - D83063E WNF_SHEL_CALM_DISPLAY_ACTIVE
Set to 0 (inactive) or 1 (active).
A3BDC035 - D83063E WNF_SHEL_START_LAYOUT_UPDATED
This event signals a start layout change to a background task
A3BDC835 - D83063E WNF_SHEL_PEOPLE_PINNED_LIST_CHANGED
This event is signalled when there is a change to the Pinned People list
A3BDD075 - D83063E WNF_SHEL_LOCKSTATE
Current lock state of the device. Payload is DEVICE_LOCKSTATE. On multisession SKUs, everyone can read while only SYSTEM can write. On single session SKUs, everyone can read while only DefaultAccount can write. On single session SKUs, also include allow list from the SDDL for DEVICE_LOCK_STATE. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
A3BDD875 - D83063E WNF_SHEL_APPLICATION_SPATIAL_INFO_UPDATE
Event is for the shell to notify when app spatial information has changed. Payload is ApplicationSpatialInformationWnf struct.
A3BDE075 - D83063E WNF_SHEL_CORTANA_AUDIO_ACTIVE
Indicates the state of Cortana speech input and output.
A3BDE835 - D83063E WNF_SHEL_LOCKSCREEN_INFO_UPDATED
This event signals that the LockScreen info is updated.
A3BDF875 - D83063E WNF_SHEL_CDM_FEATURE_CONFIG_FIRST_USAGE
This event notifies the CDM when a new feature configuration is first used
A3BE00F5 - D83063E WNF_SHEL_APPLICATION_STARTED
This event is signals when an application launches. The Payload is the appID.
A3BE08F5 - D83063E WNF_SHEL_APPLICATION_TERMINATED
This event is signals when an application is terminated. The Payload is the appID.
A3BE10F5 - D83063E WNF_SHEL_WINDOWSTIP_CONTENT_PUBLISHED
This event is signals when a request is made to show a Windows Tip bubble. The Payload is the content id(String).
A3BE18F5 - D83063E WNF_SHEL_USER_IDLE
This event signals when the first time a user is idle after logon
A3BE2035 - D83063E WNF_SHEL_PEOPLE_PANE_VIEW_CHANGED
This event is signalled when there is a change to the People Pane Views
A3BE2835 - D83063E WNF_SHEL_LOCK_APP_RELOCK
This event signals that the lock screen should be reset due to a re-lock request.
A3BE3035 - D83063E WNF_SHEL_LOCK_APP_READY
This event signals that the lock screen is ready after a reset was requested.
A3BE3835 - D83063E WNF_SHEL_SESSION_LOGON_COMPLETE
This event is scoped to the user session and signaled when the desktop is ready after a logon
A3BE4075 - D83063E WNF_SHEL_HEALTH_STATE_CHANGED
This event signals when the health state of the device changes
A3BE4875 - D83063E WNF_SHEL_CONTENT_DELIVERY_MANAGER_NEEDS_REMEDIATION
This event signals that Content Delivery Manager content needs remediation
A3BE50F5 - D83063E WNF_SHEL_DESKTOP_APPLICATION_STARTED
This event is signals when a desktop application launches. The Payload is the executable name.
A3BE58F5 - D83063E WNF_SHEL_DESKTOP_APPLICATION_TERMINATED
This event is signals when a desktop application is terminated. The Payload is the executable name.
A3BE60F5 - D83063E WNF_SHEL_SUGGESTED_APP_READY
This event signals that the app launched by sign in suggestions is ready.
A3BE6835 - D83063E WNF_SHEL_CDM_REGISTRATION_COMPLETE
This event is scoped to the user session and signaled when the CDM registration is complete
A3BE70F5 - D83063E WNF_SHEL_CONTENT_DELIVERY_MANAGER_MONITORING
This event signals that Content Delivery Manager Cache Monitoring is Enabled or not.
A3BC0875 - 4189073E WNF_SIO_PIN_ENROLLED
Used to notify the PIN list that a PIN has been enrolled and that it should refresh.
A3BC1075 - 4189073E WNF_SIO_BIO_ENROLLED
Used to notify the Delay Lock settings that Biometric enrollment has been modified.
A3BC0875 - 59F053E WNF_SKYD_FILE_SYNC
A file has changed on storage and a request is received to sync.
A3BC1075 - 59F053E WNF_SKYD_QUOTA_CHANGE
A user's quota has changed.
A3BC0875 - 4195033E WNF_SMS_CHECK_ACCESS
This event triggers when the user revokes SMS access.
A3BC0875 - 1295033E WNF_SMSS_MEMORY_COOLING_COMPATIBLE
This event triggers when the system has multiple memory channels and memory cooling can be started
A3BC0875 - 2871E3E WNF_SPAC_SPACEPORT_PROPERTY_CHANGED
This notification is issued when a property of an object changes
A3BC1075 - 2871E3E WNF_SPAC_SPACEPORT_WORK_REQUESTED
This notification is issued to request work in user-mode
A3BC0835 - 9851E3E WNF_SPCH_INPUT_STATE_UPDATE
Indicates the state of the shared recognizer.
A3BC0875 - C931C3E WNF_SRUM_SCREENONSTUDY_SESSION_START
Sent when a screen on study session starts
A3BC1075 - C931C3E WNF_SRUM_SCREENONSTUDY_SESSION_END
Sent when a screen on study session ends
A3BC0875 - 41901C3E WNF_SRV_SRV2_STATE_CHANGE
This event signals when the server (SRV2) start/stop
A3BC6075 - F911D22 WNF_OSWN_STORAGE_PRESENCE_CHANGE
This event indicates a change in the mount state of an SD card.
A3BC6875 - F911D22 WNF_OSWN_STORAGE_VOLUME_STATUS_CHANGE
This event indicates a change in the volume status of an SD card.
A3BC7075 - F911D22 WNF_OSWN_STORAGE_FREE_SPACE_CHANGE
This event indicates a change in the free space state of storage.
A3BC7875 - F911D22 WNF_OSWN_STORAGE_TEMP_CLEANUP_CHANGE
This event indicates a change in the temp file cleanup state of storage.
A3BCB875 - F911D22 WNF_OSWN_STORAGE_FINISHED_USAGE_CATEGORY_UPDATE
This event indicates completion of an update of storage usage categories.
A3BC5875 - F911D22 WNF_OSWN_SYSTEM_CLOCK_CHANGED
This event informs the system tray that the date-time has changed
A3BCC075 - F911D22 WNF_OSWN_STORAGE_SHELLHWD_EVENT
This event informs StorSvc that SHSVCS received a device handle event.
A3BC8075 - F911D22 WNF_OSWN_STORAGE_APP_PAIRING_CHANGE
This event indicates a change in the app pairing state of an SD card.
A3BC0875 - 11961B3E WNF_SUPP_ENABLE_ERROR_DETAILS_CACHE
Enable the Error Details Cache
A3BC0875 - 41840B3E WNF_SEB_INTERNET_PRESENT
Internet available or not
A3BC1075 - 41840B3E WNF_SEB_FREE_NETWORK_PRESENT
Free network available or not
A3BC1875 - 41840B3E WNF_SEB_SMS_RECEIVED
SMS has been received
A3BC2075 - 41840B3E WNF_SEB_NETWORK_STATE_CHANGES
Network state has changed
A3BC2875 - 41840B3E WNF_SEB_MBAE_NOTIFICATION_RECEIVED
Radio Operator Message received
A3BC3075 - 41840B3E WNF_SEB_NETWORK_CONTROL_CHANNEL_TRIGGER_RESET
Network control channel triggers have been reset
A3BC3875 - 41840B3E WNF_SEB_TIME_ZONE_CHANGE
Time zone change
A3BC4075 - 41840B3E WNF_SEB_ONLINE_ID_CONNECTED_STATE_CHANGE
Online ID connected state changed. SDDL comes from ID_CAP_EVERYONE in %SDXROOT%\src\baseos\prod\packages\WLId\WLId.pkg.xml
A3BC4875 - 41840B3E WNF_SEB_SYSTEM_IDLE
system is idle or not
A3BC5075 - 41840B3E WNF_SEB_BATTERY_LEVEL
System is idle or not
A3BC5875 - 41840B3E WNF_SEB_DOMAIN_JOINED
System is domain joined or not
A3BC6075 - 41840B3E WNF_SEB_BOOT
System has booted
A3BC6875 - 41840B3E WNF_SEB_USER_PRESENT
System has at least 1 user present
A3BC7075 - 41840B3E WNF_SEB_SYSTEM_AC
System is AC or DC
A3BC7875 - 41840B3E WNF_SEB_MONITOR_ON
Monitor is ON or OFF
A3BC8075 - 41840B3E WNF_SEB_IP_ADDRESS_AVAILABLE
IP address is available or not
A3BC8875 - 41840B3E WNF_SEB_BACKGROUND_WORK_COST_CHANGE
Indicate a change in the background work cost
A3BC9075 - 41840B3E WNF_SEB_BACKGROUND_WORK_COST_HIGH
Background work cost is high or not
A3BC9875 - 41840B3E WNF_SEB_SYSTEM_LPE
System is in Low Power Epoch or not
A3BCA075 - 41840B3E WNF_SEB_SMART_CARD_TRANSACTION_NOTIFICATION
Smart card transaction notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
A3BCA875 - 41840B3E WNF_SEB_SYSTEM_MAINTENANCE
System is in good state for maintenance
A3BCB075 - 41840B3E WNF_SEB_GEOLOCATION
Geolocation service should be started
A3BCB875 - 41840B3E WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED
OEM custom notification received
A3BCC075 - 41840B3E WNF_SEB_MOB_OPERATOR_CUSTOM_NOTIFICATION_RECEIVED
MO custom notification received
A3BCC875 - 41840B3E WNF_SEB_CACHED_FILE_UPDATED
Cached file has updated
A3BCD075 - 41840B3E WNF_SEB_SMART_CARD_FIELD_INFO_NOTIFICATION
Smart card field entry/exit notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
A3BCD875 - 41840B3E WNF_SEB_SMART_CARD_HCE_APPLICATION_ACTIVATION_NOTIFICATION
Smart card HCE application activation notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
A3BCE075 - 41840B3E WNF_SEB_DEPRECATED7
Unused notification
A3BCE875 - 41840B3E WNF_SEB_DEPRECATED8
Unused notification
A3BCF075 - 41840B3E WNF_SEB_LOW_LATENCY_POWER_REQUEST
Low-latency power request notification
A3BCF875 - 41840B3E WNF_SEB_RESILIENCY_NOTIFICATION_PHASE
Resiliency phase notification
A3BD0075 - 41840B3E WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK
Fullscreen video playback notification
A3BD0875 - 41840B3E WNF_SEB_NFC_PERF_BOOST
Indicates high-performance boost mode for critical NFC background activity
A3BD1075 - 41840B3E WNF_SEB_APP_LAUNCH_PREFETCH
Indicates app launch pre-fetch phase
A3BD1875 - 41840B3E WNF_SEB_DEPRECATED1
Unused notification
A3BD2075 - 41840B3E WNF_SEB_APP_RESUME
Indicates app resume phase
A3BD2875 - 41840B3E WNF_SEB_DEPRECATED2
Unused notification
A3BD3075 - 41840B3E WNF_SEB_DEPRECATED3
Unused notification
A3BD3875 - 41840B3E WNF_SEB_DEPRECATED4
Unused notification
A3BD4075 - 41840B3E WNF_SEB_DEPRECATED5
Unused notification
A3BD4875 - 41840B3E WNF_SEB_DEPRECATED6
Unused notification
A3BD5075 - 41840B3E WNF_SEB_CALL_STATE_CHANGED
Call state change notification
A3BD5875 - 41840B3E WNF_SEB_VOICEMAIL_CHANGED
Voicemail change notification
A3BD6075 - 41840B3E WNF_SEB_CALL_HISTORY_CHANGED
Call history change notification
A3BD6875 - 41840B3E WNF_SEB_LINE_CHANGED
Phone line change notification
A3BD7075 - 41840B3E WNF_SEB_AIRPLANE_MODE_DISABLED_FOR_EMERGENCY_CALL
Airplane mode disabled for emergency call notification
A3BD7875 - 41840B3E WNF_SEB_MOBILE_BROADBAND_REGISTRATION_STATE_CHANGE
Registration state has changed
A3BD8075 - 41840B3E WNF_SEB_MOBILE_BROADBAND_RADIO_STATE_CHANGE
Radio state has changed
A3BD8875 - 41840B3E WNF_SEB_MOBILE_BROADBAND_PIN_LOCK_STATE_CHANGE
Pin lock state has changed
A3BD9075 - 41840B3E WNF_SEB_MOBILE_BROADBAND_DEVICE_SERVICE_NOTIFICATION
Device service command has been received
A3BD9875 - 41840B3E WNF_SEB_DEFAULT_SIGN_IN_ACCOUNT_CHANGE
Default Sign In account has changed
A3BDA075 - 41840B3E WNF_SEB_NETWORK_CONNECTIVITY_IN_STANDBY
Network connectivity in Standby
A3BDA875 - 41840B3E WNF_SEB_USER_PRESENCE_CHANGED
User presence changed
A3BDB075 - 41840B3E WNF_SEB_AUDIO_ACTIVITY
Audio activity in progress
A3BDB875 - 41840B3E WNF_SEB_FULL_SCREEN_HDR_VIDEO_PLAYBACK
Fullscreen HDR video playback notification
A3BDC075 - 41840B3E WNF_SEB_UWP_APP_LAUNCH
Indicates UWP app launch phase
A3BC0835 - 418F1E3E WNF_SPI_LOGICALDPIOVERRIDE
Signals a change caused by SystemParametersInfo(SPI_SETLOGICALDPIOVERRIDE). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC0835 - F850339 WNF_TMCN_ISTABLETMODE
The computer has changed density mode. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC0875 - C870B39 WNF_TEAM_SHELL_HOTKEY_PRESSED
Indicates a hotkey was pressed
A3BE0875 - 418A0B39 WNF_TEL_STORAGE_CAPACITY
This is fired every time an SENSE's storage fullness crosses into a new tier or is reset. struct { DWORD PercentageFull[4]; }
A3BE1075 - 418A0B39 WNF_TEL_DAILY_UPLOAD_QUOTA
This is fired every time an SENSE's daily upload quota crosses into a new tier or is reset. struct { DWORD PercentageFull; }
A3BE1875 - 418A0B39 WNF_TEL_ONESETTINGS_UPDATED
This is fired every time a onesettings namespace is updated. {UINT64 SettingsCount; struct {UINT64 NamespaceHash; UINT64 TimeLastChanged;}[16]}
A3BE2075 - 418A0B39 WNF_TEL_SETTINGS_PUSH_NOTIFICATION_RECEIVED
This is fired every time a push notification is received from the OneSettings service. UTF8 string.
A3BE2875 - 418A0B39 WNF_TEL_TIMER_RECONFIGURED
This is fired every time a UTC service timer changes its configuration values so subscribers can call GetTimerConfiguration to check any new values.
A3BC2875 - 4188063D WNF_PHN_CALL_STATUS
Bitmask containing the current relevant call states. Any 3rd party app is allowed to listen to this. See PhoneWnf.h for valid values. SID referenced below is that of the Phone service.
A3BC3075 - 4188063D WNF_PHN_CALLFORWARDING_STATUS_LINE0
Bitmask containing the call forwarding state for phone line 0. See PhoneWnf.h for valid values. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC3875 - 1188063D WNF_PHNP_SERVICE_INITIALIZED
BOOL indicating whether the Phone service has been initialized. SDDL comes from phoneCall and ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%%\src\src\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC4075 - 1188063D WNF_PHNP_SIMSEC_READY
BOOL indicating whether SimSec is ready to receive requests. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml
A3BC4875 - 1188063D WNF_PHNP_ANNOTATION_ENDPOINT
Wide string indicating the call annotation provider's RPC endpoint name. SDDL comes from ID_CAP_CALLMESSAGING_FILTER and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC4075 - D88063D WNF_PHNL_LINE1_READY
BOOL indicating whether the line is ready. SDDL comes from PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC0875 - 9920B39 WNF_TETH_TETHERING_STATE
State name for the Tethering service notification of all state changes
A3BC1075 - 9920B39 WNF_TETH_AUTOSTART_BLUETOOTH
State name for starting Tethering service over Bluetooth
A3BC0875 - 41830324 WNF_IME_INPUT_MODE_LABEL
Input Mode Indicator label IME want to show on systray. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
A3BC1035 - 41830324 WNF_IME_EXPLICIT_PRIVATE_MODE
Explicit IME private mode status. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
A3BC0875 - 48B0639 WNF_THME_THEME_CHANGED
Notifies when the theme of the system changes
A3BC0875 - 41C61439 WNF_TZ_LEGACY_STORE_CHANGED
Time Zone Legacy store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC1075 - 41C61439 WNF_TZ_STORE_CHANGED
Time Zone store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC1875 - 41C61439 WNF_TZ_TIMEZONE_CHANGED
This state is notified when the timezone is changed via SetTimeZoneInformationByID - The data value is a UINT that indicates the new TZID. SDDL comes from ID_CAP_BUILTIN_SETTIME, ID_CAP_EVERYONE and tzautoupdate in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
A3BC0875 - 4960139 WNF_TOPE_INP_POINTER_DEVICE_ACTIVITY
Touch Event
A3BC0835 - F840539 WNF_TKBN_KEYBOARD_VISIBILITY
The touch keyboard's appearance on the screen has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC1035 - F840539 WNF_TKBN_RESTRICTED_KEYBOARD_VISIBILITY
The restricted mode touch keyboard's appearance on the screen has changed.
A3BC1835 - F840539 WNF_TKBN_IMMERSIVE_FOCUS_TRACKING
An immersive application has encountered a focus change. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC2035 - F840539 WNF_TKBN_TOUCH_EVENT
An application encountered a touch down/up event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC2835 - F840539 WNF_TKBN_RESTRICTED_TOUCH_EVENT
An application encountered a touch down/up event
A3BC3035 - F840539 WNF_TKBN_LANGUAGE
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC3835 - F840539 WNF_TKBN_FOREGROUND_WINDOW
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC4035 - F840539 WNF_TKBN_CARET_TRACKING
Caret tracking has updated on the desktop. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC4835 - F840539 WNF_TKBN_AUTOCOMPLETE
The autocomplete window has been updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC5035 - F840539 WNF_TKBN_MODERN_KEYBOARD_FOCUS_TRACKING
Determines whether focus is in an editable field for the purposes of the modern keyboard. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC5835 - F840539 WNF_TKBN_KEYBOARD_VIEW_CHANGE
The view being shown by the touch keyboard has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC6035 - F840539 WNF_TKBN_RESTRICTED_KEYBOARD_VIEW_CHANGE
The view being shown by the restricted mode touch keyboard has changed.
A3BC6835 - F840539 WNF_TKBN_KEYBOARD_GESTURE
The keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC7035 - F840539 WNF_TKBN_RESTRICTED_KEYBOARD_GESTURE
The restricted keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact.
A3BC7835 - F840539 WNF_TKBN_CANDIDATE_WINDOW_STATE
The candidate window state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC8035 - F840539 WNF_TKBN_KEYBOARD_LAYOUT_CHANGE
The layout being shown by the touch keyboard has changed.
A3BC8835 - F840539 WNF_TKBN_RESTRICTED_KEYBOARD_LAYOUT_CHANGE
The layout being shown by the restricted mode touch keyboard has changed.
A3BC9035 - F840539 WNF_TKBN_COMPOSITION_STATE
The composition state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC9835 - F840539 WNF_TKBN_SYSTEM_IMMERSIVE_FOCUS_TRACKING
A System Mode Application(Logon/OOBE) has encountered a focus change
A3BCA035 - F840539 WNF_TKBN_SYSTEM_TOUCH_EVENT
A System Mode application(Logon/OOBE) encountered a touch down/up event
A3BCA835 - F840539 WNF_TKBN_INPUT_PANE_DISPLAY_POLICY
The edit control in focus has changed the input pane display policy (manual/automatic). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BCB035 - F840539 WNF_TKBN_DESKTOP_MODE_AUTO_IHM
The system is in desktop mode but the user prefers tablet-mode IHM behavior. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BCB835 - F840539 WNF_TKBN_KEYBOARD_SET_VISIBLE
The touch keyboard should show or hide. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BCC035 - F840539 WNF_TKBN_KEYBOARD_SET_VISIBLE_NOTIFICATION
Update the show/hide status of touch keyboard that is being tracked in tabtip. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC08F5 - 13840539 WNF_TKBR_CHANGE_SYSTEM
This state name is used to notify system components about state changes in the Token Broker
A3BC1075 - 13840539 WNF_TKBR_CHANGE_APP
This state name is used to notify apps about state changes in the Token Broker
A3BC18F5 - 13840539 WNF_TKBR_CHANGE_APP_INTERNAL
This state name is used to notify apps about state changes in the Token Broker
A3BC0875 - 418B1E39 WNF_TPM_OWNERSHIP_TAKEN
This event signals when the Win32_TPM provider has completed taking ownership of the TPM.
A3BC1075 - 418B1E39 WNF_TPM_DEVICEID_STATE
This event signals the state of the TPM-based DeviceID.
A3BC1875 - 418B1E39 WNF_TPM_PROVISION_TRIGGER
This event triggers the TPM provisioning/status check to run.
A3BC2075 - 418B1E39 WNF_TPM_CLEAR_PENDING
This event signals a TPM Clear will be attempted.
A3BC2875 - 418B1E39 WNF_TPM_CLEAR_RESULT
This event signals if ownership was taken during TPM Provisioning and the result of TPM Clear on last reboot.
A3BC3075 - 418B1E39 WNF_TPM_DISABLE_DEACTIVATE_PENDING
This event signals a TPM Disable or TPM Deactivate will be attempted.
A3BC3875 - 418B1E39 WNF_TPM_ENABLE_ACTIVATE_COMPLETED
This event signals after the TPM is Enabled or Activated.
A3BC0875 - C960C38 WNF_UBPM_POWER_SOURCE
The machine power source state
A3BC1075 - C960C38 WNF_UBPM_CONSOLE_MONITOR
The machine console monitor on/off state
A3BC1875 - C960C38 WNF_UBPM_FRMU_ALLOWED
The user is present and machine is on batteries and the battery level is above firmware update thershold
A3BC2075 - C960C38 WNF_UBPM_PRESHUTDOWN_PHASE
The machine entered pre shutdown phase
A3BC0875 - 7820338 WNF_UMDF_WUDFSVC_START
Trigger the Driver Manager service start
A3BC0875 - 41891D38 WNF_USO_STATE_CHANGE
Signals that a state transition occurred for an update session.
A3BC1075 - 41891D38 WNF_USO_STATE_ATTENTION_REQUIRED
Signals that a state encounter a condition that requires attention.
A3BC1875 - 41891D38 WNF_USO_UPDATE_PROGRESS
Signals the a change in progess of an update session.
A3BC2075 - 41891D38 WNF_USO_REBOOT_REQUIRED
Signals that a reboot is required to complete the update session.
A3BC2875 - 41891D38 WNF_USO_ACTIVE_SESSION
Signals that the current active session is changed.
A3BC3075 - 41891D38 WNF_USO_UPDATE_SUCCEEDED
Signals that updates have installed successfully on lite servicing stack.
A3BC3875 - 41891D38 WNF_USO_UPTODATE_STATUS_CHANGED
Signals that the machine's up to date status has changed.
A3BC4075 - 41891D38 WNF_USO_REBOOT_BLOCK_REQUESTED
Signals that USO should not reboot the system.
A3BC4875 - 41891D38 WNF_USO_DOWNLOAD_STARTED
Signals that update download has started on lite servicing stack.
A3BC5075 - 41891D38 WNF_USO_INSTALL_STARTED
Signals that update install has started on lite servicing stack.
A3BC0875 - 15850729 WNF_DICT_CONTENT_CHANGED
The content of a user dictionary has changed (word either added or removed). SDDL SID's come from capability ID_CAP_INPUT_CORE (both application and service SID's), and DefAppsCapabilitiesGroup
A3BC0835 - 13810338 WNF_UMGR_SIHOST_READY
Shell Infrastructure host is ready.
A3BC1075 - 13810338 WNF_UMGR_USER_LOGIN
The user was logged in to the system.
A3BC1875 - 13810338 WNF_UMGR_USER_LOGOUT
The user was logged out of the system.
A3BC2075 - 13810338 WNF_UMGR_SYSTEM_USER_CONTEXT_CHANGED
Default system user, as defined by start view, has changed.
A3BC2875 - 13810338 WNF_UMGR_SESSIONUSER_TOKEN_CHANGE
Token for the session user changed.
A3BC3035 - 13810338 WNF_UMGR_SESSION_ACTIVE_SHELL_USER_CHANGE
Session active shell user changed.
A3BC3875 - 13810338 WNF_UMGR_USER_TILE_CHANGED
The user tile for the specified SID was changed. The payload is the String user sid and the datasize is the byte count of MAX_PATH.
A3BC0875 - 41880F3B WNF_VAN_VANUI_STATUS
The VAN UI open close status
A3BC0875 - 41881E3B WNF_VPN_CLIENT_CONNECTIVITY_STATUS
The VPN Client connectivity status
A3BC0875 - 418B0D3A WNF_WCM_INTERFACE_LIST
This event signals when a WCM-managed network interface has been added or removed. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC1075 - 418B0D3A WNF_WCM_SERVICE_STATUS
Connection Manager service restart. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC1875 - 418B0D3A WNF_WCM_MAPPING_POLICY_UPDATED
WNF state for refreshing WCM service mapping policies cache
A3BC2075 - 418B0D3A WNF_WCM_PROFILE_CONFIG_UPDATED
WNF state for refreshing WCM's selection multiplex table and selectable connection list
A3BC1075 - 1583002E WNF_CNET_DPU_GLOBAL_STATE_OVER_LIMIT
the data of this state is 1 when the global data usage state is less than or equal to OVER_LIMIT, otherwise it is 0
A3BC1875 - 1583002E WNF_CNET_DPU_GLOBAL_STATE_OFF_TRACK
the data of this state is 1 when the global data usage state is less than or equal to OFF_TRACK, otherwise it is 0
A3BC2075 - 1583002E WNF_CNET_DPU_GLOBAL_STATE_ON_TRACK
the data of this state is 1 when the global data usage state is less than or equal to ON_TRACK, otherwise it is 0
A3BC2875 - 1583002E WNF_CNET_DPU_GLOBAL_STATE_UNDER_TRACK
the data of this state is 1 when the global data usage state is less than or equal to UNDER_TRACK, otherwise it is 0
A3BC3075 - 1583002E WNF_CNET_DPU_GLOBAL_STATE_NOT_TRACKED
the data of this state is 1 when the global data usage state is less than or equal to NOT_TRACKED, otherwise it is 0
A3BC4875 - 1583002E WNF_CNET_CELLULAR_CONNECTIONS_AVAILABLE
State name for Cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC5075 - 1583002E WNF_CNET_NON_CELLULAR_CONNECTIONS_AVAILABLE
State name for Non-cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC6875 - 1583002E WNF_CNET_NON_CELLULAR_CONNECTED
The state is 1 when a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC7075 - 1583002E WNF_CNET_RADIO_ACTIVITY_OR_NON_CELLULAR_CONNECTED
The state is 1 when Radio is active or a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC0875 - C951B29 WNF_DUSM_TASK_TOAST
Trigger task scheduler to launch task for toast
A3BC0875 - 41940B3A WNF_WER_SERVICE_START
The WER service needs to start. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
A3BC1075 - 41940B3A WNF_WER_QUEUED_REPORTS
The number of reports queued to the machine store. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
A3BC1875 - 41940B3A WNF_WER_CRASH_STATE
Information about applications currently crashing.
A3BC0875 - 880073A WNF_WIFI_CONNECTION_STATUS
State name for Wifi radio and connection status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC1075 - 880073A WNF_WIFI_CPL_STATUS
State name for Wifi CPL status flags
A3BC2075 - 880073A WNF_WIFI_SERVICE_NOTIFICATIONS
Notifications received from the WiFi Conn Svc. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC2875 - 880073A WNF_WIFI_HOTSPOT_HOST_READY
State name for Wifi Hotspot Host ready flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC4875 - 880073A WNF_WIFI_AOAC_STATUS
State name for Wifi power status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC5875 - 880073A WNF_WIFI_CONNECTION_SCORE
State name for Wifi connection status and connection score updates
A3BC6075 - 880073A WNF_WIFI_TILE_UPDATE
State name for Wifi network tiles updated. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC6875 - 880073A WNF_WIFI_AVERAGE_TRANSMIT
Average peak transmitted traffic seen by NCSI
A3BC7075 - 880073A WNF_WIFI_MEDIA_STREAMING_MODE
Last media streaming mode state change
A3BC7875 - 880073A WNF_WIFI_TASK_TRIGGER
State name triggering WiFiNetworkManager background task. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC8075 - 880073A WNF_WIFI_L3_AUTH_STATE
State for triggering browser UI when a network is hijacked. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
A3BC8875 - 880073A WNF_WIFI_WLANSVC_NOTIFICATION
This event sends notifications from wlansvc
A3BC9075 - 880073A WNF_WIFI_HOTSPOT2_REGISTRATION_STATUS
State name for triggering hotspot2 registration status from online signup server
A3BC0C75 - 418A073A WNF_WIL_FEATURE_STORE
Event indicating the Normal feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
A3BC1475 - 418A073A WNF_WIL_BOOT_FEATURE_STORE
Event indicating the Boot feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
A3BC1C75 - 418A073A WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_1
Event to indicate the first use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC2475 - 418A073A WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_2
Event to indicate the first use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC2C75 - 418A073A WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_3
Event to indicate the first use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC3475 - 418A073A WNF_WIL_FEATURE_USAGE_TRACKING_1
Event to indicate unique use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC3C75 - 418A073A WNF_WIL_FEATURE_USAGE_TRACKING_2
Event to indicate unique use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC4475 - 418A073A WNF_WIL_FEATURE_USAGE_TRACKING_3
Event to indicate unique use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC4C75 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_1
Event to indicate uniquely observed code failures on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC5475 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_2
Event to indicate uniquely observed code failures on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC5C75 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_3
Event to indicate uniquely observed code failures on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC6475 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_4
Event to indicate uniquely observed code failures on this device (4). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC6C75 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_5
Event to indicate uniquely observed code failures on this device (5). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC7475 - 418A073A WNF_WIL_FEATURE_HEALTH_TRACKING_6
Event to indicate uniquely observed code failures on this device (6). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC7C75 - 418A073A WNF_WIL_MACHINE_FEATURE_STORE
Event indicates modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC8075 - 418A073A WNF_WIL_MACHINE_FEATURE_STORE_MODIFIED
Event fires once per boot on modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC88F5 - 418A073A WNF_WIL_USER_FEATURE_STORE
Event indicates modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC90F5 - 418A073A WNF_WIL_USER_FEATURE_STORE_MODIFIED
Event fires once per user session on modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A3BC0875 - 41921C3E WNF_SRT_WINRE_CONFIGURATION_CHANGE
Triggered each time there is a configuration change in WinRE
A3BC0875 - 13891A3E WNF_STOR_CONFIGURATION_DEVICE_INFO_UPDATED
This WNF event fires when the OEM, MO, and Device Hardware values change in the registry.
A3BC1075 - 13891A3E WNF_STOR_CONFIGURATION_MO_TASK_RUNNING
This WNF event fires when the MO discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
A3BC1875 - 13891A3E WNF_STOR_CONFIGURATION_OEM_TASK_RUNNING
This WNF event fires when the OEM discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
A3BC08F5 - 41871B3A WNF_WUA_NUM_PER_USER_UPDATES
State stores the number of per-user updates for the current user
A3BC1075 - 41871B3A WNF_WUA_AU_SCAN_COMPLETE
Triggered each time an AU scan is completed
A3BC1875 - 41871B3A WNF_WUA_CALL_HANG
State stores information regarding WU call hangs
A3BC2075 - 41871B3A WNF_WUA_SERVICE_HANG
State stores information regarding WU service hangs
A3BC2875 - 41871B3A WNF_WUA_STAGEUPDATE_DETAILS
Triggered when a StageUpdate call has completed for a phone update installation.
A3BC0875 - 1192063A WNF_WHTP_WINHTTP_PROXY_DISCOVERED
A network proxy has been discovered. WinHttpAutoProxySvc can write, NlaSvc can read.
A3BC1075 - 1192063A WNF_WHTP_WINHTTP_PROXY_AUTHENTICATION_REQUIRED
A proxy has returned a 407 status code.
A3BC0875 - C971D3A WNF_WSQM_IS_OPTED_IN
Mirrors the state of CEIPEnable and CEIPSampledIn registry settings.
A3BC0875 - 4195003A WNF_WNS_CONNECTIVITY_STATUS
The WNS Connection Provider connectivity status
A3BC0875 - 4180013A WNF_WOF_OVERLAY_CONFIGURATION_CHANGE
Overlay configuration change
A3BC0835 - 4194063E WNF_SHR_SHARING_CHANGED
System sharing status changed
A3BC1075 - 4194063E WNF_SHR_DHCP_IPv4_LEASE_LIST
ICS DHCP IPv4 lease list changed
A3BC1875 - 4194063E WNF_SHR_DHCP_IPv4_FASTIP_ADDRS
New assigned Fast-IP Address(es)
A3BC0875 - 41901D26 WNF_KSV_STREAMSTATE
This is the current stream state of a camera for a process in a given session
A3BC1075 - 41901D26 WNF_KSV_DEVICESTATE
This is the current device state
A3BC0875 - 41C60C39 WNF_TB_SYSTEM_TIME_CHANGED
Time Broker has finished processing a change ot time
A3BC0835 - 418B0A38 WNF_UDM_SERVICE_INITIALIZED
BOOL + UserContextToken indicating whether the UserDataService service has been initialized for the specified user. On OneCore, SDDL gives read access to callers with userDataSystem and all access to IU/AU/System. On phone, SDDL comes from ID_CAP_APPOINTMENTS, ID_CAP_COMMS_COMMON, ID_CAP_CONTACTS, ID_CAP_EVERYONE, ID_CAP_PLATFORM_EXTENSIBILITY, UserDataSvc and ID_CAP_SMS in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC2835 - 41870A38 WNF_UDA_CONTACT_SORT_CHANGED
State name for aggregate sort and display order changes. SDDL comes from ID_CAP_COMMS_APPLICATIONS and ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
A3BC0875 - 19890C35 WNF_XBOX_APPLICATION_CONTEXT_CHANGED
The application specific context has changed in steady state.
A3BC1075 - 19890C35 WNF_XBOX_APPLICATION_FOCUS_CHANGED
The currently focused application has changed.
A3BC1875 - 19890C35 WNF_XBOX_APPLICATION_ACTIVATING
An application is activating.
A3BC2875 - 19890C35 WNF_XBOX_SHELL_TOAST_NOTIFICATION
A new toast notification has been delivered to the shell.
A3BC3075 - 19890C35 WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_LAUNCH
A package is about to be unmounted from the System OS ready to launch it on the Title OS.
A3BC3875 - 19890C35 WNF_XBOX_PACKAGE_INSTALL_STATE_CHANGED
A new application package has been added or an existing one has been removed.
A3BC4875 - 19890C35 WNF_XBOX_GLOBALIZATION_SETTING_CHANGED
An application package has been removed.
A3BC5075 - 19890C35 WNF_XBOX_APPLICATION_NO_LONGER_RUNNING
An application is no longer running.
A3BC5875 - 19890C35 WNF_XBOX_AUTOPLAY_CONTENT_DETECTED
An optical disc or other media has been detected with content.
A3BC6075 - 19890C35 WNF_XBOX_APPLICATION_ERROR
Application error handler
A3BC6875 - 19890C35 WNF_XBOX_STORAGE_ERROR
Handler for achievement cache and game save storage
A3BC7075 - 19890C35 WNF_XBOX_LIVE_CONNECTIVITY_CHANGED
Connectivity to the Xbox LIVE service has changed.
A3BC7875 - 19890C35 WNF_XBOX_SYSTEM_TITLE_AUTH_STATUS_CHANGED
System Title Authentication status has changed.
A3BC8075 - 19890C35 WNF_XBOX_ACHIEVEMENTS_RAW_NOTIFICATION_RECEIVED
A new achievements-related raw notifications was received.
A3BC8875 - 19890C35 WNF_XBOX_ERA_VM_STATUS_CHANGED
ERA VM status has changed.
A3BC9075 - 19890C35 WNF_XBOX_APPLICATION_LAYOUT_CHANGED
One or more application layouts changed.
A3BC9875 - 19890C35 WNF_XBOX_SYSTEM_IDLE_TIMEOUT_CHANGED
System Idle Timeout has changed.
A3BCA075 - 19890C35 WNF_XBOX_SYSTEM_CONSTRAINED_MODE_STATUS_CHANGED
System constrained status has changed.
A3BCD875 - 19890C35 WNF_XBOX_APPLICATION_COM_RESILIENCY_STATUS_CHANGED
Application's COM resiliency status has changed.
A3BCE075 - 19890C35 WNF_XBOX_SYSTEM_USER_CONTEXT_CHANGED
Default system user, as defined by start view, has changed.
A3BCF075 - 19890C35 WNF_XBOX_HOST_STORAGE_CONFIGURATION_CHANGED
A storage device was either plugged or unplugged.
A3BCF875 - 19890C35 WNF_XBOX_EXIT_SILENT_BOOT_MODE
The system is exiting silent boot mode.
A3BD0075 - 19890C35 WNF_XBOX_APPLICATION_LICENSE_CHANGED
The license used by the application has changed.
A3BD0875 - 19890C35 WNF_XBOX_SHELL_INITIALIZED
The system shell is initialized and ready.
A3BD1875 - 19890C35 WNF_XBOX_PASS3_UPDATE_NOTIFICATION
Pass 3 system update has progressed and is sending a notification.
A3BD2075 - 19890C35 WNF_XBOX_MSA_ENVIRONMENT_CONFIGURED
The MSA and WNS environments have been configured to match the XBL environment.
A3BD2875 - 19890C35 WNF_XBOX_SIP_VISIBILITY_CHANGED
The visibility of the Software Input Pane has changed.
A3BD3075 - 19890C35 WNF_XBOX_SYSTEM_GAME_STREAMING_STATE_CHANGED
Game streaming state has changed.
A3BD3875 - 19890C35 WNF_XBOX_SIP_FOCUS_TRANSFER_NOTIFICATION
It is possible to transfer focus away from the Software Input Pane.
A3BD4075 - 19890C35 WNF_XBOX_XAM_SMB_SHARES_INIT_ALLOW_SYSTEM_READY
SMB shares have been launched.
A3BD4875 - 19890C35 WNF_XBOX_XBBLACKBOX_SNAP_NOTIFICATION
A snap of XBBlackbox has occurred
A3BD5075 - 19890C35 WNF_XBOX_SYSTEM_LOW_POWER_MAINTENANCE_WORK_ALLOWED
Maintenance work is allowed in low power mode
A3BD5875 - 19890C35 WNF_XBOX_ERA_TITLE_LAUNCH_NOTIFICATION
ERA launch notification with XBL title info
A3BD6075 - 19890C35 WNF_XBOX_STORAGE_STATUS
Status of attached storage devices
A3BD6875 - 19890C35 WNF_XBOX_STORAGE_CHANGED
A storage device, or its contents, have changed
A3BD7075 - 19890C35 WNF_XBOX_PACKAGE_STREAMING_STATE
Current state of the streaming package
A3BD7875 - 19890C35 WNF_XBOX_STREAMING_QUEUE_CHANGED
The install streaming queue contents have changed
A3BD8075 - 19890C35 WNF_XBOX_QUERY_UPDATE_NOTIFICATION
An update is available for installing content.
A3BD8875 - 19890C35 WNF_XBOX_REPOSITORY_CHANGED
A change has been made to the pre-indexed state repository.
A3BD9075 - 19890C35 WNF_XBOX_LIVETV_TUNER_COUNT_CHANGED
The number of LiveTV tuners connected to the system has changed
A3BD9875 - 19890C35 WNF_XBOX_PACKAGECACHE_CHANGED
A change has been made to the package cache.
A3BDA075 - 19890C35 WNF_XBOX_WPN_PLATFORM_HOST_INITIALIZED
The WPN platform host is initialized and ready.
A3BDA875 - 19890C35 WNF_XBOX_NARRATOR_RECT_CHANGED
The rectangle visual of the Narrator has changed.
A3BDB075 - 19890C35 WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_UNINSTALL
A package is about to be unmounted from the System OS for uninstall.
A3BDB875 - 19890C35 WNF_XBOX_SEND_LTV_COMMAND_REQUESTED
A module requested for an ltv command to be issued.
A3BDC075 - 19890C35 WNF_XBOX_SHELL_DATACACHE_ENTITY_CHANGED
An entity has changed in the shell data cache.
A3BDC875 - 19890C35 WNF_XBOX_CORTANAOVERLAY_VISIBILITY_CHANGED
The visibility of the Cortana Overlay view has changed.
A3BDD075 - 19890C35 WNF_XBOX_NOTIFICATION_UNREAD_COUNT
Number of unread notifications for the current system user.
A3BDD875 - 19890C35 WNF_XBOX_EXTENDED_RESOURCE_MODE_CHANGED
Extended resource mode has been toggled
A3BDE075 - 19890C35 WNF_XBOX_AUTO_SIGNIN_IN_PROGRESS
Indicates whether the shell is in the process of auto-signin. Payload is UINT32 with a 1 or 0.
A3BDE875 - 19890C35 WNF_XBOX_REMOTE_SIGNOUT
A local user has signed out remotely via SPOP.
A3BDF075 - 19890C35 WNF_XBOX_ACCESSIBILITY_NARRATOR_ENABLED
Indicates whether the Narrator is enabled. Payload is UINt32 with 1 (enabled) or 0 (disabled).
A3BDF875 - 19890C35 WNF_XBOX_GLOBAL_SPEECH_INPUT_NOTIFICATION
A global speech command was recognized that translates to a controller button press.
A3BE0075 - 19890C35 WNF_XBOX_APPLICATION_CURRENT_USER_CHANGED
The current user of the application has changed.
A3BE0875 - 19890C35 WNF_XBOX_ERA_VM_INSTANCE_CHANGED
ERA VM Instance has come up or gone down
A3BE1075 - 19890C35 WNF_XBOX_RESET_IDLE_TIMER
Idle monitor timer should be reset due to user activity.
A3BE1875 - 19890C35 WNF_XBOX_CORTANA_TV_GRAMMAR_UPDATE_NOTIFICATION
Notification for when TV grammars for cortana needs rebuilding
A3BE2075 - 19890C35 WNF_XBOX_CORTANA_SIGNEDIN_USERS_GRAMMAR_UPDATE_NOTIFICATION
Notification for when signed in users change results in rebuilding grammars for cortana
A3BE2875 - 19890C35 WNF_XBOX_KINECT_IS_REQUIRED
An application that requires Kinect has connected to the NuiService.
A3BE3075 - 19890C35 WNF_XBOX_ADJUST_SNAP_CPU_AFFINITY
Adjust an app's CPU affinity if in constrained mode
A3BE3875 - 19890C35 WNF_XBOX_VIDEOPLAYER_ACTIVEPLAYER
The active shared video player host has changed.
A3BE4075 - 19890C35 WNF_XBOX_VIDEOPLAYER_PLAYERSTATE
The video player app has changed internal state.
A3BE4875 - 19890C35 WNF_XBOX_VIDEOPLAYER_PLAYBACKPROGRESS
The video player app has changed playback progress.
A3BE5075 - 19890C35 WNF_XBOX_SAFEAREA_SETTING_CHANGED
Indicates whether the safe area setting is enabled. Payload is UINT32 with a 1 or 0.
A3BE5875 - 19890C35 WNF_XBOX_ACTIVE_BACKGROUNDAUDIO_APPLICATION_CHANGED
The application providing audio from the background has changed.
A3BE6075 - 19890C35 WNF_XBOX_KEYBOARD_LOCALE_CHANGED
Indicates that the desired keyboard locale has changed.
A3BE6875 - 19890C35 WNF_XBOX_GAMER_ACCOUNT_CHANGED
The local gamer account has signed in or out. Payload is uint32 representing sessionid
A3BE7075 - 19890C35 WNF_XBOX_ERA_VM_IOPRIORITY_CHANGED
ERA VM IO priority has been changed
A3BE7875 - 19890C35 WNF_XBOX_SPEECH_INPUT_DEVICE
Input device changed for OneCore speech
A3BE8875 - 19890C35 WNF_XBOX_CORTANA_USER_CHANGED_UPDATE_NOTIFICATION
Notification for when the active user of Cortana changes from signing in/out/switching user
A3BE9075 - 19890C35 WNF_XBOX_ACCESSIBILITY_EXCLUSIVE_INPUT_MODE_CHANGED
The exclusive input modality for an accessibility component changed
A3BE9875 - 19890C35 WNF_XBOX_PROACTIVE_NOTIFICATION_TRIGGERED
Proactive notification service is triggered
A3BEA075 - 19890C35 WNF_XBOX_ACHIEVEMENT_TRACKER_STATE_CHANGED
Notification for when the Achievement Tracker's state should change
A3BEA875 - 19890C35 WNF_XBOX_GUIDE_DIRECT_ACTIVATION
Event to trigger direct activation of xbox guide when nexus is pressed
A3BEB075 - 19890C35 WNF_XBOX_TITLE_SPOP_VETO_RECEIVED
A title SPOP veto has been received.
A3BEB875 - 19890C35 WNF_XBOX_LIBRARY_RAW_NOTIFICATION_RECEIVED
A new library-related raw notifications was received.
A3BEC075 - 19890C35 WNF_XBOX_MESSAGING_RAW_NOTIFICATION_RECEIVED
A new messaging-related raw notifications was received.
A3BEC875 - 19890C35 WNF_XBOX_PEOPLE_RAW_NOTIFICATION_RECEIVED
A new people-related raw notifications was received.
A3BED075 - 19890C35 WNF_XBOX_MULTIPLAYER_RAW_NOTIFICATION_RECEIVED
A new multiplayer-related raw notifications was received.
A3BED875 - 19890C35 WNF_XBOX_LIVETV_RAW_NOTIFICATION_RECEIVED
A new live tv-related raw notifications was received.
A3BEE075 - 19890C35 WNF_XBOX_SYSTEMUI_RAW_NOTIFICATION_RECEIVED
A new SystemUI-related raw notifications was received.
A3BEE875 - 19890C35 WNF_XBOX_CLUB_RAW_NOTIFICATION_RECEIVED
A new club-related raw notifications was received.
A3BEF075 - 19890C35 WNF_XBOX_CLUBCHAT_RAW_NOTIFICATION_RECEIVED
A new club chat-related raw notifications was received.
A3BEF875 - 19890C35 WNF_XBOX_SETTINGS_RAW_NOTIFICATION_RECEIVED
A new settings-related raw notifications was received.
A3BF0075 - 19890C35 WNF_XBOX_MEDIA_IS_PLAYING_CHANGED
Notification of whether any media is playing.
A3BF0875 - 19890C35 WNF_XBOX_EXPANDED_RESOURCES_INACTIVE
An expandedResources app has gone inactive.
A3BF1075 - 19890C35 WNF_XBOX_PARENTAL_RESTRICTIONS_CHANGED
The maximum age rating currently permissable has changed.
A3BC0C75 - 41951A38 WNF_UTS_USERS_ENROLLED
Indicates whether there are any enrolled users.
A3BC1475 - 41951A38 WNF_UTS_LOCKSCREEN_DISMISSAL_TRIGGERED
Triggered when the lock screen is dismissed to kick-off trusted signals.
A3BC0875 - 41841D38 WNF_USB_TYPE_C_PARTNER_STATE
This event indicates the state of a USB Type-C connector's partner device.
A3BC1075 - 41841D38 WNF_USB_BILLBOARD_CHANGE
This event indicates that the number of Billboard devices in the system has changed.
A3BC1875 - 41841D38 WNF_USB_PEER_DEVICE_STATE
This is the state of a peer device.
A3BC2075 - 41841D38 WNF_USB_CHARGING_STATE
This event indicates the USB charging state for this Windows device.
A3BC2875 - 41841D38 WNF_USB_FUNCTION_CONTROLLER_STATE
This event indicates the state of a USB function controller, such as detached, or attached, and successfully enumerated with host PC.

↧

ETW private loggers

September 1, 2017, 9:15 am

≫ Next: W32pServiceTable from windows 10 build 16278

≪ Previous: WNF IDs from perf_nt_c.dll

as you know ordinary etw loggers can be checked in compmgmt.msc\performance\data collector sets\event trace sessions
But private etw sessions cannot be showed in compmgmt.msc
Actually all private sessions stored in ntdll!EtwpLoggerArray. This array has size of 0x40 items (see allocation in function EtwpGetNextAvailableLoggerId) and looks like:

EtwpLoggerArray: 000000000524D380
00000000  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000010  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000020  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000030  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000040  80 6D 2B 05-01 00 00 00|01 00 00 00-00 00 00 00  Ђm+.............
00000050  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000060  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000070  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000080  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000090  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
000000A0  01 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................

We have one private logger context here at 0x52B6D80. Size of context is different:

0x228 on w10
0x220 on w8.1
0x210 on w8

also struсt of context is different and can be partially recovered from function EtwpInitLoggerContext:

typedef struct _etw_private_logger_ctx
{
/*  x86   x64 offsets */
#ifdef _WIN64
      /* 0x0  */  DWORD head[14];
#else
/* 0x0  */        DWORD head[12];
#endif /* _WIN64 */
/* 0x30  0x38 */ IID trace_IID;
/* 0x40  0x48 */ PVOID unk1;
/* 0x44  0x50 */ PVOID unk2;
/* 0x48  0x58 */ RTL_CRITICAL_SECTION cs;
/* 0x60  0x80 */ HANDLE handle1;
/* 0x64  0x88 */ HANDLE handle2;
/* 0x68  0x90 */ PVOID unk;
/* 0x6c  0x98 */ UNICODE_STRING name;
/* 0x74  0xa8 */ UNICODE_STRING fname;

// other fields are emitted
} etw_private_logger_ctx, *petw_private_logger_ctx;

sample of output fromSkyDrive:

  logger context at 00000000052B6D80:
00000000  D3 4D 40 D1-36 23 D3 01|D3 4D 40 D1-36 23 D3 01  УM@С6#У.УM@С6#У.
00000010  02 00 00 00-08 00 00 00|C8 0C 00 00-CC 03 00 00  ........И...М...
00000020  00 00 00 00-00 00 12 C0|00 00 0D C0-FF FF 00 00  .......А...Аяя..
00000030  4A 62 0F 9C-76 D2 4D 40|86 7F D0 9F-D2 59 6B 53  Jb.њvТM@†РџТYkS
00000040  01 00 00 00-00 00 00 00|FF FF FF FF-FF FF FF FF  ........яяяяяяяя
00000050  00 00 00 00-00 00 00 00|00 00 00 00-00 00 00 00  ................
00000060  1C 04 00 00-20 04 00 00|24 04 00 00-40 00 42 00  .... ...$...@.B.
00000070  C0 A6 24 05-AE 00 B0 00|08 9D 29 05-00 00 00 00  А¦$.®.°..ќ).....
00000080  00 00 00 00-00 00 00 00|01 00 00 00-00 10 00 00  ................
00000090  B8 0F 00 00-18 00 00 00|02 00 00 00-02 00 00 00  ё...............
000000A0  01 00 00 00-38 00 01 05|38 10 01 05-34 6E 2B 05  ....8...8...4n+.
000000B0  20 10 01 05-20 10 01 05|40 6E 2B 05-40 6E 2B 05   ... ...@n+.@n+.
000000C0  00 00 00 00-4C 6E 2B 05|4C 6E 2B 05-00 00 00 00  ....Ln+.Ln+.....
000000D0  0A 00 00 00-02 08 02 00|01 00 00 00-10 00 00 00  ................
000000E0  01 00 00 00-00 00 00 00|00 00 00 00-00 00 00 00  ................
000000F0  00 10 00 00-00 00 00 00|00 10 00 00-00 00 00 00  ................
00000100  00 00 00 00-00 00 00 00|00 00 00 00-00 00 00 00  ................
00000110  00 00 00 00-00 00 00 00|01 00 00 00-00 00 00 00  ................
00000120  00 00 00 00-00 00 00 00|02 00 00 00-00 00 00 00  ................
00000130  00 00 01 05-00 00 00 00|00 00 00 00-00 00 00 00  ................
00000140  00 00 00 00-00 00 00 00|00 00 00 00-D8 CA 25 05  ............ШК%.
00000150  D8 CA 25 05-D4 6E 2B 05|D4 6E 2B 05-00 00 00 00  ШК%.Фn+.Фn+.....
00000160  00 00 00 00-00 00 00 00|F0 87 25 05-00 00 00 00  ........р‡%.....
00000170  00 00 00 00-00 00 01 05                          ........

   name: Microsoft SkyDrive Trace Session
   fname: C:\Users\redp\AppData\Local\Microsoft\OneDrive\logs\Personal\TraceCurrent.6982.0821.etl
   flags: 20802
   IID: {9C0F624A-D276-404D-867F-D09FD2596B53}

↧

W32pServiceTable from windows 10 build 16278

September 8, 2017, 7:15 am

≫ Next: how to find rpcrt4!GlobalRpcServer

≪ Previous: ETW private loggers

W32pServiceLimit .eq. 0x498

NtUserGetOwnerTransformedMonitorRect
NtUserYieldTask
NtUserSetSensorPresence
NtGdiWidenPath
NtGdiUpdateColors
NtGdiUnrealizeObject
NtGdiUnmapMemFont
NtGdiUnloadPrinterDriver
NtGdiTransparentBlt
NtGdiTransformPoints
NtGdiScaleRgn
NtGdiScaleValues
NtGdiGetDCDpiScaleValue
NtGdiGetBitmapDpiScaleValue
NtGdiEnsureDpiDepDefaultGuiFontForPlateau
NtGdiSwapBuffers
NtGdiStrokePath
NtGdiStrokeAndFillPath
NtGdiStretchDIBitsInternal
NtGdiStretchBlt
NtGdiStartPage
NtGdiStartDoc
NtGdiSetSizeDevice
NtGdiSetVirtualResolution
NtGdiSetTextJustification
NtGdiSetSystemPaletteUse
NtGdiSetRectRgn
NtGdiSetPixelFormat
NtGdiSetPixel
NtGdiSetOPMSigningKeyAndSequenceNumbers
NtGdiSetLayout
NtGdiMirrorWindowOrg
NtGdiGetDeviceWidth
NtGdiSetMiterLimit
NtGdiSetMetaRgn
NtGdiSetMagicColors
NtGdiSetLinkedUFIs
NtGdiSetIcmMode
NtGdiSetFontXform
NtGdiSetFontEnumeration
NtGdiSetDIBitsToDeviceInternal
NtGdiSetDeviceGammaRamp
NtGdiGetGammaRampCapability
NtGdiSetPrivateDeviceGammaRamp
NtGdiGetAppliedDeviceGammaRamp
NtGdiSetColorSpace
NtGdiSetColorAdjustment
NtGdiSetBrushOrg
NtGdiSetBrushAttributes
NtGdiSetBoundsRect
NtGdiSetBitmapDimension
NtGdiSetBitmapBits
NtGdiSetBitmapAttributes
NtGdiSelectPen
NtGdiSelectFont
NtGdiSelectClipPath
NtGdiSelectBrush
NtGdiSelectBitmap
NtGdiScaleWindowExtEx
NtGdiScaleViewportExtEx
NtGdiSaveDC
NtGdiRoundRect
NtGdiRestoreDC
NtGdiResizePalette
NtGdiResetDC
NtGdiRemoveFontMemResourceEx
NtGdiRemoveFontResourceW
NtGdiRectVisible
NtGdiRectInRegion
NtGdiRectangle
NtGdiQueryFontAssocInfo
NtGdiQueryFonts
NtGdiPtVisible
NtGdiPtInRegion
NtGdiPolyTextOutW
NtGdiPolyPolyDraw
NtGdiPolyDraw
NtGdiPlgBlt
NtGdiPathToRegion
NtGdiPolyPatBlt
NtGdiPatBlt
NtGdiOpenDCW
NtGdiOffsetRgn
NtGdiOffsetClipRgn
NtGdiMoveTo
NtGdiMonoBitmap
NtGdiModifyWorldTransform
NtGdiMaskBlt
NtGdiMakeInfoDC
NtGdiMakeFontDir
NtGdiLineTo
NtGdiInvertRgn
NtGdiIntersectClipRect
NtGdiInitSpool
NtGdiInit
NtGdiIcmBrushInfo
NtGdiHfontCreate
NtGdiGradientFill
NtGdiGetWidthTable
NtGdiGetFontUnicodeRanges
NtGdiAddEmbFontToDC
NtGdiChangeGhostFont
NtGdiGetEmbedFonts
NtGdiGetUFIPathname
NtGdiGetEmbUFI
NtGdiGetUFI
NtGdiGetTransform
NtGdiGetTextMetricsW
NtGdiGetTextFaceW
NtGdiGetTextExtentExW
NtGdiGetTextExtent
NtGdiGetTextCharsetInfo
NtGdiGetSystemPaletteUse
NtGdiGetSuggestedOPMProtectedOutputArraySize
NtGdiGetStringBitmapW
NtGdiGetStats
NtGdiGetSpoolMessage
NtGdiGetServerMetaFileBits
NtGdiGetRgnBox
NtGdiGetRegionData
NtGdiGetRealizationInfo
NtGdiGetRasterizerCaps
NtGdiGetRandomRgn
NtGdiGetPixel
NtGdiGetPath
NtGdiGetOutlineTextMetricsInternalW
NtGdiGetOPMRandomNumber
NtGdiGetObjectBitmapHandle
NtGdiGetNearestPaletteIndex
NtGdiGetNearestColor
NtGdiGetMonitorID
NtGdiGetMiterLimit
NtGdiGetLinkedUFIs
NtGdiGetKerningPairs
NtGdiGetOPMInformation
NtGdiGetGlyphOutline
NtGdiGetGlyphIndicesWInternal
NtGdiGetGlyphIndicesW
NtGdiGetFontResourceInfoInternalW
NtGdiGetFontFileInfo
NtGdiGetFontFileData
NtGdiGetFontData
NtGdiGetEudcTimeStampEx
NtGdiGetETM
NtGdiGetEntry
NtGdiGetDIBitsInternal
NtGdiGetDeviceCapsAll
NtGdiGetDeviceGammaRamp
NtGdiGetDeviceCaps
NtGdiGetDCPoint
NtGdiGetDCObject
NtGdiGetDCforBitmap
NtGdiGetDCDword
NtGdiGetCurrentDpiInfo
NtGdiGetCOPPCompatibleOPMInformation
NtGdiGetColorSpaceforBitmap
NtGdiGetColorAdjustment
NtGdiGetCharWidthInfo
NtGdiGetCharWidthW
NtGdiGetCharSet
NtGdiGetCharacterPlacementW
NtGdiGetCharABCWidthsW
NtGdiGetCertificateSize
NtGdiGetCertificate
NtGdiGetCertificateSizeByHandle
NtGdiGetCertificateByHandle
NtGdiGetBoundsRect
NtGdiGetBitmapDimension
NtGdiGetBitmapBits
NtGdiGetAppClipBox
NtGdiGetAndSetDCDword
NtGdiFullscreenControl
NtGdiFrameRgn
NtGdiForceUFIMapping
NtGdiFlush
NtGdiFlattenPath
NtGdiFillRgn
NtGdiFillPath
NtGdiExtTextOutW
NtGdiExtSelectClipRgn
NtGdiExtGetObjectW
NtGdiExtFloodFill
NtGdiExtEscape
NtGdiExtCreateRegion
NtGdiExtCreatePen
NtGdiExcludeClipRect
NtGdiEudcLoadUnloadLink
NtGdiEqualRgn
NtGdiEnumObjects
NtGdiEnumFonts
NtGdiEndPath
NtGdiEndPage
NtGdiEndGdiRendering
NtGdiEndDoc
NtGdiEnableEudc
NtGdiEllipse
NtGdiDrawEscape
NtGdiDoPalette
NtGdiDoBanding
NtGdiGetPerBandInfo
NtGdiDestroyOPMProtectedOutput
NtGdiDescribePixelFormat
NtGdiDeleteObjectApp
NtGdiDeleteColorTransform
NtGdiDeleteColorSpace
NtGdiDeleteClientObj
NtGdiCreateSolidBrush
NtGdiCreateServerMetaFile
NtGdiCreateRoundRectRgn
NtGdiCreateRectRgn
NtGdiCreatePen
NtGdiCreatePatternBrushInternal
NtGdiCreatePaletteInternal
NtGdiCreateOPMProtectedOutputs
NtGdiCreateOPMProtectedOutput
NtGdiCreateMetafileDC
NtGdiCreateHatchBrushInternal
NtGdiCreateHalftonePalette
NtGdiCreateEllipticRgn
NtGdiCreateSessionMappedDIBSection
NtGdiCreateDIBSection
NtGdiCreateDIBitmapInternal
NtGdiCreateDIBBrush
NtGdiCreateCompatibleDC
NtGdiCreateCompatibleBitmap
NtGdiCreateColorTransform
NtGdiCreateColorSpace
NtGdiCreateClientObj
NtGdiCreateBitmapFromDxSurface2
NtGdiCreateBitmapFromDxSurface
NtGdiCreateBitmap
NtGdiConvertMetafileRect
NtGdiConfigureOPMProtectedOutput
NtGdiComputeXformCoefficients
NtGdiCombineTransform
NtGdiCombineRgn
NtGdiColorCorrectPalette
NtGdiClearBrushAttributes
NtGdiClearBitmapAttributes
NtGdiCloseFigure
NtGdiCheckBitmapBits
NtGdiCancelDC
NtGdiBitBlt
NtGdiBeginPath
NtGdiBeginGdiRendering
NtGdiArcInternal
NtGdiFontIsLinked
NtGdiAnyLinkedFonts
NtGdiAngleArc
NtGdiAlphaBlend
NtGdiAddRemoteMMInstanceToDC
NtGdiRemoveMergeFont
NtGdiAddFontMemResourceEx
NtGdiAddRemoteFontToDC
NtGdiAddFontResourceW
NtGdiAbortPath
NtGdiAbortDoc
NtUserDefSetText
NtUserDeferWindowPosAndBand
NtUserDdeInitialize
NtUserCanBrokerForceForeground
NtUserCreateWindowStation
NtUserCreateWindowEx
NtUserCreateLocalMemHandle
NtUserCreateInputContext
NtUserCreateDesktopEx
NtUserCreateCaret
NtUserCreateAcceleratorTable
NtUserCountClipboardFormats
NtUserCopyAcceleratorTable
NtUserConvertMemHandle
NtUserConsoleControl
NtUserCloseWindowStation
NtUserCloseDesktop
NtUserCloseClipboard
NtUserClipCursor
NtUserChildWindowFromPointEx
NtUserCheckMenuItem
NtUserCheckWindowThreadDesktop
NtUserDwmValidateWindow
NtUserCheckAccessForIntegrityLevel
NtUserDisplayConfigSetDeviceInfo
NtUserDisplayConfigGetDeviceInfo
NtUserQueryDisplayConfig
NtUserSetDisplayConfig
NtUserFunctionalizeDisplayConfig
NtUserGetDisplayConfigBufferSizes
NtUserChangeDisplaySettings
NtUserChangeClipboardChain
NtUserCallTwoParam
NtUserCallOneParam
NtUserCallNoParam
NtUserCallNextHookEx
NtUserCallMsgFilter
NtUserCallHwndParamLock
NtUserCallHwndParam
NtUserCallHwndOpt
NtUserCallHwndLock
NtUserCallHwnd
NtUserBroadcastThemeChangeEvent
NtUserBuildPropList
NtUserBuildNameList
NtUserBuildHwndList
NtUserBuildHimcList
NtUserBlockInput
NtUserBitBltSysBmp
NtUserBeginPaint
NtUserAttachThreadInput
NtUserAssociateInputContext
NtUserAlterWindowStyle
NtUserAddClipboardFormatListener
NtUserActivateKeyboardLayout
NtUserDelegateCapturePointers
NtUserDelegateInput
NtUserDispatchMessage
NtUserDisableProcessWindowFiltering
NtUserDisableThreadIme
NtUserDestroyWindow
NtUserDestroyMenu
NtUserDestroyInputContext
NtUserDestroyCursor
NtUserDestroyAcceleratorTable
NtUserDeleteMenu
NtUserDoSoundDisconnect
NtUserDoSoundConnect
NtUserGhostWindowFromHungWindow
NtUserGetWOWClass
NtUserGetWindowPlacement
NtUserGetWindowDisplayAffinity
NtUserGetWindowDC
NtUserGetWindowCompositionAttribute
NtUserGetWindowCompositionInfo
NtUserGetWindowBand
NtUserGetUpdateRgn
NtUserGetUpdateRect
NtUserGetUpdatedClipboardFormats
NtUserGetTopLevelWindow
NtUserGetTitleBarInfo
NtUserGetThreadState
NtUserGetThreadDesktop
NtUserGetSystemMenu
NtUserGetScrollBarInfo
NtUserGetRegisteredRawInputDevices
NtUserGetRawInputDeviceList
NtUserGetRawInputDeviceInfo
NtUserGetRawInputData
NtUserGetRawInputBuffer
NtUserGetActiveProcessesDpis
NtUserGetDpiForCurrentProcess
NtUserGetProcessDpiAwarenessContext
NtUserGetProcessWindowStation
NtUserGetPriorityClipboardFormat
NtUserGetOpenClipboardWindow
NtUserGetObjectInformation
NtUserGetMouseMovePointsEx
NtUserGetMessage
NtUserGetMenuItemRect
NtUserGetMenuIndex
NtUserGetMenuBarInfo
NtUserGetListBoxInfo
NtUserGetKeyState
NtUserGetKeyNameText
NtUserGetKeyboardState
NtUserGetKeyboardLayoutName
NtUserGetKeyboardLayoutList
NtUserGetInternalWindowPos
NtUserGetInputLocaleInfo
NtUserGetImeInfoEx
NtUserGetImeHotKey
NtUserGetIconSize
NtUserGetIconInfo
NtUserGetGUIThreadInfo
NtUserGetGuiResources
NtUserGetForegroundWindow
NtUserGetDoubleClickTime
NtUserGetDesktopID
NtUserGetDCEx
NtUserGetDC
NtUserGetCursorInfo
NtUserGetCursorFrameInfo
NtUserGetCurrentInputMessageSource
NtUserGetCIMSSM
NtUserGetCPD
NtUserGetControlColor
NtUserGetControlBrush
NtUserGetComboBoxInfo
NtUserGetClipCursor
NtUserGetClipboardViewer
NtUserGetClipboardSequenceNumber
NtUserGetClipboardOwner
NtUserGetClipboardFormatName
NtUserGetClipboardData
NtUserGetClassName
NtUserGetClassInfoEx
NtUserGetCaretPos
NtUserGetCaretBlinkTime
NtUserGetAtomName
NtUserGetAsyncKeyState
NtUserGetAppImeLevel
NtUserGetAncestor
NtUserGetAltTabInfo
NtUserFrostCrashedWindow
NtUserFlashWindowEx
NtUserFindWindowEx
NtUserFindExistingCursorIcon
NtUserFillWindow
NtUserExcludeUpdateRgn
NtUserEvent
NtUserEnumDisplaySettings
NtUserEnumDisplayMonitors
NtUserEnumDisplayDevices
NtUserEndPaint
NtUserEndMenu
NtUserEndDeferWindowPosEx
NtUserEnableScrollBar
NtUserEnableMenuItem
NtUserEmptyClipboard
NtUserDrawMenuBarTemp
NtUserDrawIconEx
NtUserDrawCaptionTemp
NtUserDrawCaption
NtUserDrawAnimatedRects
NtUserDragObject
NtUserDragDetect
NtUserHandleDelegatedInput
NtUserInheritWindowMonitor
NtUserRealChildWindowFromPoint
NtUserQueryWindow
NtUserQuerySendMessage
NtUserQueryInputContext
NtUserQueryInformationThread
NtUserQueryBSDRWindow
NtUserPerMonitorDPIPhysicalToLogicalPoint
NtUserProcessConnect
NtUserPrintWindow
NtUserPostThreadMessage
NtUserPostMessage
NtUserPhysicalToLogicalPoint
NtUserPeekMessage
NtUserPaintMonitor
NtUserPaintDesktop
NtUserOpenWindowStation
NtUserOpenThreadDesktop
NtUserOpenInputDesktop
NtUserOpenDesktop
NtUserOpenClipboard
NtUserNotifyWinEvent
NtUserNotifyProcessCreate
NtUserNotifyIMEStatus
NtUserMoveWindow
NtUserModifyUserStartupInfoFlags
NtUserMNDragOver
NtUserMNDragLeave
NtUserMinMaximize
NtUserMessageCall
NtUserMenuItemFromPoint
NtUserMapVirtualKeyEx
NtUserLayoutCompleted
NtUserLogicalToPerMonitorDPIPhysicalPoint
NtUserLogicalToPhysicalPoint
NtUserLockCursor
NtUserLockWorkStation
NtUserLockWindowUpdate
NtUserLockWindowStation
NtUserLoadKeyboardLayoutEx
NtUserKillTimer
NtUserIsTopLevelWindow
NtUserIsClipboardFormatAvailable
NtUserInvalidateRgn
NtUserInvalidateRect
NtUserInternalGetWindowIcon
NtUserInternalGetWindowText
NtUserInitTask
NtUserInitializeClientPfnArrays
NtUserInitialize
NtUserImpersonateDdeClientWindow
NtUserHungWindowFromGhostWindow
NtUserHiliteMenuItem
NtUserHideCaret
NtUserHardErrorControl
NtUserRealInternalGetMessage
NtUserRealWaitMessageEx
NtUserReleaseDwmHitTestWaiters
NtUserReleaseDC
NtUserTranslateMessage
NtUserTranslateAccelerator
NtUserPaintMenuBar
NtUserCalcMenuBar
NtUserCalculatePopupWindowPosition
NtUserTrackPopupMenuEx
NtUserTrackMouseEvent
NtUserToUnicodeEx
NtUserThunkedMenuItemInfo
NtUserThunkedMenuInfo
NtUserTestForInteractiveUser
NtUserSendEventMessage
NtUserSystemParametersInfo
NtUserSystemParametersInfoForDpi
NtUserSwitchDesktop
NtUserSoundSentry
NtUserShutdownReasonDestroy
NtUserShutdownBlockReasonQuery
NtUserShutdownBlockReasonCreate
NtUserShowWindowAsync
NtUserShowWindow
NtUserShowScrollBar
NtUserShowCaret
NtUserShowCursor
NtUserSetWinEventHook
NtUserSetWindowWord
NtUserSetWindowStationUser
NtUserSetWindowsHookEx
NtUserSetWindowsHookAW
NtUserSetWindowRgnEx
NtUserGetWindowRgnEx
NtUserSetWindowRgn
NtUserSetWindowPos
NtUserSetWindowPlacement
NtUserSetWindowLong
NtUserSetWindowFNID
NtUserSetWindowDisplayAffinity
NtUserSetWindowCompositionTransition
NtUserUpdateDefaultDesktopThumbnail
NtUserSetWindowCompositionAttribute
NtUserSetWindowBand
NtUserSetProcessUIAccessZorder
NtUserSetProcessDpiAwarenessContext
NtUserEnableChildWindowDpiMessage
NtUserIsChildWindowDpiMessageEnabled
NtUserEnableNonClientDpiScaling
NtUserIsNonClientDpiScalingEnabled
NtUserSetDialogControlDpiChangeBehavior
NtUserIsWindowBroadcastingDpiToChildren
NtUserEnableWindowGDIScaledDpiMessage
NtUserIsWindowGDIScaledDpiMessageEnabled
NtUserSetTargetForResourceBrokering
NtUserSetTimer
NtUserSetThreadState
NtUserSetThreadLayoutHandles
NtUserSetThreadDesktop
NtUserSetThreadInputBlocked
NtUserSetSystemTimer
NtUserSetSystemMenu
NtUserSetSystemCursor
NtUserSetSysColors
NtUserSetShellWindowEx
NtUserSetScrollInfo
NtUserSetProp
NtUserGetProp
NtUserSetProcessWindowStation
NtUserSetParent
NtUserSetObjectInformation
NtUserSetMenuFlagRtoL
NtUserSetMenuDefaultItem
NtUserSetMenuContextHelpId
NtUserSetMenu
NtUserSetKeyboardState
NtUserSetInternalWindowPos
NtUserSetInformationThread
NtUserSetImeOwnerWindow
NtUserSetImeInfoEx
NtUserSetImeHotKey
NtUserSetFocus
NtUserSetCursorIconData
NtUserSetCursorContents
NtUserSetCursor
NtUserSetCursorPos
NtUserSetClipboardViewer
NtUserSetClipboardData
NtUserSetClassWord
NtUserSetClassLong
NtUserSetChildWindowNoActivate
NtUserSetCapture
NtUserSetAppImeLevel
NtUserSetActiveWindow
NtUserSendInput
NtUserSelectPalette
NtUserScrollWindowEx
NtUserScrollDC
NtUserSBGetParms
NtUserResolveDesktopForWOW
NtUserRemoveProp
NtUserRemoveMenu
NtUserRemoveClipboardFormatListener
NtUserRegisterWindowMessage
NtUserRegisterTasklist
NtUserRegisterServicesProcess
NtUserRegisterRawInputDevices
NtUserRegisterHotKey
NtUserRegisterDManipHook
NtUserGetDManipHookInitFunction
NtUserRegisterManipulationThread
NtUserSetManipulationInputTarget
NtUserStopAndEndInertia
NtUserRegisterUserApiHook
NtUserRegisterErrorReportingDialog
NtUserRegisterClassExWOW
NtUserRegisterBSDRWindow
NtUserRedrawWindow
NtUserUndelegateInput
NtUserGetWindowMinimizeRect
NtUserDwmGetRemoteSessionOcclusionEvent
NtUserDwmGetRemoteSessionOcclusionState
NtUserDwmKernelShutdown
NtUserDwmKernelStartup
NtUserCheckProcessSession
NtUserUnregisterSessionPort
NtUserRegisterSessionPort
NtUserCtxDisplayIOCtl
NtUserRemoteStopScreenUpdates
NtUserRemoteRedrawScreen
NtUserRemoteRedrawRectangle
NtUserRemoteConnect
NtUserWaitAvailableMessageEx
NtUserWindowFromPoint
NtUserWindowFromPhysicalPoint
NtUserWindowFromDC
NtUserWaitMessage
NtUserWaitForMsgAndEvent
NtUserWaitForInputIdle
NtUserVkKeyScanEx
NtUserValidateTimerCallback
NtUserValidateRect
NtUserValidateHandleSecure
NtUserUserHandleGrantAccess
NtUserUpdatePerUserSystemParameters
NtUserSetLayeredWindowAttributes
NtUserGetLayeredWindowAttributes
NtUserUpdateLayeredWindow
NtUserUpdateInstance
NtUserUpdateInputContext
NtUserUnregisterHotKey
NtUserUnregisterUserApiHook
NtUserUnregisterClass
NtUserUnlockWindowStation
NtUserUnloadKeyboardLayout
NtUserUnhookWinEvent
NtUserUnhookWindowsHookEx
NtUserGetTouchInputInfo
NtUserIsTouchWindow
NtUserModifyWindowTouchCapability
NtGdiEngStretchBltROP
NtGdiEngTextOut
NtGdiEngTransparentBlt
NtGdiEngGradientFill
NtGdiEngAlphaBlend
NtGdiEngLineTo
NtGdiEngPaint
NtGdiEngStrokeAndFillPath
NtGdiEngFillPath
NtGdiEngStrokePath
NtGdiEngMarkBandingSurface
NtGdiEngPlgBlt
NtGdiEngStretchBlt
NtGdiEngBitBlt
NtGdiEngLockSurface
NtGdiEngUnlockSurface
NtGdiEngEraseSurface
NtGdiEngDeleteSurface
NtGdiEngDeletePalette
NtGdiEngCopyBits
NtGdiEngComputeGlyphSet
NtGdiEngCreatePalette
NtGdiEngCreateDeviceBitmap
NtGdiEngCreateDeviceSurface
NtGdiEngCreateBitmap
NtGdiEngAssociateSurface
NtUserSetWindowFeedbackSetting
NtUserRegisterEdgy
NtUserRegisterShellPTPListener
NtUserGetWindowFeedbackSetting
NtUserHidePointerContactVisualization
NtUserGetTouchValidationStatus
NtUserInitializeTouchInjection
NtUserInjectTouchInput
NtUserRegisterTouchHitTestingWindow
NtUserSetDisplayMapping
NtUserSetCalibrationData
NtUserGetPhysicalDeviceRect
NtUserRegisterTouchPadCapable
NtUserGetRawPointerDeviceData
NtUserGetPointerDeviceCursors
NtUserGetPointerDeviceRects
NtUserRegisterPointerDeviceNotifications
NtUserGetPointerDeviceProperties
NtUserGetPointerDevice
NtUserGetPointerDevices
NtUserEnableTouchPad
NtUserGetPrecisionTouchPadConfiguration
NtUserSetPrecisionTouchPadConfiguration
NtUserPromotePointer
NtUserDiscardPointerFrameMessages
NtUserRegisterPointerInputTarget
NtUserGetPointerFrameArrivalTimes
NtUserGetPointerInputTransform
NtUserGetPointerInfoList
NtUserGetPointerCursorId
NtUserGetPointerType
NtUserGetGestureConfig
NtUserSetGestureConfig
NtUserGetGestureExtArgs
NtUserGetGestureInfo
NtUserInjectGesture
NtUserChangeWindowMessageFilterEx
NtGdiXLATEOBJ_hGetColorTransform
NtGdiXLATEOBJ_iXlate
NtGdiXLATEOBJ_cGetPalette
NtGdiEngDeleteClip
NtGdiEngCreateClip
NtGdiEngDeletePath
NtGdiCLIPOBJ_ppoGetPath
NtGdiCLIPOBJ_cEnumStart
NtGdiCLIPOBJ_bEnum
NtGdiBRUSHOBJ_hGetColorTransform
NtGdiBRUSHOBJ_pvGetRbrush
NtGdiBRUSHOBJ_pvAllocRbrush
NtGdiBRUSHOBJ_ulGetBrushColor
NtGdiXFORMOBJ_iGetXform
NtGdiXFORMOBJ_bApplyXform
NtGdiFONTOBJ_pQueryGlyphAttrs
NtGdiFONTOBJ_pfdg
NtGdiFONTOBJ_pifi
NtGdiFONTOBJ_cGetGlyphs
NtGdiFONTOBJ_pxoGetXform
NtGdiFONTOBJ_vGetInfo
NtGdiFONTOBJ_cGetAllGlyphHandles
NtGdiFONTOBJ_pvTrueTypeFontFile
NtGdiSTROBJ_dwGetCodePage
NtGdiSTROBJ_vEnumStart
NtGdiSTROBJ_bGetAdvanceWidths
NtGdiSTROBJ_bEnumPositionsOnly
NtGdiSTROBJ_bEnum
NtGdiPATHOBJ_bEnumClipLines
NtGdiPATHOBJ_vEnumStartClipLines
NtGdiPATHOBJ_vEnumStart
NtGdiPATHOBJ_bEnum
NtGdiPATHOBJ_vGetBounds
NtGdiEngCheckAbort
NtGdiGetDhpdev
NtGdiHT_Get8BPPMaskPalette
NtGdiHT_Get8BPPFormatPalette
NtGdiUpdateTransform
NtGdiUMPDEngFreeUserMem
NtGdiBRUSHOBJ_DeleteRbrush
NtGdiSetPUMPDOBJ
NtGdiSetUMPDSandboxState
NtGdiDrawStream
NtGdiHLSurfSetInformation
NtGdiHLSurfGetInformation
NtGdiDwmCreatedBitmapRemotingOutput
NtGdiDdDDIGetScanLine
NtGdiDdDDIReleaseProcessVidPnSourceOwners
NtGdiDdDDIGetProcessSchedulingPriorityClass
NtGdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDIGetContextSchedulingPriority
NtGdiDdDDISetContextSchedulingPriority
NtGdiDdDDIDestroyDCFromMemory
NtGdiDdDDICreateDCFromMemory
NtGdiDdDDIGetDeviceState
NtGdiDdDDISetGammaRamp
NtGdiDdDDIWaitForVerticalBlankEvent
NtGdiDdDDIDestroyOverlay
NtGdiDdDDIFlipOverlay
NtGdiDdDDIUpdateOverlay
NtGdiDdDDICreateOverlay
NtGdiDdDDIGetPresentQueueEvent
NtGdiDdDDIGetPresentHistory
NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDIQueryStatistics
NtGdiDdDDIEscape
NtGdiDdDDIGetSharedPrimaryHandle
NtGdiDdDDICloseAdapter
NtGdiDdDDIOpenAdapterFromLuid
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIRender
NtGdiDdDDIPresent
NtGdiDdDDIGetMultisampleMethodList
NtGdiDdDDISetDisplayMode
NtGdiDdDDIGetDisplayModeList
NtGdiDdDDIUnlock
NtGdiDdDDILock
NtGdiDdDDIQueryAdapterInfo
NtGdiDdDDIGetRuntimeData
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIOpenSynchronizationObject
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDestroyContext
NtGdiDdDDICreateContext
NtGdiDdDDIDestroyDevice
NtGdiDdDDICreateDevice
NtGdiDdDDIQueryAllocationResidency
NtGdiDdDDISetAllocationPriority
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIOpenResourceFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle
NtGdiDdDDIOpenSyncObjectFromNtHandle2
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIShareObjects
NtGdiDdDDIQueryResourceInfoFromNtHandle
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDICreateAllocation
NtGdiDdDDIOutputDuplReleaseFrame
NtGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIOutputDuplPresent
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDIOutputDuplGetPointerShapeData
NtGdiDdDDIOutputDuplGetMetaData
NtGdiDdDDIOutputDuplGetFrameInfo
NtGdiDdDDIDestroyOutputDupl
NtGdiDdDDICreateOutputDupl
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIOfferAllocations
NtGdiDdDDICheckSharedResourceAccess
NtGdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDIGetOverlayState
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDISharedPrimaryUnLockNotification
NtGdiDdDDISharedPrimaryLockNotification
NtGdiDdDDISetDisplayPrivateDriverFormat
NtGdiDdDDICheckExclusiveOwnership
NtGdiDdDDICheckMonitorPowerState
NtGdiDdDDIWaitForIdle
NtGdiDdDDICheckOcclusion
NtGdiDdDDIInvalidateActiveVidPn
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDISetQueuedLimit
NtGdiDdDDIPinDirectFlipResources
NtGdiDdDDIUnpinDirectFlipResources
NtGdiDdDDIWaitForVerticalBlankEvent2
NtGdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDISetSyncRefreshCountWaitTarget
NtGdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetSharedResourceAdapterLuid
NtGdiDdDDISetStereoEnabled
NtGdiDdDDIPresentMultiPlaneOverlay
NtGdiDdDDICheckMultiPlaneOverlaySupport
NtGdiDdDDIMakeResident
NtGdiDdDDIEvict
NtGdiDdDDIUpdateAllocationProperty
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDICreatePagingQueue
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDILock2
NtGdiDdDDIUnlock2
NtGdiDdDDIInvalidateCache
NtGdiDdDDIGetResourcePresentPrivateDriverData
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIUpdateGpuVirtualAddress
NtGdiDdDDICreateContextVirtual
NtGdiDdDDISubmitCommand
NtGdiDdDDIGetCachedHybridQueryValue
NtGdiDdDDICacheHybridQueryValue
NtGdiDdDDINetDispGetNextChunkInfo
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtGdiDdDDINetDispStopMiracastDisplayDevice
NtGdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispStopSessions
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDICreateSwapChain
NtGdiDdDDIOpenSwapChain
NtGdiDdDDIAddSurfaceToSwapChain
NtGdiDdDDIRemoveSurfaceFromSwapChain
NtGdiDdDDIUnOrderedPresentSwapChain
NtGdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIAcquireSwapChain
NtGdiDdDDIReleaseSwapChain
NtGdiDdDDIAbandonSwapChain
NtGdiDdDDISetDodIndirectSwapchain
NtGdiDdDDICheckMultiPlaneOverlaySupport2
NtGdiDdDDIPresentMultiPlaneOverlay2
NtGdiDdDDIReclaimAllocations2
NtGdiDdDDISetStablePowerState
NtGdiDdDDIQueryClockCalibration
NtGdiDdDDIQueryVidPnExclusiveOwnership
NtGdiDdDDIAdjustFullscreenGamma
NtGdiDdDDISetVidPnSourceHwProtection
NtGdiDdDDIMarkDeviceAsError
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDISetHwProtectionTeardownRecovery
NtGdiDdDDIQueryProcessOfferInfo
NtGdiDdDDITrimProcessCommitment
NtGdiDdDDICheckMultiPlaneOverlaySupport3
NtGdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDISetFSEBlock
NtGdiDdDDIQueryFSEBlock
NtGdiDdDDICreateHwContext
NtGdiDdDDIDestroyHwContext
NtGdiDdDDICreateHwQueue
NtGdiDdDDIDestroyHwQueue
NtGdiDdDDISubmitCommandToHwQueue
NtGdiDdDDISubmitWaitForSyncObjectsToHwQueue
NtGdiDdDDISubmitSignalSyncObjectsToHwQueue
NtGdiDdDDIGetAllocationPriority
NtGdiDdDDIGetMultiPlaneOverlayCaps
NtGdiDdDDIGetPostCompositionCaps
NtGdiDdDDISetYieldPercentage
NtGdiDdDDISetProcessSchedulingPriorityBand
NtGdiDdDDISetMemoryBudgetTarget
NtGdiDdDDIGetYieldPercentage
NtGdiDdDDIGetProcessSchedulingPriorityBand
NtGdiDdDDIGetMemoryBudgetTarget
NtGdiDdDDIDDisplayEnum
NtGdiDdDDIDispMgrCreate
NtGdiDdDDIDispMgrTargetOperation
NtGdiDdDDIDispMgrSourceOperation
NtGdiDdDDICreateProtectedSession
NtGdiDdDDIDestroyProtectedSession
NtGdiDdDDIQueryProtectedSessionStatus
NtGdiDdDDIQueryProtectedSessionInfoFromNtHandle
NtGdiDdDDIOpenProtectedSessionFromNtHandle
NtGdiDdDDISetMonitorColorSpaceTransform
NtGdiDdDDIPresentRedirected
NtGdiDdDDICreateBundleObject
NtGdiDdDDIExtractBundleObject
NtGdiDdDDISetDeviceLostSupport
NtGdiDdDDIGetProcessDeviceLostSupport
NtGdiMakeObjectUnXferable
NtGdiMakeObjectXferable
NtGdiDestroyPhysicalMonitor
NtGdiGetPhysicalMonitorDescription
NtGdiGetPhysicalMonitors
NtGdiGetNumberOfPhysicalMonitors
NtGdiDDCCIGetTimingReport
NtGdiDDCCIGetCapabilitiesString
NtGdiDDCCIGetCapabilitiesStringLength
NtGdiDDCCISaveCurrentSettings
NtGdiDDCCISetVCPFeature
NtGdiDDCCIGetVCPFeature
NtGdiDdQueryVisRgnUniqueness
NtGdiDdDestroyFullscreenSprite
NtGdiDdNotifyFullscreenSpriteUpdate
NtGdiDdCreateFullscreenSprite
NtGdiGetProcessSessionFonts
NtGdiGetPublicFontTableChangeCookie
NtGdiAddInitialFonts
NtUserShowSystemCursor
NtUserSetMirrorRendering
NtUserSetDesktopColorTransform
NtUserMagGetContextInformation
NtUserMagSetContextInformation
NtUserMagControl
NtUserSlicerControl
NtUserHwndSetRedirectionInfo
NtUserHwndQueryRedirectionInfo
NtCreateCompositionSurfaceHandle
NtValidateCompositionSurfaceHandle
NtBindCompositionSurface
NtUnBindCompositionSurface
NtQueryCompositionSurfaceBinding
NtNotifyPresentToCompositionSurface
NtQueryCompositionSurfaceStatistics
NtOpenCompositionSurfaceSectionInfo
NtOpenCompositionSurfaceSwapChainHandleInfo
NtQueryCompositionSurfaceRenderingRealization
NtOpenCompositionSurfaceDirtyRegion
NtQueryCompositionSurfaceHDRMetaData
NtSetCompositionSurfaceHDRMetaData
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceStatistics
NtSetCompositionSurfaceBufferUsage
NtSetCompositionSurfaceIndependentFlipInfo
NtDesktopCaptureBits
NtDCompositionEnableMMCSS
NtVisualCaptureBits
NtDCompositionEnableDDASupport
NtDCompositionCreateSharedVisualHandle
NtCreateCompositionInputSink
NtCreateImplicitCompositionInputSink
NtDuplicateCompositionInputSink
NtQueryCompositionInputSink
NtQueryCompositionInputSinkLuid
NtQueryCompositionInputSinkViewId
NtUpdateInputSinkTransforms
NtCompositionInputThread
NtQueryCompositionInputQueueAndTransform
NtQueryCompositionInputIsImplicit
NtCompositionSetDropTarget
NtTokenManagerOpenSectionAndEvents
NtTokenManagerThread
NtTokenManagerCreateCompositionTokenHandle
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerGetAnalogExclusiveSurfaceUpdates
NtTokenManagerConfirmOutstandingAnalogToken
NtSetCompositionSurfaceAnalogExclusive
NtDCompositionBeginFrame
NtDCompositionConfirmFrame
NtDCompositionRetireFrame
NtDCompositionDiscardFrame
NtDCompositionGetFrameSurfaceUpdates
NtDCompositionGetFrameLegacyTokens
NtDCompositionDestroyConnection
NtDCompositionGetConnectionBatch
NtDCompositionGetFrameStatistics
NtDCompositionGetDeletedResources
NtDCompositionCreateConnection
NtDCompositionDestroyChannel
NtDCompositionReleaseAllResources
NtDCompositionSubmitDWMBatch
NtDCompositionProcessChannelBatchBuffer
NtDCompositionCommitChannel
NtDCompositionWaitForChannel
NtDCompositionSetChannelCommitCompletionEvent
NtDCompositionTelemetryTouchInteractionBegin
NtDCompositionTelemetryTouchInteractionUpdate
NtDCompositionTelemetryTouchInteractionEnd
NtDCompositionTelemetrySetApplicationId
NtDCompositionTelemetryAnimationScenarioBegin
NtDCompositionTelemetryAnimationScenarioReference
NtDCompositionTelemetryAnimationScenarioUnreference
NtDCompositionCurrentBatchId
NtDCompositionRemoveCrossDeviceVisualChild
NtDCompositionAddCrossDeviceVisualChild
NtDCompositionCreateDwmChannel
NtDCompositionCreateChannel
NtDCompositionSynchronize
NtDCompositionReferenceSharedResourceOnDwmChannel
NtDCompositionCreateAndBindSharedSection
NtDCompositionSetDebugCounter
NtDCompositionGetChannels
NtDCompositionConnectPipe
NtDCompositionRegisterThumbnailVisual
NtDCompositionRegisterVirtualDesktopVisual
NtDCompositionDuplicateHandleToProcess
NtDCompositionUpdatePointerCapture
NtDCompositionSetChannelCallbackId
NtDCompositionDuplicateSwapchainHandleToDwm
NtDCompositionSetChildRootVisual
NtDCompositionCommitSynchronizationObject
NtFlipObjectCreate
NtFlipObjectOpen
NtFlipObjectAddPoolBuffer
NtFlipObjectRemovePoolBuffer
NtUserDestroyDCompositionHwndTarget
NtUserCreateDCompositionHwndTarget
NtUserCreateEmptyCursorObject
NtUserWaitForRedirectionStartComplete
NtUserWOWCleanup
NtUserSignalRedirectionStartComplete
NtUserEnableWindowResizeOptimization
NtUserGetResizeDCompositionSynchronizationObject
NtUserEnableResizeLayoutSynchronization
NtUserBeginLayoutUpdate
NtUserIsResizeLayoutSynchronizationEnabled
NtUserConfirmResizeCommit
NtUserSetActiveProcessForMonitor
NtUserGetDisplayAutoRotationPreferencesByProcessId
NtUserGetDisplayAutoRotationPreferences
NtUserSetDisplayAutoRotationPreferences
NtUserSetAutoRotation
NtUserGetAutoRotationState
NtUserAutoRotateScreen
NtUserAcquireIAMKey
NtUserSetActivationFilter
NtUserSetFallbackForeground
NtUserSetBrokeredForeground
NtUserDisableImmersiveOwner
NtUserClearForeground
NtUserEnableIAMAccess
NtUserGetProcessUIContextInformation
NtUserSetProcessRestrictionExemption
NtUserSetWindowArrangement
NtUserSetWindowShowState
NtUserUpdateWindowTrackingInfo
NtUserEnableMouseInPointer
NtUserIsMouseInPointerEnabled
NtUserPromoteMouseInPointer
NtUserAutoPromoteMouseInPointer
NtUserEnableMouseInputForCursorSuppression
NtUserIsMouseInputEnabled
NtUserCheckProcessForClipboardAccess
NtUserGetClipboardAccessToken
NtUserGetQueueStatusReadonly
NtUserCompositionInputSinkLuidFromPoint
NtUserCompositionInputSinkViewInstanceIdFromPoint
NtUserUpdateWindowInputSinkHints
NtUserTransformPoint
NtUserTransformRect
NtUserGetHimetricScaleFactorFromPixelLocation
NtUserGetHDevName
NtUserGetDpiForMonitor
NtUserReportInertia
NtUserLinkDpiCursor
NtUserGetCursorDims
NtUserGetCursor
NtUserInitializeInputDeviceInjection
NtUserInitializeGenericHidInjection
NtUserInitializePointerDeviceInjection
NtUserRemoveInjectionDevice
NtUserSetFeatureReportResponse
NtUserInjectDeviceInput
NtUserInjectMouseInput
NtUserInjectKeyboardInput
NtUserInjectPointerInput
NtUserInjectGenericHidInput
NtUserInitializePointerDeviceInjectionEx
NtRIMRegisterForInput
NtRIMReadInput
NtRIMGetDevicePreparsedData
NtRIMGetDeviceProperties
NtRIMAreSiblingDevices
NtRIMFreeInputBuffer
NtRIMOnPnpNotification
NtRIMOnTimerNotification
NtRIMDeviceIoControl
NtRIMUnregisterForInput
NtRIMSetTestModeStatus
NtRIMGetPhysicalDeviceRect
NtRIMGetSourceProcessId
NtRIMAddInputObserver
NtRIMRemoveInputObserver
NtRIMUpdateInputObserverRegistration
NtRIMObserveNextInput
NtRIMGetDevicePreparsedDataLockfree
NtRIMGetDevicePropertiesLockfree
NtRIMEnableMonitorMappingForDevice
NtUserSetCoreWindow
NtUserSetCoreWindowPartner
NtUserNavigateFocus
NtHWCursorUpdatePointer
NtUserAcquireInteractiveControlBackgroundAccess
NtUserGetInteractiveControlInfo
NtUserGetInteractiveControlDeviceInfo
NtUserSendInteractiveControlHapticsReport
NtUserSetInteractiveControlFocus
NtUserInteractiveControlQueryUsage
NtUserSetInteractiveCtrlRotationAngle
NtUserGetInteractiveCtrlSupportedWaveforms
NtUserProcessInkFeedbackCommand
NtUserSetProcessInteractionFlags
NtMITActivateInputProcessing
NtMITWaitForMultipleObjectsEx
NtMITDeactivateInputProcessing
NtMITSetInputCallbacks
NtMITCoreMsgKGetConnectionHandle
NtMITCoreMsgKSend
NtMITCoreMsgKOpenConnectionTo
NtMITUpdateInputGlobals
NtMITBindInputTypeToMonitors
NtMITEnableMouseIntercept
NtMITDisableMouseIntercept
NtMITSynthesizeTouchInput
NtMITSynthesizeMouseInput
NtMITSynthesizeMouseWheel
NtMITGetCursorUpdateHandle
NtDWMSetInputSystemOutputConfig
NtDWMCommitInputSystemOutputConfig
NtDWMBindCursorToOutputConfig
NtDWMSetCursorOrientation
NtUserMsgWaitForMultipleObjectsEx

↧

how to find rpcrt4!GlobalRpcServer

November 2, 2017, 7:51 am

≫ Next: rpcrt4 security providers

≪ Previous: W32pServiceTable from windows 10 build 16278

I looked through sources of rpcview and found that they used some kind of brute-force in file RpcCore.c in function GetRpcServerAddressInProcess. It looks very strange and slow - they already has some code for pdb reading, so why not just ask address of ?GlobalRpcServer@@3PEAVRPC_SERVER@@EA ?

Anyway there is better way. Lets run my exref.pl in IDA Pro on rpcrt4.dll from windows 10 build 16278:

_I_RpcServerUseProtseq2W@20: 4EFACEB0 addr 4EFACEED
_RpcServerInqBindings@4: 4EFADA90 addr 4EFADAAC
_RpcServerRegisterIfEx@24: 4EFADCB0 addr 4EFADCCC
_RpcMgmtIsServerListening@4: 4EFAE470 addr 4EFAE48D
_RpcServerInterfaceGroupActivate@4: 4EFAE5B0 addr 4EFAE5C2
_RpcServerInterfaceGroupDeactivate@8: 4EFAE5E0 addr 4EFAE5F2
_I_RpcServerUseProtseqEp2W@24: 4EFB33E0 addr 4EFB33FF
_RpcServerUnregisterIf@12: 4EFB50B0 addr 4EFB50C5
_RpcServerRegisterIf3@32: 4EFB51F0 addr 4EFB5222
_RpcServerRegisterIf2@28: 4EFDFF40 addr 4EFDFF5C
_RpcServerInqBindingsEx@8: 4EFE0080 addr 4EFE0098
_RpcServerRegisterIf@12: 4EFE02E0 addr 4EFE02F5
_I_RpcServerRegisterForwardFunction@4: 4EFE03E0 addr 4EFE03F2
_RpcServerInterfaceGroupInqBindings@8: 4F0070D0 addr 4F0070E7
_RpcServerUseAllProtseqsEx@12: 4F007150 addr 4F00722C

wow, it seems that this will be easy
Lets look at exported function I_RpcServerRegisterForwardFunction:

_I_RpcServerRegisterForwardFunction@4 proc near 

pForwardFunction= dword ptr  8

                mov     edi, edi
                push    ebp
                mov     ebp, esp
                cmp     ?RpcHasBeenInitialized@@3HA, 0 ; int RpcHasBeenInitialized
                jz      loc_4F002811

loc_4EFE03F2:                          
                mov     eax, ?GlobalRpcServer@@3PAVRPC_SERVER@@A ; RPC_SERVER * GlobalRpcServer
                mov     ecx, [ebp+pForwardFunction]
                mov     [eax+0F4h], ecx
                xor     eax, eax

loc_4EFE0402:                           ; CODE XREF: I_RpcServerRegisterForwardFunction(x)+22438 j
                pop     ebp
                retn    4

With simple disasm of this function you can get GlobalRpcServer, flag RpcHasBeenInitialized and offset to RPC_SERVER_T.pRpcForwardFunction

↧

rpcrt4 security providers

November 7, 2017, 8:36 am

≫ Next: crypt32.dll SIPs

≪ Previous: how to find rpcrt4!GlobalRpcServer

Count of loaded providers stored in rpcrt4!LoadedProviders and list in rpcrt4!ProviderList
Structure of each provider can be partially recovered from function FindSecurityPackage:
struct _rpc_loaded_provider
{
DWORD unk1;
PVOID unk2;
PSecurityFunctionTable table;
PVOID unk3;
PVOID unk4;
}; // size of struct 0x14 for x86 and 0x28 for x64

It's interesting that the function of InitSecurityFunctionTable patches the contents of SECURITY_FUNCTION_TABLE. Sample of output from w8.1:

Module: C:\Windows\system32\RPCRT4.dll at 00007FFE16D90000
rpcrt4.dll!GlobalRpcServer: 000000E5C25C98C0

 LoadedProviders at 00007FFE16EAB0F4: 2
 ProviderList at 00007FFE16EAB248: 000000E5C25D5710
 item size 28:
00000000  0B 00 00 00-01 20 00 00|30 86 61 C2-E5 00 00 00  ..... ..0†aΒε...
00000010  20 5A 96 14-FE 7F 00 00|50 FA 5D C2-E5 00 00 00   Z–.ώ..Pϊ]Βε...
00000020  80 0A 60 C2-E5 00 00 00|01 00 00 00-00 00 00 00  €.`Βε...........
00000030  50 F3 5F C2-E5 00 00 00|A0 FB DE 13-FE 7F 00 00  Pσ_Βε... ϋή.ώ..
00000040  10 5E 61 C2-E5 00 00 00|70 AF 60 C2-E5 00 00 00  .^aΒε...p―`Βε...

 SecurityProvider[0]: 00007FFE14965A20 C:\Windows\system32\SspiCli.dll
 SecurityFunctionTable at 00007FFE14965A20:
00000000  01 00 00 00-00 00 00 00|30 9F 94 14-FE 7F 00 00  ........0”.ώ..
00000010  00 6F 94 14-FE 7F 00 00|10 6A 94 14-FE 7F 00 00  .o”.ώ...j”.ώ..
00000020  70 6B 94 14-FE 7F 00 00|00 00 00 00-00 00 00 00  pk”.ώ..........
00000030  60 7E 94 14-FE 7F 00 00|10 F1 94 14-FE 7F 00 00  `~”.ώ...ρ”.ώ..
00000040  40 09 96 14-FE 7F 00 00|30 81 94 14-FE 7F 00 00  @.–.ώ..0”.ώ..
00000050  40 16 95 14-FE 7F 00 00|40 78 94 14-FE 7F 00 00  @.•.ώ..@x”.ώ..
00000060  40 DE 94 14-FE 7F 00 00|30 E0 94 14-FE 7F 00 00  @ή”.ώ..0ΰ”.ώ..
00000070  80 04 95 14-FE 7F 00 00|30 03 95 14-FE 7F 00 00  €.•.ώ..0.•.ώ..
00000080  50 28 94 14-FE 7F 00 00|F0 E8 94 14-FE 7F 00 00  P(”.ώ..πθ”.ώ..
00000090  80 21 94 14-FE 7F 00 00|50 23 94 14-FE 7F 00 00  €!”.ώ..P#”.ώ..
000000A0  D0 09 96 14-FE 7F 00 00|60 0B 96 14-FE 7F 00 00  Π.–.ώ..`.–.ώ..
000000B0  50 07 96 14-FE 7F 00 00|00 00 00 00-00 00 00 00  P.–.ώ..........
000000C0  F0 FE 94 14-FE 7F 00 00|80 21 94 14-FE 7F 00 00  πώ”.ώ..€!”.ώ..
000000D0  50 23 94 14-FE 7F 00 00|00 00 00 00-00 00 00 00  P#”.ώ..........
000000E0  00 00 00 00-00 00 00 00                          ........

  EnumerateSecurityPackages:  00007FFE14949F30 C:\Windows\system32\SspiCli.dll
  QueryCredentialsAttributes: 00007FFE14946F00 C:\Windows\system32\SspiCli.dll
  AcquireCredentialsHandle:   00007FFE14946A10 C:\Windows\system32\SspiCli.dll
  FreeCredentialsHandle:      00007FFE14946B70 C:\Windows\system32\SspiCli.dll
  InitializeSecurityContext:  00007FFE14947E60 C:\Windows\system32\SspiCli.dll
  AcceptSecurityContext:      00007FFE1494F110 C:\Windows\system32\SspiCli.dll
  CompleteAuthToken:          00007FFE14960940 C:\Windows\system32\SspiCli.dll
  DeleteSecurityContext:      00007FFE14948130 C:\Windows\system32\SspiCli.dll
  ApplyControlToken:          00007FFE14951640 C:\Windows\system32\SspiCli.dll
  QueryContextAttributes:     00007FFE14947840 C:\Windows\system32\SspiCli.dll
  ImpersonateSecurityContext: 00007FFE1494DE40 C:\Windows\system32\SspiCli.dll
  RevertSecurityContext:      00007FFE1494E030 C:\Windows\system32\SspiCli.dll
  MakeSignature:              00007FFE14950480 C:\Windows\system32\SspiCli.dll
  VerifySignature:            00007FFE14950330 C:\Windows\system32\SspiCli.dll
  FreeContextBuffer:          00007FFE14942850 C:\Windows\system32\SspiCli.dll
  QuerySecurityPackageInfo:   00007FFE1494E8F0 C:\Windows\system32\SspiCli.dll
  ExportSecurityContext:      00007FFE149609D0 C:\Windows\system32\SspiCli.dll
  ImportSecurityContext:      00007FFE14960B60 C:\Windows\system32\SspiCli.dll
  AddCredentials:             00007FFE14960750 C:\Windows\system32\SspiCli.dll
  QuerySecurityContextToken:  00007FFE1494FEF0 C:\Windows\system32\SspiCli.dll
  EncryptMessage:             00007FFE14942180 C:\Windows\system32\SspiCli.dll
  DecryptMessage:             00007FFE14942350 C:\Windows\system32\SspiCli.dll
 SecurityProvider[1]: 00007FFE13DEFBA0 C:\Windows\system32\netlogon.DLL
 SecurityFunctionTable at 00007FFE13DEFBA0:
00000000  01 00 00 00-00 00 00 00|B0 07 D7 13-FE 7F 00 00  ........°.Χ.ώ..
00000010  00 00 00 00-00 00 00 00|90 DE D3 13-FE 7F 00 00  ........ήΣ.ώ..
00000020  F0 73 D6 13-FE 7F 00 00|00 00 00 00-00 00 00 00  πsΦ.ώ..........
00000030  00 F4 D5 13-FE 7F 00 00|70 DF D3 13-FE 7F 00 00  .τΥ.ώ..pίΣ.ώ..
00000040  40 FE E2 16-FE 7F 00 00|80 73 D4 13-FE 7F 00 00  @ώβ.ώ..€sΤ.ώ..
00000050  40 FE E2 16-FE 7F 00 00|D0 DD D3 13-FE 7F 00 00  @ώβ.ώ..ΠέΣ.ώ..
00000060  60 DF D3 13-FE 7F 00 00|60 DF D3 13-FE 7F 00 00  `ίΣ.ώ..`ίΣ.ώ..
00000070  30 2F DD 13-FE 7F 00 00|F0 2F DD 13-FE 7F 00 00  0/έ.ώ..π/έ.ώ..
00000080  10 2F DD 13-FE 7F 00 00|E0 07 D7 13-FE 7F 00 00  ./έ.ώ..ΰ.Χ.ώ..
00000090  00 D1 D3 13-FE 7F 00 00|F0 D6 D3 13-FE 7F 00 00  .ΡΣ.ώ..πΦΣ.ώ..
000000A0  40 FE E2 16-FE 7F 00 00|40 FE E2 16-FE 7F 00 00  @ώβ.ώ..@ώβ.ώ..
000000B0  40 FE E2 16-FE 7F 00 00|00 00 00 00-00 00 00 00  @ώβ.ώ..........
000000C0  40 FE E2 16-FE 7F 00 00|40 FE E2 16-FE 7F 00 00  @ώβ.ώ..@ώβ.ώ..
000000D0  40 FE E2 16-FE 7F 00 00|00 00 00 00-00 00 00 00  @ώβ.ώ..........
000000E0  00 00 00 00-00 00 00 00                          ........

  EnumerateSecurityPackages:  00007FFE13D707B0 C:\Windows\system32\netlogon.DLL
  AcquireCredentialsHandle:   00007FFE13D3DE90 C:\Windows\system32\netlogon.DLL
  FreeCredentialsHandle:      00007FFE13D673F0 C:\Windows\system32\netlogon.DLL
  InitializeSecurityContext:  00007FFE13D5F400 C:\Windows\system32\netlogon.DLL
  AcceptSecurityContext:      00007FFE13D3DF70 C:\Windows\system32\netlogon.DLL
  CompleteAuthToken:          00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  DeleteSecurityContext:      00007FFE13D47380 C:\Windows\system32\netlogon.DLL
  ApplyControlToken:          00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  QueryContextAttributes:     00007FFE13D3DDD0 C:\Windows\system32\netlogon.DLL
  ImpersonateSecurityContext: 00007FFE13D3DF60 C:\Windows\system32\netlogon.DLL
  RevertSecurityContext:      00007FFE13D3DF60 C:\Windows\system32\netlogon.DLL
  MakeSignature:              00007FFE13DD2F30 C:\Windows\system32\netlogon.DLL
  VerifySignature:            00007FFE13DD2FF0 C:\Windows\system32\netlogon.DLL
  FreeContextBuffer:          00007FFE13DD2F10 C:\Windows\system32\netlogon.DLL
  QuerySecurityPackageInfo:   00007FFE13D707E0 C:\Windows\system32\netlogon.DLL
  ExportSecurityContext:      00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  ImportSecurityContext:      00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  AddCredentials:             00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  QuerySecurityContextToken:  00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  EncryptMessage:             00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll
  DecryptMessage:             00007FFE16E2FE40 C:\Windows\system32\RPCRT4.dll

under w10 format of rpc_loaded_provider was changed - it now contains whole SECURITY_FUNCTION_TABLE:
struct _rpc_loaded_provider_w10
{
DWORD unk1;
PVOID unk2;

  SECURITY_FUNCTION_TABLE tab;

...

}; // size of structure 0x120 for x64 and 0x90 for x86

Remark that again function InitSecurityFunctionTabledoes not copy all fields of the structure
SECURITY_FUNCTION_TABLE - for example it leaves uninitialized holes for fields Reserved2, Reserved8, SetContextAttributesW and ChangeAccountPasswordW. Sample of output from w10 build 16241:


Module: C:\Windows\System32\RPCRT4.dll at 75690000

rpcrt4.dll!GlobalRpcServer: 02E25958

 LoadedProviders at 757489AC: 2
 ProviderList at 757489B4: 02E61290
 item size 90:
00000000  0C 00 00 00-F8 18 E6 02|00 00 00 00-C0 A6 54 74  ....ш.ж.....А¦Tt
00000010  D0 5C 54 74-30 70 54 74|80 6F 54 74-00 00 00 00  Р\Tt0pTtЂoTt....
00000020  60 82 54 74-A0 A1 55 74|10 A7 55 74-20 7B 54 74  `‚Tt ЎUt.§Ut {Tt
00000030  B0 4D 54 74-40 5C 54 74|80 A8 55 74-F0 AC 55 74  °MTt@\TtЂЁUtр¬Ut
00000040  50 AA 55 74-10 AF 55 74|10 D4 54 74-D0 D9 54 74  PЄUt.ЇUt.ФTtРЩTt
00000050  E0 8A 54 74-D0 8B 54 74|00 A8 55 74-A0 A9 55 74  аЉTtР‹Tt.ЁUt ©Ut
00000060  D0 A5 55 74-00 00 00 00|40 AC 55 74-E0 8A 54 74  РҐUt....@¬UtаЉTt
00000070  D0 8B 54 74-00 00 00 00|00 00 00 00-00 00 00 00  Р‹Tt............
00000080  70 85 54 74-B0 5B 54 74|78 C4 E1 02-18 B8 E1 02  p…Tt°[TtxДб..ёб.
00000090  01 00 00 00-C8 2F E3 02|00 00 00 00-40 29 EB 73  ....И/г.....@)лs
000000A0  40 DF 6E 75-E0 D3 ED 73|80 D8 ED 73-00 00 00 00  @ЯnuаУнsЂШнs....
000000B0  D0 D8 ED 73-C0 CD ED 73|50 DF 6E 75-20 D8 ED 73  РШнsАНнsPЯnu Шнs
000000C0  50 DF 6E 75-20 EF ED 73|70 31 EB 73-70 31 EB 73  PЯnu пнsp1лsp1лs
000000D0  90 DE ED 73-80 F1 ED 73|60 D8 ED 73-10 F0 ED 73  ђЮнsЂснs`Шнs.рнs
000000E0  E0 F0 ED 73-30 F1 ED 73|70 DF 6E 75-70 DF 6E 75  арнs0снspЯnupЯnu
000000F0  20 DF 6E 75-00 00 00 00|50 DF 6E 75-70 DF 6E 75   Яnu....PЯnupЯnu
00000100  70 DF 6E 75-00 00 00 00|00 00 00 00-00 00 00 00  pЯnu............
00000110  00 00 00 00-00 00 00 00|50 C4 E1 02-48 2F E3 02  ........PДб.H/г.
 SecurityProvider[0]:
 SecurityFunctionTable at 02E61298:
  EnumerateSecurityPackages:  7454A6C0 C:\Windows\system32\SspiCli.dll
  QueryCredentialsAttributes: 74545CD0 C:\Windows\system32\SspiCli.dll
  AcquireCredentialsHandle:   74547030 C:\Windows\system32\SspiCli.dll
  FreeCredentialsHandle:      74546F80 C:\Windows\system32\SspiCli.dll
  InitializeSecurityContext:  74548260 C:\Windows\system32\SspiCli.dll
  AcceptSecurityContext:      7455A1A0 C:\Windows\system32\SspiCli.dll
  CompleteAuthToken:          7455A710 C:\Windows\system32\SspiCli.dll
  DeleteSecurityContext:      74547B20 C:\Windows\system32\SspiCli.dll
  ApplyControlToken:          74544DB0 C:\Windows\system32\SspiCli.dll
  QueryContextAttributes:     74545C40 C:\Windows\system32\SspiCli.dll
  ImpersonateSecurityContext: 7455A880 C:\Windows\system32\SspiCli.dll
  RevertSecurityContext:      7455ACF0 C:\Windows\system32\SspiCli.dll
  MakeSignature:              7455AA50 C:\Windows\system32\SspiCli.dll
  VerifySignature:            7455AF10 C:\Windows\system32\SspiCli.dll
  FreeContextBuffer:          7454D410 C:\Windows\system32\SspiCli.dll
  QuerySecurityPackageInfo:   7454D9D0 C:\Windows\system32\SspiCli.dll
  ExportSecurityContext:      7455A800 C:\Windows\system32\SspiCli.dll
  ImportSecurityContext:      7455A9A0 C:\Windows\system32\SspiCli.dll
  AddCredentials:             7455A5D0 C:\Windows\system32\SspiCli.dll
  QuerySecurityContextToken:  7455AC40 C:\Windows\system32\SspiCli.dll
  EncryptMessage:             74548AE0 C:\Windows\system32\SspiCli.dll
  DecryptMessage:             74548BD0 C:\Windows\system32\SspiCli.dll
 SecurityProvider[1]:
 SecurityFunctionTable at 02E61328:
  EnumerateSecurityPackages:  73EB2940 C:\Windows\system32\netlogon.DLL
  QueryCredentialsAttributes: 756EDF40 C:\Windows\System32\RPCRT4.dll
  AcquireCredentialsHandle:   73EDD3E0 C:\Windows\system32\netlogon.DLL
  FreeCredentialsHandle:      73EDD880 C:\Windows\system32\netlogon.DLL
  InitializeSecurityContext:  73EDD8D0 C:\Windows\system32\netlogon.DLL
  AcceptSecurityContext:      73EDCDC0 C:\Windows\system32\netlogon.DLL
  CompleteAuthToken:          756EDF50 C:\Windows\System32\RPCRT4.dll
  DeleteSecurityContext:      73EDD820 C:\Windows\system32\netlogon.DLL
  ApplyControlToken:          756EDF50 C:\Windows\System32\RPCRT4.dll
  QueryContextAttributes:     73EDEF20 C:\Windows\system32\netlogon.DLL
  ImpersonateSecurityContext: 73EB3170 C:\Windows\system32\netlogon.DLL
  RevertSecurityContext:      73EB3170 C:\Windows\system32\netlogon.DLL
  MakeSignature:              73EDDE90 C:\Windows\system32\netlogon.DLL
  VerifySignature:            73EDF180 C:\Windows\system32\netlogon.DLL
  FreeContextBuffer:          73EDD860 C:\Windows\system32\netlogon.DLL
  QuerySecurityPackageInfo:   73EDF010 C:\Windows\system32\netlogon.DLL
  ExportSecurityContext:      756EDF70 C:\Windows\System32\RPCRT4.dll
  ImportSecurityContext:      756EDF70 C:\Windows\System32\RPCRT4.dll
  AddCredentials:             756EDF20 C:\Windows\System32\RPCRT4.dll
  QuerySecurityContextToken:  756EDF50 C:\Windows\System32\RPCRT4.dll
  EncryptMessage:             756EDF70 C:\Windows\System32\RPCRT4.dll
  DecryptMessage:             756EDF70 C:\Windows\System32\RPCRT4.dll

↧

crypt32.dll SIPs

November 16, 2017, 7:32 am

≫ Next: wincheck rc8.59

≪ Previous: rpcrt4 security providers

in cool paper"subverting windows trust" was described mechanism of subject interface package (SIP)
Lets see how we can extract and dump them
Unfortunately list of SIPs inside crypt32.dll don't have name in .pdb. One way is to find it with help of IDA Pro from function FindDll:

  push    [ebp+nSize]                   ; nSize
  push    ebx                           ; lpDst
  push    [ebp+lpSrc]                   ; lpSrc
  call    ds:__imp__ExpandEnvironmentStringsW@12
  test    eax, eax
  jz      short loc_5CF28F50
  push    offset dll_cs

  call    ds:__imp__EnterCriticalSection@4 
  mov     edi, dll_list ; linked list of SIPs
  test    edi, edi
  jz      short loc_5CF28F89

next_item:
  push    0FFFFFFFFh                    ; cchCount2
  push    dword ptr [edi+8]             ; lpString2
  push    0FFFFFFFFh                    ; cchCount1
  push    ebx                           ; lpString1
  push    1                             ; dwCmpFlags
  push    409h                          ; Locale
  call    ds:__imp__CompareStringW@24
  dec     eax
  sub     eax, 1
  jz      short loc_5CF28F41
  mov     edi, [edi+4]
  test    edi, edi
  jnz     short next_item

this address (I named it dll_list) contains head of linked list to SIPs structures like this:

struct sip_item
{
  sip_item *next;
  PVOID unk4;        // ptr to crypto32_dll_list_item
  const char *fname; // actually ends to end of sip_item
  PVOID pfn; // if function was resolved, else NULL
};

struct crypto32_dll_list_item
{
  PVOID unk;
  crypto32_dll_list_item *next;
  const wchar_t *dll_name;

  HANDLE base; // if dll was loaded - load base else NULL
  DWORD unk10;
  DWORD unk14;
  sip_item *func_items_list; 
  PVOID unk20;
  PVOID unk24;
  PVOID unk28;
};

it's interesting to note that not all SIP .dll loading at initialization of SIP structures - in fact they are almost always empty and contain only names. Sample of output from lsass.exe:

 SIP: 000002669EE8CCA0 C:\Windows\System32\SecureTimeAggregator.dll base 00007FF96EE90000
  SIP data at 000002669F848B70: GetSecureTime 00007FF96EE95770 C:\Windows\System32\SecureTimeAggregator.dll
  SIP data at 000002669F84C290: AggregateSSLHandshakeTime 00007FF96EE95680 C:\Windows\System32\SecureTimeAggregator.dll
 SIP: 000002669EEA1A90 C:\Windows\System32\inetcomm.dll
  SIP data at 000002669F863C90: EssContentHintEncodeEx
  SIP data at 000002669F863DD0: EssMLHistoryEncodeEx
  SIP data at 000002669F863D90: EssSecurityLabelEncodeEx
  SIP data at 000002669F863A10: EssSignCertificateEncodeEx
  SIP data at 000002669F863D10: EssKeyExchPreferenceEncodeEx
  SIP data at 000002669F863F50: EssReceiptRequestEncodeEx
  SIP data at 000002669F863910: EssReceiptEncodeEx
  SIP data at 000002669F87B2D0: EssContentHintDecodeEx
  SIP data at 000002669F87B290: EssMLHistoryDecodeEx
  SIP data at 000002669F87B6D0: EssSecurityLabelDecodeEx
  SIP data at 000002669F87B3D0: EssSignCertificateDecodeEx
  SIP data at 000002669F87B650: EssKeyExchPreferenceDecodeEx
  SIP data at 000002669F87B190: EssReceiptRequestDecodeEx
  SIP data at 000002669F87B450: EssReceiptDecodeEx
 SIP: 000002669EEA19F0 C:\Windows\System32\cryptnet.dll base 00007FF96EE60000
  SIP data at 000002669F8633D0: CertDllVerifyRevocation 00007FF96EE65A90 C:\Windows\System32\cryptnet.dll
  SIP data at 000002669F87B390: LdapProvOpenStore
  SIP data at 000002669F87B4D0: LdapProvOpenStore

↧

wincheck rc8.59

November 24, 2017, 8:54 am

≫ Next: wincheck rc8.60

≪ Previous: crypt32.dll SIPs

download
mirror
Changelog:

add support of numerous versions of windows 10 insider preview - up to ~17025
add -dsip option to dump SIPs from crypt32.dll
add -dac & -dsac options to dump activation contexts and system activation contexts. based on this code from @deroko
add dumping of rpcrt4 security providers
add dumping of ETW private loggers (-wmi option)
add lots of WNF IDs names
add dumping of registered with winnsi!NsiRpcRegisterChangeNotification notifications

↧

wincheck rc8.60

January 17, 2018, 8:12 am

≫ Next: interesting case of memory leak

≪ Previous: wincheck rc8.59

download
mirror
Changelog:

add some support of meltdown patched kernels. It seems that Microsoft backported from w10 InterruptObject to KPRCB on windows 8.1. so all offsets below this field were shifted downward and previous version of wincheck produced BSODs
add dumping of SYSTEM_KERNEL_VA_SHADOW_INFORMATION
add support of windows 10 build 17063
add lots of new WNF IDs names from ADK version 10.1.16299

↧

interesting case of memory leak

June 29, 2018, 5:23 am

≫ Next: WNF IDs from perf_nt_c.dll (adk version 17692)

≪ Previous: wincheck rc8.60

after three weeks of work service osqueryd.exe consumed about 150 mb of memory. so I made full memory dump with process explorer and run !heap -l in windbg
298991 string in log ! lets write quick and ditry perl script to calculate sizes of leaked blocks:

my $state = 0;
my($str, %dict, $size);
while( $str = <> )
{
chomp $str;
lastif ( $str eq'' );
if ( ! $state )
  {
    $state = 1 if ( $str =~ /^-----/ );
next;
  }
  $str = substr($str, 72, 10);
  $str =~ s/^\s+//g;
  $str =~ s/\s+$//g;
  $size = hex($str);
nextif ( !$size );
  $dict{$size} += 1;
}

# dump results
my $iter;
foreach $iter ( sort { $dict{$b} <=> $dict{$a} } keys %dict )
{
printf("%X %d\n", $iter, $dict{$iter});
}

results are encouraging:

it seems that we have pairs of leaked objects with size 0xa0 and 0x4d0. with my partial structs matcher we can find two appropriate candidates - WTSINFOA (size 0x90) and WTSCLIENTA (size 0x4b0). Also can check in IDA content of some blocks - yep, almost certainly they are our found structs.

Qiuck search in source code gives only place where WTSINFOA used - function genLoggedInUsers:

  PWTS_SESSION_INFO_1 pSessionInfo;
  unsigned long count;
  unsigned long level = 1;
  auto res = WTSEnumerateSessionsEx(
      WTS_CURRENT_SERVER_HANDLE, &level, 0, &pSessionInfo, &count);
  for (size_t i = 0; i < count; i++) {
    Row r;

    char* sessionInfo = nullptr;
    unsigned long bytesRet = 0;
    res = WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE,
                                     pSessionInfo[i].SessionId,
                                     WTSSessionInfo,
                                     &sessionInfo,
                                     &bytesRet);
 ...

auto wtsSession = (PWTSINFO)sessionInfo;
...

    if (clientInfo != nullptr) {
      WTSFreeMemoryEx(WTSTypeSessionInfoLevel1, clientInfo, count);
      clientInfo = nullptr;
    }
    if (sessionInfo != nullptr) {
      WTSFreeMemoryEx(WTSTypeSessionInfoLevel1, sessionInfo, count);
      sessionInfo = nullptr;
    }
  }

all seems fine - memory allocated in WTSQuerySessionInformation and free at end of cycle. Can you guess what wrong here ? ok, I could not too
So finally rtfm:

To free the returned buffer, call the WTSFreeMemory function

Yep, this memory leak caused wrong using of windows API functions. Interesting would find this bug existing code analyzers like pvs studio or coverity ?

↧

WNF IDs from perf_nt_c.dll (adk version 17692)

July 3, 2018, 5:30 am

≫ Next: bug in wtsapi32!WTSFreeMemoryExA

≪ Previous: interesting case of memory leak

to compare with

WNF_AAD_DEVICE_REGISTRATION_STATUS_CHANGE id1 A3BC0875 id2 41820F2C
This event is signalled when device changes status of registration in Azure Active Directory.

WNF_ACC_EC_ENABLED id1 A3BC0835 id2 41850D2C
This event is bool signaled to indicate the EC accessibility feature enabled state

WNF_ACT_DATA_UPDATED id1 A3BC0835 id2 41920D2C
Indicates Activity Data has been updated

WNF_AFD_IGNORE_ORDERLY_RELEASE_CHANGE id1 A3BC0875 id2 4182082C
A system entity has requested a change in AFD's orderly release behavior.

WNF_AOW_BOOT_PROGRESS id1 A3BC0875 id2 4191012C
This state is incremented when a discrete part of the AoW boot sequence has completed. Security: WNF_STATE_SUBSCRIBE (1) by everyone (WD) and app containers (S-1-15-2-1); WNF_STATE_SUBSCRIBE | WNF_STATE_PUBLISH (3) by Local System (SY) and the Interactive User account (IU).

WNF_BCST_APP_BROADCAST_STREAM_STATE id1 A3BC0875 id2 15950D2F
Contains the current stream state information for the app broadcast service.

WNF_AI_USERTILE id1 A3BC0875 id2 41C6072C
AppInstallation state name to receive RAW notifications

WNF_AI_PACKAGEINSTALL id1 A3BC1075 id2 41C6072C
This event is signalled when a package install operation completes

WNF_AI_PACKAGEUPDATE id1 A3BC1875 id2 41C6072C
This event is signalled when a package update operation completes

WNF_AI_PACKAGEUNINSTALL id1 A3BC2075 id2 41C6072C
This event is signalled when a package uninstall operation completes

WNF_A2A_APPURIHANDLER_INSTALLED id1 A3BC0875 id2 41877C2C
An app implementing windows.AppUriHandler contract has been installed

WNF_APXI_CRITICAL_PACKAGES_INSTALLED id1 A3BC0875 id2 89E1E2C
This event is fired when all critical packages (those that need to be installed before the shell is displayed) have installed.

WNF_AA_LOCKDOWN_CHANGED id1 A3BC0875 id2 41C60F2C
Mobile lockdown configuration has been changed

WNF_AA_CURATED_TILE_COLLECTION_STATUS id1 A3BC1075 id2 41C60F2C
Curate tile collection for all allowed apps for current AssignedAccess account has been created

WNF_AA_MDM_STATUS_EVENT_LOGGED id1 A3BC1875 id2 41C60F2C
Events are logged to the assigned access status trace logging.

WNF_AUDC_CPUSET_ID id1 A3BC08B5 id2 2821B2C
This state holds the CPU Set ID for audio threads. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_AUDC_PHONECALL_ACTIVE id1 A3BC1075 id2 2821B2C
This state indicates an active phone call, which can be from a cellular call or active Communications category audio streams

WNF_AUDC_TUNER_DEVICE_AVAILABILITY id1 A3BC1875 id2 2821B2C
This notification indicates whether or not the tuner endpoint is available.

WNF_AUDC_HEALTH_PROBLEM id1 A3BC2075 id2 2821B2C
State for problems detected in the audio core.

WNF_AUDC_CPUSET_ID_SYSTEM id1 A3BC2875 id2 2821B2C
This state keeps other system services apprised of the audio-reserved CPU set ID.

WNF_AUDC_RENDER id1 A3BC3075 id2 2821B2C
Reports the number of, and all endpoints currently rendering audio. Returns a WNF_STREAM_EVENT_HEADER data structure

WNF_AUDC_VOLUME_CONTEXT id1 A3BC3875 id2 2821B2C
This notification is raised when contextual volume for endpoints have changed.

WNF_AUDC_CAPTURE id1 A3BC4075 id2 2821B2C
Reports the number of, and process ids of all applications currently capturing audio. Returns a WNF_CAPTURE_STREAM_EVENT_HEADER data structure

WNF_AUDC_RINGERVIBRATE_STATE_CHANGED id1 A3BC4875 id2 2821B2C
Reports the changes to the Ringervibrate state of the device

WNF_AUDC_SPATIAL_STATUS id1 A3BC5075 id2 2821B2C
Reports for each spatial audio endpoint if spatial audio is currently being rendered. Returns a WNF_SPATIAL_STATUS_HEADER data structure

WNF_AUDC_DEFAULT_RENDER_ENDPOINT_PROPERTIES id1 A3BC5875 id2 2821B2C
Reports certain properties of the default render multimedia endpoint whenever the default endpoint changes or a property of interest changes on the default render endpoint

WNF_AUDC_CHAT_APP_CONTEXT id1 A3BC6075 id2 2821B2C
Publishes a list of the current chat applications on the device

WNF_AVA_SOUNDDETECTOR_PATTERN_MATCH id1 A3BC0875 id2 4187182C
This notification is used to signal that a match has been detected for Voice Activation

WNF_AVLC_DRIVER_REQUEST id1 A3BC0875 id2 28A182C
A driver requst permission for volume limit change.

WNF_AVLC_VOLUME_WARNING_ACCEPTED id1 A3BC1075 id2 28A182C
This event propagates the user's choice from the warning dialog.

WNF_AVLC_SHOW_VOLUMELIMITWARNING id1 A3BC1875 id2 28A182C
This event informs the system that we need to show reached volume limit warning message

WNF_ACHK_SP_CORRUPTION_DETECTED id1 A3BC0875 id2 A8E0D2C
Event fired when we scan the System Partition and find corruption.

WNF_BMP_BG_PLAYSTATE_CHANGED id1 A3BC0875 id2 4196032F
The background media player's playstate has changed.

WNF_BMP_BG_PLAYBACK_REVOKED id1 A3BC1075 id2 4196032F
The following tasks aren't able to play under current policy

WNF_OS_IP_OVER_USB_AVAILABLE id1 A3BC8075 id2 41C61D22
IP Over USB Availability. SDDL comes from ID_CAP_EVERYONE and IpOverUsb in %SDXROOT%\src\baseos\prod\packages\MfgIpOverUsb\MfgIpOverUsb.pkg.xml

WNF_OS_IU_PROGRESS_REPORT id1 A3BC8875 id2 41C61D22
Update progress reporting status. SDDL comes from ID_CAP_BASEOS_UPDATEAPI in %SDXROOT%\src\baseos\prod\packages\imgupd\MainOS\ImgUpd.pkg.xml

WNF_FVE_DE_SUPPORT id1 A3BC0875 id2 4183182B
This event triggers when Device Encryption support status is evaluated, and receives the result of that evaluation.

WNF_FVE_DE_MANAGED_VOLUMES_COUNT id1 A3BC1075 id2 4183182B
This event triggers when the BitLocker service detects a change in the count of DE-managed volumes, and includes the count of such volumes.

WNF_FVE_WIM_HASH_GENERATION_TRIGGER id1 A3BC1875 id2 4183182B
This event triggers or signals to stop WIM hash generation task.

WNF_FVE_WIM_HASH_GENERATION_COMPLETION id1 A3BC2075 id2 4183182B
This event signals completion of WIM hash generation.

WNF_FVE_WIM_HASH_DELETION_TRIGGER id1 A3BC2875 id2 4183182B
This event triggers WIM hash deletion.

WNF_FVE_BDESVC_TRIGGER_START id1 A3BC3075 id2 4183182B
This event trigger-starts BdeSvc service.

WNF_FVE_STATE_CHANGE id1 A3BC3875 id2 4183182B
This event triggers on every BitLocker state change.

WNF_FVE_MDM_POLICY_REFRESH id1 A3BC4075 id2 4183182B
This event triggers where RequireDeviceEncryption policy arrives under the BitLocker area.

WNF_FVE_REQUIRE_SDCARD_ENCRYPTION id1 A3BC4875 id2 4183182B
This event triggers SD card encrytion policy arrival notification.

WNF_FVE_SDCARD_ENCRYPTION_REQUEST id1 A3BC5075 id2 4183182B
This event triggers SecTask to enable/disable SD Card encryption.

WNF_FVE_SDCARD_ENCRYPTION_STATUS id1 A3BC5875 id2 4183182B
This event indicates completion of SD Card encryption/decryption request.

WNF_FVE_DETASK_TRIGGER_START id1 A3BC6075 id2 4183182B
This event trigger-starts device encryption task.

WNF_FVE_BITLOCKER_ENCRYPT_ALL_DRIVES id1 A3BC6875 id2 4183182B
This event triggers BitLocker task to enable BitLocker on all volumes.

WNF_BLTH_BLUETOOTH_STATUS id1 A3BC0875 id2 992022F
State name for Bluetooth overall status notification. Flags from the BLUETOOTH_GLOBAL_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTConnMgr in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml

WNF_BLTH_BLUETOOTH_AUDIO_GATEWAY_STATUS id1 A3BC1075 id2 992022F
State name for Bluetooth Audio Gateway status notification. A 32-bit bitmask of BLUETOOTH_AUDIO_GATEWAY_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTAGService in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml

WNF_BLTH_BLUETOOTH_MAP_STATUS id1 A3BC1875 id2 992022F
State name for Bluetooth MAP status notification. A 32-bit bitmask of BLUETOOTH_MAP_STATUS enum are returned.

WNF_BLTH_BLUETOOTH_CONNECTION_STATE_CHANGE id1 A3BC2075 id2 992022F
Indicates when a Bluetooth Device gets connected and disconnected

WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_REQUEST id1 A3BC2875 id2 992022F
Indicates that a legacy Gatt client request is present. The local radio and remote device BTH_ADDR are returned.

WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_INVALIDATE_TOKEN id1 A3BC3075 id2 992022F
Indicates that a legacy Gatt client request was no longer present. The previously granted access token to be revoked is returned.

WNF_BLTH_BLUETOOTH_QUICKPAIR_STATUS_CHANGED id1 A3BC3875 id2 992022F
Notification that the user requested a change to the status of the QuickPair engine.

WNF_BLTH_BLUETOOTH_AVRCP_VOLUME_CHANGED id1 A3BC4075 id2 992022F
Notification that the user has changed the volume level using AVRCP on a Bluetooth peripheral.

WNF_BLTH_BLUETOOTH_DEVICE_BATTERY_IS_LOW id1 A3BC4875 id2 992022F
Notification that a Bluetooth device's battery is low.

WNF_BLTH_BLUETOOTH_LE_ADV_SCANNING_STATUS id1 A3BC5075 id2 992022F
Exposes the status of Bluetooth LE Advertisement scanning.

WNF_BOOT_DIRTY_SHUTDOWN id1 A3BC0875 id2 1589012F
The state is published once the previous shutdown was not clean.

WNF_BOOT_INVALID_TIME_SOURCE id1 A3BC1075 id2 1589012F
The state is published if system time is initialized with a backup time source.

WNF_BOOT_MEMORY_PARTITIONS_RESTORE id1 A3BC1875 id2 1589012F
The state reflects memory partiton restoration state (nothing to restore, restore in progress, restore completed, failure)

WNF_BRI_ACTIVE_WINDOW id1 A3BC0875 id2 418F1C2F
Notifies brightness classes of the active window in order to apply their brightness preferences

WNF_BI_BROKER_WAKEUP_CHANNEL id1 A3BC0875 id2 41C6072F
Background work execution trigger

WNF_BI_USER_LOGON_CHANNEL id1 A3BC1075 id2 41C6072F
BI user logon system state notification channel

WNF_BI_USER_LOGOFF_CHANNEL id1 A3BC1875 id2 41C6072F
BI user logoff system state notification channel

WNF_BI_SESSION_CONNECT_CHANNEL id1 A3BC2075 id2 41C6072F
BI session connect system state notification channel

WNF_BI_SESSION_DISCONNECT_CHANNEL id1 A3BC2875 id2 41C6072F
BI session disconnect system state notification channel

WNF_BI_APPLICATION_UNINSTALL_CHANNEL id1 A3BC3075 id2 41C6072F
BI application uninstall system state notification channel

WNF_BI_APPLICATION_SERVICING_START_CHANNEL id1 A3BC3875 id2 41C6072F
BI application servicing start system state notification channel

WNF_BI_APPLICATION_SERVICING_STOP_CHANNEL id1 A3BC4075 id2 41C6072F
BI application servicing stop system state notification channel

WNF_BI_LOCK_SCREEN_UPDATE_CHANNEL id1 A3BC4875 id2 41C6072F
BI lock screen update system state notification channel

WNF_BI_EVENT_DELETION id1 A3BC5075 id2 41C6072F
BI event deletion system state notification channel

WNF_BI_PSM_TEST_HOOK_CHANNEL id1 A3BC5875 id2 41C6072F
PSM policy test hook

WNF_BI_QUIET_MODE_UPDATE_CHANNEL id1 A3BC6075 id2 41C6072F
BI Quiet Mode update system state notification channel

WNF_BI_BI_READY id1 A3BC6835 id2 41C6072F
Indicates that BI is ready and also publish channels list for each session

WNF_BI_NOTIFY_NEW_SESSION id1 A3BC7075 id2 41C6072F
BI notify new session system state notification channel

WNF_BI_QUERY_APP_USAGE id1 A3BC7875 id2 41C6072F
PSM notification to clients for querying application performance usage

WNF_BI_NETWORK_LIMITED_CHANNEL id1 A3BC8075 id2 41C6072F
Notification that the system is entering or exiting a network limited standby

WNF_CCTL_BUTTON_REQUESTS id1 A3BC08B5 id2 D920D2E
A button press has caused a request.

WNF_CAM_APPDIAGNOSTICS_ACCESS_CHANGED id1 A3BC0875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_APPOINTMENTS_ACCESS_CHANGED id1 A3BC1075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_BLUETOOTH_ACCESS_CHANGED id1 A3BC1875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_CAMERA_ACCESS_CHANGED id1 A3BC2075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_CELLULARDATA_ACCESS_CHANGED id1 A3BC2875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_CHAT_ACCESS_CHANGED id1 A3BC3075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_CONTACTS_ACCESS_CHANGED id1 A3BC3875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_EMAIL_ACCESS_CHANGED id1 A3BC4075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_HID_ACCESS_CHANGED id1 A3BC4875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_LOCATION_ACCESS_CHANGED id1 A3BC5075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_MICROPHONE_ACCESS_CHANGED id1 A3BC5875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_PHONECALL_ACCESS_CHANGED id1 A3BC6075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_PHONECALLHISTORY_ACCESS_CHANGED id1 A3BC6875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_POS_ACCESS_CHANGED id1 A3BC7075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_RADIOS_ACCESS_CHANGED id1 A3BC7875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_SENSORSCUSTOM_ACCESS_CHANGED id1 A3BC8075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_SERIAL_ACCESS_CHANGED id1 A3BC8875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_USB_ACCESS_CHANGED id1 A3BC9075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_USERACCOUNTINFO_ACCESS_CHANGED id1 A3BC9875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_USERDATATASKS_ACCESS_CHANGED id1 A3BCA075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_USERNOTIFICATIONLISTENER_ACCESS_CHANGED id1 A3BCA875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_DOCUMENTSLIBRARY_ACCESS_CHANGED id1 A3BCB075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_PICTURESLIBRARY_ACCESS_CHANGED id1 A3BCB875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_VIDEOSLIBRARY_ACCESS_CHANGED id1 A3BCC075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_GAZEINPUT_ACCESS_CHANGED id1 A3BCC875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_BROADFILESYSTEMACCESS_ACCESS_CHANGED id1 A3BCD075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_ACTIVITY_ACCESS_CHANGED id1 A3BCD875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_BLUETOOTHSYNC_ACCESS_CHANGED id1 A3BCE075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CAM_WIFIDIRECT_ACCESS_CHANGED id1 A3BCE875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes

WNF_CDP_CDPSVC_READY id1 A3BC0875 id2 41960A2E
Indicates CDP Service is ready

WNF_CDP_CDPSVC_STOPPING id1 A3BC1075 id2 41960A2E
Indicates CDP Service is stopping

WNF_CDP_CDPUSERSVC_READY id1 A3BC1835 id2 41960A2E
Indicates CDP User Service is ready

WNF_CDP_CDPUSERSVC_STOPPING id1 A3BC2035 id2 41960A2E
Indicates CDP User Service is stopping

WNF_CDP_CDP_MESSAGES_QUEUED id1 A3BC2875 id2 41960A2E
Indicates CDP service queued the message(s) for designated applications

WNF_CDP_CDP_ACTIVITIES_RECIEVED id1 A3BC3075 id2 41960A2E
Indicates CDP service received new activities

WNF_CDP_USERAUTH_POLICY_CHANGE id1 A3BC3875 id2 41960A2E
Indicates that the user has changed the CDP policy

WNF_CDP_CDP_NOTIFICATION_ACTION_FORWARD_FAILURE id1 A3BC4075 id2 41960A2E
Indicates failure either delivering or invoking a Notification Action on a remote device

WNF_CDP_USER_ROME_SETTING_CHANGE id1 A3BC4835 id2 41960A2E
Indicates that the user has changed Rome SDK authorization setting

WNF_CDP_USER_NEAR_SHARE_SETTING_CHANGE id1 A3BC5035 id2 41960A2E
Indicates that the user has changed Near Share authorization setting

WNF_CDP_ENABLE_ACTIVITYFEED_POLICY_CHANGE id1 A3BC5875 id2 41960A2E
Indicates whether ActivityFeed is enabled. It is responsible for mirroring different activity types (as applicable) across device graph of the user.

WNF_CDP_PUBLISH_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC6075 id2 41960A2E
Indicates the settings policy (enabled/disabled) for 'User Activity' publishing has changed.

WNF_CDP_CDP_LOCAL_ACTIVITIES_RECIEVED id1 A3BC6875 id2 41960A2E
Indicates CDP service received local activities

WNF_CDP_USER_RESOURCE_INFO_CHANGED id1 A3BC7075 id2 41960A2E
Indicates the persisted values associated with a resource has changed.

WNF_CDP_UPLOAD_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC7875 id2 41960A2E
Indicates the settings policy (enabled/disabled) for 'User Activity' upload has changed.

WNF_CDP_ALLOW_CLIPBOARDHISTORY_POLICY_CHANGE id1 A3BC8075 id2 41960A2E
Indicates clipboard history policy has changed.

WNF_CDP_ALLOW_CROSSDEVICECLIPBOARD_POLICY_CHANGE id1 A3BC8875 id2 41960A2E
Indicates cross device clipboard policy has changed.

WNF_CELL_POWER_STATE_MODEM0 id1 A3BC0875 id2 D8A0B2E
Modem power state of the first modem, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_EVERYONE, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SIGNAL_STRENGTH_BARS_CAN0 id1 A3BC1075 id2 D8A0B2E
Number of bars (0..5) of signal strength for the first cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SYSTEM_TYPE_CAN0 id1 A3BC1875 id2 D8A0B2E
System type of the first cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_STATUS_CAN0 id1 A3BC2075 id2 D8A0B2E
Current registration status of the first cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_STATUS_SLOT0 id1 A3BC2875 id2 D8A0B2E
Status of the UICC in the first slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_AIRPLANEMODE id1 A3BC3075 id2 D8A0B2E
The current state of airplanemode. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_OPERATOR_NAME_CAN0 id1 A3BC3875 id2 D8A0B2E
Current serving operator for the first cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CDMA_ACTIVATION_CAN0 id1 A3BC4075 id2 D8A0B2E
Activation, PRL, and provisioning state for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_NETWORK_TIME_CAN0 id1 A3BC4875 id2 D8A0B2E
NITZ information for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_AVAILABLE_OPERATORS_CAN0 id1 A3BC5075 id2 D8A0B2E
List of available operators for the first cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_DEVICE_INFO_CAN0 id1 A3BC5875 id2 D8A0B2E
Device info (RIL_GetDeviceInfo) for the first cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_DATA_ENABLED_BY_USER_MODEM0 id1 A3BC6475 id2 D8A0B2E
Cellular data enabled state as set by user. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PHONE_NUMBER_CAN0 id1 A3BC6875 id2 D8A0B2E
Phone number (MSISDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_VOICEMAIL_NUMBER_CAN0 id1 A3BC7075 id2 D8A0B2E
Voicemail number (MBDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_PREFERENCES_CAN0 id1 A3BC7C75 id2 D8A0B2E
Registration preferences for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CAN_STATE_CAN0 id1 A3BC8075 id2 D8A0B2E
Can state (between CellManager and CellUX) for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_USER_PREFERRED_POWER_STATE_MODEM0 id1 A3BC8C75 id2 D8A0B2E
Power state of the modem as last preferred by the user, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_AIRPLANEMODE_DETAILS id1 A3BC9075 id2 D8A0B2E
The current state of airplanemode details. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_POSSIBLE_DATA_ACTIVITY_CHANGE_MODEM0 id1 A3BC9875 id2 D8A0B2E
This is triggered if cellcore suspects that data activity may have been affected. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SYSTEM_CONFIG id1 A3BCA475 id2 D8A0B2E
Root state describing cellular system configuration (all modems and their cans). SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN0 id1 A3BCA875 id2 D8A0B2E
Detailed registration status of the first cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_EVERYONE, ID_CAP_ISV_CAMERA, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN0 id1 A3BCB075 id2 D8A0B2E
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PERSO_STATUS_CAN0 id1 A3BCB875 id2 D8A0B2E
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_HOME_OPERATOR_CAN0 id1 A3BCC075 id2 D8A0B2E
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_ISV_CAMERA and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_HOME_PRL_ID_CAN0 id1 A3BCC875 id2 D8A0B2E
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UTK_SETUP_MENU_SLOT0 id1 A3BCE875 id2 D8A0B2E
UICC toolkit setup menu notification for slot 0. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UTK_PROACTIVE_CMD id1 A3BCF075 id2 D8A0B2E
UICC toolkit proactive command notification for all slots. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CSP_WWAN_PLUS_READYNESS id1 A3BCF875 id2 D8A0B2E
CM CSPWWAN+ readyness state. SDDL comes from ID_CAP_CMCSPWWAN_PLUS in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_CELL_CALLFORWARDING_STATUS_CAN0 id1 A3BD0075 id2 D8A0B2E
Call-forwarding status for the first cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_RADIO_TYPE_MODEM0 id1 A3BD0C75 id2 D8A0B2E
Modem radio type of the first modem, values defined by RILRADIOCONFIGURATIONRADIOTYPE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SIGNAL_STRENGTH_BARS_CAN1 id1 A3BD1075 id2 D8A0B2E
Number of bars (0..5) of signal strength for the second cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SYSTEM_TYPE_CAN1 id1 A3BD1875 id2 D8A0B2E
System type of the second cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_STATUS_CAN1 id1 A3BD2075 id2 D8A0B2E
Current registration status of the second cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_STATUS_SLOT1 id1 A3BD2875 id2 D8A0B2E
Status of the UICC in the second slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_OPERATOR_NAME_CAN1 id1 A3BD4075 id2 D8A0B2E
Current serving operator for the second cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CDMA_ACTIVATION_CAN1 id1 A3BD4875 id2 D8A0B2E
Activation, PRL, and provisioning state for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_NETWORK_TIME_CAN1 id1 A3BD5075 id2 D8A0B2E
NITZ information for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_AVAILABLE_OPERATORS_CAN1 id1 A3BD5875 id2 D8A0B2E
List of available operators for the second cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_DEVICE_INFO_CAN1 id1 A3BD6075 id2 D8A0B2E
Device info (RIL_GetDeviceInfo) for the second cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PHONE_NUMBER_CAN1 id1 A3BD7075 id2 D8A0B2E
Phone number (MSISDN) for the second cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_PREFERENCES_CAN1 id1 A3BD8C75 id2 D8A0B2E
Registration preferences for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CAN_STATE_CAN1 id1 A3BD9075 id2 D8A0B2E
Can state (between CellManager and CellUX) for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN1 id1 A3BD9875 id2 D8A0B2E
Detailed registration status of the second cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CELL_WNF, ID_CAP_EVERYONE, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN1 id1 A3BDA075 id2 D8A0B2E
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_HOME_OPERATOR_CAN1 id1 A3BDA875 id2 D8A0B2E
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_HOME_PRL_ID_CAN1 id1 A3BDB075 id2 D8A0B2E
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UTK_SETUP_MENU_SLOT1 id1 A3BDD075 id2 D8A0B2E
UICC toolkit setup menu notification for slot 1. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CALLFORWARDING_STATUS_CAN1 id1 A3BDE075 id2 D8A0B2E
Call-forwarding status for the second cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PERSO_STATUS_CAN1 id1 A3BDE875 id2 D8A0B2E
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CONFIGURED_LINES_CAN0 id1 A3BDF475 id2 D8A0B2E
Configured lines for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CONFIGURED_LINES_CAN1 id1 A3BDFC75 id2 D8A0B2E
Configured lines for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_STATUS_DETAILS_SLOT0 id1 A3BE0075 id2 D8A0B2E
Status details of the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_STATUS_DETAILS_SLOT1 id1 A3BE0875 id2 D8A0B2E
Status details of the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PREFERRED_LANGUAGES_SLOT0 id1 A3BE1075 id2 D8A0B2E
Preferred languages in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PREFERRED_LANGUAGES_SLOT1 id1 A3BE1875 id2 D8A0B2E
Preferred languages in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IMSI_CAN0 id1 A3BE2075 id2 D8A0B2E
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IMSI_CAN1 id1 A3BE2875 id2 D8A0B2E
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_LEGACY_SETTINGS_MIGRATION id1 A3BE3075 id2 D8A0B2E
Migration action for legacy cellcore settings. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_ATR_SLOT0 id1 A3BE3875 id2 D8A0B2E
Answer to reset from the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_ATR_SLOT1 id1 A3BE4075 id2 D8A0B2E
Answer to reset from the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_SIMSEC_SLOT0 id1 A3BE4875 id2 D8A0B2E
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 0. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_SIMSEC_SLOT1 id1 A3BE5075 id2 D8A0B2E
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 1. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_CAN_CONFIGURATION_SET_COMPLETE_MODEM0 id1 A3BE5875 id2 D8A0B2E
Indication that all executors have been configured and that there are no outstanding configurations pending in the modem. SDDL comes from WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_REGISTRATION_CHANGED_TRIGGER_MV id1 A3BE6075 id2 D8A0B2E
This is published when cellcore needs MV to kick in. SDDL comes from ID_CAP_EVERYONE, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN0 id1 A3BE7075 id2 D8A0B2E
Signal-strength details for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN1 id1 A3BE7875 id2 D8A0B2E
Signal-strength details for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_EMERGENCY_CALLBACK_MODE_STATUS id1 A3BE6875 id2 D8A0B2E
Indication about the current emergency callback mode. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IMS_STATUS_CAN0 id1 A3BE8075 id2 D8A0B2E
Current IMS registration for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IMS_STATUS_CAN1 id1 A3BE8875 id2 D8A0B2E
Current IMS registration for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IWLAN_AVAILABILITY_CAN0 id1 A3BE9075 id2 D8A0B2E
iWLAN availability for Can 0, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_IWLAN_AVAILABILITY_CAN1 id1 A3BE9875 id2 D8A0B2E
iWLAN availability for Can 1, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PS_MEDIA_PREFERENCES_CAN0 id1 A3BEA475 id2 D8A0B2E
PS Media preferences for Can 0, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_PS_MEDIA_PREFERENCES_CAN1 id1 A3BEAC75 id2 D8A0B2E
PS Media preferences for Can 1, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_WIFI_CALL_SETTINGS_CAN0 id1 A3BEB075 id2 D8A0B2E
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_WIFI_CALL_SETTINGS_CAN1 id1 A3BEB875 id2 D8A0B2E
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml

WNF_CELL_UICC_PIN_STATE_SLOT0 id1 A3BEC075 id2 D8A0B2E
Reports detailed states of PIN on slot 0. It is private for Wwansvc access only

WNF_CELL_UICC_PIN_STATE_SLOT1 id1 A3BEC875 id2 D8A0B2E
Reports detailed states of PIN on slot 1. It is private for Wwansvc access only

WNF_WWAN_OBJECT_LIST id1 A3BC0875 id2 F87193A
Table of all modems and executors under it.

WNF_WWAN_EUICC_ARRIVAL id1 A3BC1075 id2 F87193A
This event is published by WwanSvc to indicate the arrival of an eUICC.

WNF_WWAN_CELLULAR_STATE_SNAPSHOT_CHANGE id1 A3BC1875 id2 F87193A
This event is published by WwanSvc to indicate a change in cellular state snapshot.

WNF_WWAN_TASK_TRIGGER id1 A3BC2075 id2 F87193A
State name triggering WiFiTask from WwanSvc.

WNF_SMSR_READY id1 A3BC0875 id2 1395033E
Sms Router Broker is ready.

WNF_SMSR_WWAN_READ_DONE id1 A3BC1075 id2 1395033E
Sms Router Broker is ready.

WNF_SMSR_NEW_MESSAGE_RECEIVED id1 A3BC1875 id2 1395033E
Sms Router received a new incoming SMS message.

WNF_IMS_PUSH_NOTIFICATION_RECEIVED id1 A3BC0875 id2 41950324
Push Notification Received from Entitlement Server

WNF_CERT_FLUSH_CACHE_TRIGGER id1 A3BC0875 id2 15940B2E
This event signals flush cache in all processes where flush is enabled.

WNF_CERT_FLUSH_CACHE_STATE id1 A3BC1075 id2 15940B2E
This event signals when flush cache was started and completed in each process where enabled.

WNF_CAPS_CENTRAL_ACCESS_POLICIES_CHANGED id1 A3BC0875 id2 12960F2E
Central Access Policies have been updated

WNF_CLIP_CONTENT_CHANGED id1 A3BC0875 id2 118F022E
This notification is triggered when contents on the clipboard change

WNF_CLIP_HISTORY_CHANGED id1 A3BC1035 id2 118F022E
This notification is triggered when contents of the clipboard history change

WNF_CLIP_ROAMING_CLIPBOARD_ENABLED_CHANGED id1 A3BC1835 id2 118F022E
This notification is triggered when roaming clipboard enabled/disabled setting value changes

WNF_CLIP_CLIPBOARD_HISTORY_ENABLED_CHANGED id1 A3BC2035 id2 118F022E
This notification is triggered when clipboard history enabled/disabled setting value changes

WNF_CXH_WEBAPP_STATUS id1 A3BC0835 id2 418E162E
Notification of web app status change. Payload is status type plus web app cxid of length 512

WNF_CXH_APP_FINISHED id1 A3BC1035 id2 418E162E
Notification when CloudExperienceHost app is finished. Payload is result plus result string of length 512

WNF_CXH_BACK_STATE id1 A3BC1835 id2 418E162E
Notification of web app back button state. Payload is a boolean for on/off

WNF_CXH_BACK id1 A3BC2035 id2 418E162E
Notification when back command is issued

WNF_CXH_OOBE_APP_READY id1 A3BC2875 id2 418E162E
System-wide signal that the CloudExperienceHost app launched during OOBE is ready with its first webapp visible. Payload is a boolean for true/false

WNF_CI_SMODE_CHANGE id1 A3BC0875 id2 41C6072E
This event signals that change of S mode has occurred.

WNF_CSHL_COMPOSER_LAUNCH_READY id1 A3BC0835 id2 D8E1D2E
Core shell has initialized, including all of its services (e.g. TLAVM), and the Product Composer can be launched. If the event has not been fired, then CoreShell is still initializing and the Composer cannot be launched. Payload is a DWORD to inidicate it has been fired.

WNF_CSHL_UI_AUTOMATION id1 A3BC1035 id2 D8E1D2E
On UI Automation.

WNF_CSHL_VIEWHOSTING_READY id1 A3BC2035 id2 D8E1D2E
Fired every time a Composer registers with TLAVM and inidicates that the composer is ready to host applications. If the event has not been fired, then no composer is ready to host applications. Payload is a DWORD to inidicate it has been fired.

WNF_CSHL_PRODUCT_READY id1 A3BC2835 id2 D8E1D2E
Fired every time a Product Composer has finished initializing and indicates that Shell has entered normal operations (i.e. not in restricted mode or running OOBE/PostUpdateUX). If the event has not been fired, then the Product Composer is still initializing. Payload is a DWORD to inidicate it has been fired.

WNF_CSHL_COMPOSER_TEARDOWN id1 A3BC3035 id2 D8E1D2E
When set to the value 1, it indicates that the current composer has finished unintializing.

WNF_CSHL_COMPOSER_CONTEXT_CHANGED id1 A3BC3835 id2 D8E1D2E
Indicates the composer has changed which updates the registry (ComposerManagerBaseKey) indicating which composer can be restored after a crash

WNF_CSHL_SKIP_OOBE_CXH id1 A3BC4035 id2 D8E1D2E
Fired when a test job wants to skip CXH stage of OOBE

WNF_CFCL_SC_CONFIGURATIONS_CHANGED id1 A3BC0875 id2 D85082E
Triggered each time one or more flight configurations changes.

WNF_CFCL_SC_CONFIGURATIONS_DELETED id1 A3BC1075 id2 D85082E
Triggered each time one or more flight configurations is deleted.

WNF_CFCL_SC_CONFIGURATIONS_ADDED id1 A3BC1875 id2 D85082E
Triggered each time one or more flight configurations is added.

WNF_CONT_RESTORE_FROM_SNAPSHOT_COMPLETE id1 A3BC0875 id2 1588012E
Components blocked waiting for restore from snapshot can now continue

WNF_DO_MANAGER_ACTIVE id1 A3BC0875 id2 41C60129
This event triggers when the Delivery Optimization service manager is active or idle

WNF_DO_POLICY_CHANGED id1 A3BC1075 id2 41C60129
Delivery Optimization system policy has been updated

WNF_DBA_DEVICE_ACCESS_CHANGED id1 A3BC0875 id2 41870C29
This event triggers when the user changes device access for an applocation or the user

WNF_SFA_AUTHENTICATION_STAGE_CHANGED id1 A3BC0875 id2 4187083E
This event signals when authentication stage change.

WNF_DSM_DSMAPPINSTALLED id1 A3BC0C75 id2 418B1D29
Notification for when an app is installed so we can register a device background task if necessary.

WNF_DSM_DSMAPPREMOVED id1 A3BC1475 id2 418B1D29
Notification for when an app is removed so we can clean up any registered device background tasks if necessary.

WNF_DMF_UX_COMPLETE id1 A3BC2075 id2 41800329
Signals when data migration is complete after reboot and update results need to be displayed. DWORD[1] = {completed flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml and DuPostUpdateUX in %SDXROOT%\src\devmgmt\du\packages\UX\UX.pkg.xml and WINCAP_SHELL_EXPERIENCE_COMPOSER in %SDXROOT%\shellcommon\Composable\Core\dll\microsoft-windows-coreshell.wm.xml

WNF_DX_STEREO_CONFIG id1 A3BC0C75 id2 41C61629
State stores the current stereo cpl setting. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_MODE_CHANGE_NOTIFICATION id1 A3BC1035 id2 41C61629
Triggered by kernel when mode change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_OCCLUSION_CHANGE_NOTIFICATION id1 A3BC1835 id2 41C61629
Triggered by kernel when any occlusion related OS state change happens.

WNF_DX_NETWORK_DISPLAY_STATE_CHANGE_NOTIFICATION id1 A3BC2035 id2 41C61629
Triggered by kernel when the state of a network display device is changed.

WNF_DX_MONITOR_CHANGE_NOTIFICATION id1 A3BC2835 id2 41C61629
Triggered by kernel when monitor change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_VIDMM_TRIM_NOTIFICATION id1 A3BC30B5 id2 41C61629
Triggered by kernel when video memory has to be trimmed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_VIDMM_BUDGETCHANGE_NOTIFICATION id1 A3BC3875 id2 41C61629
Triggered by kernel when video memory budget for an application changes. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_HARDWARE_CONTENT_PROTECTION_TILT_NOTIFICATION id1 A3BC4075 id2 41C61629
Triggered by hardware content protection tilt detection. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_INTERNAL_PANEL_DIMENSIONS id1 A3BC4875 id2 41C61629
Stores information about the physical dimensions (in mm) of the integrated panel if available, and 0's if not.

WNF_DX_MODERN_OUTPUTDUPLICATION id1 A3BC5035 id2 41C61629
Triggered when a lowbox application starts or stops using OutputDuplication.

WNF_DX_DISPLAY_CONFIG_CHANGE_NOTIFICATION id1 A3BC5835 id2 41C61629
Triggered by kernel when a change is made to the display configuration.

WNF_DX_DEVICE_REMOVAL id1 A3BC60B5 id2 41C61629
Triggered when a device has been removed for any reason, not just adapter removal. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_DX_MODERN_OUTPUTDUPLICATION_CONTEXTS id1 A3BC6835 id2 41C61629
Triggered when a lowbox application starts or stops using OutputDuplication and provides list of active lowbox contexts

WNF_DX_COLOR_PROFILE_CHANGE id1 A3BC7035 id2 41C61629
Triggered when the default color profile for any attached display changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_DX_GPM_TARGET id1 A3BC7875 id2 41C61629
State is used to indicate the process that should be targeted by GPM.

WNF_DX_ADAPTER_START id1 A3BC8075 id2 41C61629
Triggered by kernel when a GPU is started. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_ADAPTER_STOP id1 A3BC8875 id2 41C61629
Triggered by kernel when a GPU is stopped. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_DX_SDR_WHITE_LEVEL_CHANGED id1 A3BC9035 id2 41C61629
Triggered by kernel when SDR white level value is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_DX_COLOR_OVERRIDE_STATE_CHANGE id1 A3BC9875 id2 41C61629
Triggered when any of the color overrides are changed for any display.

WNF_DX_DISPLAY_COLORIMETRY_DATA_CHANGED id1 A3BCA035 id2 41C61629
Triggered by kernel when colorimetry data is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_DISK_SCRUB_REQUIRED id1 A3BC0875 id2 A950729
This event signals when a disk that requires scrubbing is brought online

WNF_DXGK_ADAPTER_TDR_NOTIFICATION id1 A3BC0875 id2 A811629
Triggered by the kernel when any adapter receives a TDR or PNP event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_DXGK_PATH_FAILED_OR_INVALIDATED id1 A3BC1075 id2 A811629
Triggered by the kernel when an active display path asynchronously transitions to either a failed or invalidated state

WNF_DNS_ALL_SERVER_TIMEOUT id1 A3BC1075 id2 41950029
When all the DNS Servers Timeout, this event is notified

WNF_DWM_RUNNING id1 A3BC0835 id2 418B1929
Triggered when the dwm starts/terminates

WNF_DWM_HOLOGRAPHIC_COMPOSITOR_EXCLUSIVE_LOW_FRAMERATE id1 A3BC1035 id2 418B1929
Triggered when exclusive mode apps are presenting at a low framerate to the holographic compositor

WNF_DWM_HOLOGRAPHIC_COMPOSITOR_HAS_PROTECTED_CONTENT id1 A3BC1835 id2 418B1929
Triggered when the compositor toggles between not having and having (any) protected content

WNF_DWM_HOLOGRAPHIC_COMPOSITOR_LOW_FRAMERATE id1 A3BC2035 id2 418B1929
Triggered when 3D compositor is presenting at a low framerate

WNF_DWM_COMPOSITIONCAPABILITIES id1 A3BC2835 id2 418B1929
Triggered when the dwm composition capabilities changes

WNF_EAP_APPLICATION_HANDLE id1 A3BC0875 id2 41960F28
State name for holding application window handle of calling UX

WNF_EOA_NARRATOR_FOCUS_CHANGE id1 A3BC08F5 id2 41870128
Narrator has moved its focused region

WNF_EOA_NARRATOR_RUNNING id1 A3BC1075 id2 41870128
Represents whether Narrator is currently running. A 32-bit unsigned integer with a zero value meaning Narrator is off.

WNF_EOA_UISETTINGS_CHANGED id1 A3BC1875 id2 41870128
UISettings have changed. The payload carries an identifier for the particular setting that has changed, such as TextScaleFactor.

WNF_EDGE_LAST_NAVIGATED_HOST id1 A3BC08F5 id2 4810A28
This event is fired when a top level frame navigation is complete, the payload contains the host name

WNF_EDGE_EXTENSION_INSTALLED id1 A3BC10F5 id2 4810A28
This event is fired when an extension is installed. The payload is the extension id

WNF_EDGE_EXTENSION_AVAILABLE id1 A3BC18F5 id2 4810A28
This event is fired on edge open if any extension is installed

WNF_EDGE_INPRIVATE_EXTENSION_AVAILABLE id1 A3BC20F5 id2 4810A28
This event is fired on edge open if any extension, supported in InPrivate, is installed

WNF_EDP_TAGGED_APP_LAUNCHED id1 A3BC0835 id2 41960A28
The application was launched in the specified mode under the specified Enterprise context.

WNF_EDP_IDENTITY_REVOKED id1 A3BC10F5 id2 41960A28
The keys associated with a data protection identity were removed.

WNF_EDP_DPL_KEYS_STATE id1 A3BC1875 id2 41960A28
Current state of the Data Protection under Lock private keys

WNF_EDP_CLIPBOARD_METADATA_CHANGED id1 A3BC2035 id2 41960A28
Either a copy or override operation occurred, leading to clipboard metadata changes. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.

WNF_EDP_DIALOG_CANCEL id1 A3BC2835 id2 41960A28
An EDP blocking dialog has been canceled programmatically.

WNF_EDP_APP_UI_ENTERPRISE_CONTEXT_CHANGED id1 A3BC3035 id2 41960A28
Application UI EDP context has been changed for the process.

WNF_EDP_AAD_REAUTH_REQUIRED id1 A3BC3875 id2 41960A28
The AAD token used by EDP has expired.

WNF_EDP_ENTERPRISE_CONTEXTS_UPDATED id1 A3BC4475 id2 41960A28
The EDP enterprise contexts have been updated.

WNF_EDP_PROCESS_UI_ENFORCEMENT id1 A3BC4875 id2 41960A28
EDP process UI enforcement global state

WNF_EDP_PROCESS_TLS_INDEX id1 A3BC50B5 id2 41960A28
EDP thread UI enforcement. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.

WNF_EDP_DPL_KEYS_DROPPING id1 A3BC5875 id2 41960A28
Data Protection under Lock private keys will be dropped from memory shortly.

WNF_EDP_MISSING_CREDENTIALS id1 A3BC6075 id2 41960A28
EDP cred service cannot access credentials required

WNF_EDP_PURGE_APP_LEARNING_EVT id1 A3BC6875 id2 41960A28
Purge application learning events cache

WNF_EDP_CREDENTIALS_UPDATING id1 A3BC7075 id2 41960A28
Cred service is updating user credentials.

WNF_EDU_PRINTER_POLICY_CHANGED id1 A3BC0875 id2 41930A28
This event is triggered when an MDM printer policy is changed.

WNF_EFS_SERVICE_START id1 A3BC0875 id2 41950828
This event trigger-starts EFS service.

WNF_EFS_SOFTWARE_HIVE_AVAILABLE id1 A3BC1075 id2 41950828
EFS service needs to check GP at boot, which requires the SOFTWARE hive in HKLM. This signals its availability when EFS worker thread detects it.

WNF_ENTR_DEVICELOCK_POLICY_VALUE_CHANGED id1 A3BC0875 id2 13920028
Current changed policy values represented as bits for the Device Lock policy area. SDDL comes from NgcctnrSvc in %SDXROOT%\src\baseos\prod\packages\ngc\ngc.pkg.xml and ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml, %sdxroot%\onecoreuap\admin\dm\wap\service\dmwappushservice.wm.xml

WNF_ENTR_WIFI_POLICY_VALUE_CHANGED id1 A3BC1075 id2 13920028
Current changed policy values represented as bits for the Wifi policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_SYSTEM_POLICY_VALUE_CHANGED id1 A3BC1875 id2 13920028
Current changed policy values represented as bits for the System policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xmlSDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_CONNECTIVITY_POLICY_VALUE_CHANGED id1 A3BC2075 id2 13920028
Current changed policy values represented as bits for the Connectivity policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED id1 A3BC2875 id2 13920028
Current changed policy values represented as bits for the Experience policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ACCOUNTS_POLICY_VALUE_CHANGED id1 A3BC3075 id2 13920028
Current changed policy values represented as bits for the Accounts policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_SECURITY_POLICY_VALUE_CHANGED id1 A3BC3875 id2 13920028
Current changed policy values represented as bits for the Security policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_BROWSER_POLICY_VALUE_CHANGED id1 A3BC4075 id2 13920028
Current changed policy values represented as bits for the Browser policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_UPDATE_POLICY_VALUE_CHANGED id1 A3BC4875 id2 13920028
Current changed policy values represented as bits for the Update policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_CAMERA_POLICY_VALUE_CHANGED id1 A3BC5075 id2 13920028
Current changed policy values represented as bits for the Camera policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_APPLICATIONMANAGEMENT_POLICY_VALUE_CHANGED id1 A3BC5875 id2 13920028
Current changed policy values represented as bits for the ApplicationManagement policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_REQUIRE_DEVICE_ENCRYPTION_POLICY_VALUE_CHANGED id1 A3BC6075 id2 13920028
Current changed security policy RequireDeviceEncryption value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_PUSH_NOTIFICATION_RECEIVED id1 A3BC6875 id2 13920028
An MDM Push notification has been received. SDDL comes from ID_CAP_CSP_DMCLIENT in %SDXROOT%\src\devmgmt\dm\packages\dmapps\dmapps.pkg.xml

WNF_ENTR_SEARCH_POLICY_VALUE_CHANGED id1 A3BC7075 id2 13920028
Current changed policy values represented as bits for the Search policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ABOVELOCK_POLICY_VALUE_CHANGED id1 A3BC7875 id2 13920028
Current changed policy values represented as bits for the AboveLock policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ALLOWAPPLICATIONS_POLICY_VALUE_CHANGED id1 A3BC8075 id2 13920028
A Dataprotection AllowApplications provider policy value has changed.

WNF_ENTR_EDPENFORCEMENTLEVEL_POLICY_VALUE_CHANGED id1 A3BC8875 id2 13920028
A Dataprotection EDPEnforcementLevel provider policy value has changed.

WNF_ENTR_WAP_MESSAGE_FOR_DMWAPPUSHSVC_READY id1 A3BC9075 id2 13920028
A WAP message has been received that dmwappushsvc needs to handle.

WNF_ENTR_CONTEXT_STATE_CHANGE id1 A3BC9875 id2 13920028
An enterprise context has changed it's state

WNF_ENTR_PUSH_RECEIVED id1 A3BCA075 id2 13920028
An enterprise WNS based push was received

WNF_ENTR_ALLOWINPUTPANEL_POLICY_VALUE_CHANGED id1 A3BCA875 id2 13920028
A TextInput AllowInputPanel provider policy value has changed.

WNF_ENTR_SEARCH_ALLOW_USING_DIACRITICS id1 A3BCB075 id2 13920028
Allow use of diacritics for indexing.

WNF_ENTR_SEARCH_ALWAYS_USE_AUTO_LANG_DETECTION id1 A3BCB875 id2 13920028
Always use automatic language detection when indexing content and properties.

WNF_ENTR_SEARCH_DISABLE_REMOVABLE_DRIVE_INDEXING id1 A3BCC075 id2 13920028
Do not allow locations on removable drives to be added to libraries.

WNF_ENTR_SEARCH_PREVENT_INDEXING_LOW_DISK_SPACE_MB id1 A3BCC875 id2 13920028
Stop indexing in the event of limited hard drive space.

WNF_ENTR_SEARCH_ALLOW_INDEXING_ENCRYPTED_STORES_OR_ITEMS id1 A3BCD075 id2 13920028
Allow indexing of encrypted files.

WNF_ENTR_BLUETOOTH_POLICY_VALUE_CHANGED id1 A3BCD875 id2 13920028
Bluetooth policy configuration has changed. SDDL comes from ID_CAP_POLICY_MANAGER in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_EDPNETWORKING_POLICY_VALUE_CHANGED id1 A3BCE075 id2 13920028
A Dataprotection networking policy value has changed.

WNF_ENTR_REQUIRE_DPL_POLICY_VALUE_CHANGED id1 A3BCE875 id2 13920028
DataProtection Require Protection Under Lock Config policy change.

WNF_ENTR_WINDOWS_DEFENDER_POLICY_VALUE_CHANGED id1 A3BCF075 id2 13920028
Windows Defender policy configuration has changed.

WNF_ENTR_ALLOWALLTRUSTEDAPPS_POLICY_VALUE_CHANGED id1 A3BCF875 id2 13920028
ApplicationManagement AllowAllTrustedApps provider policy value has changed.

WNF_ENTR_ALLOWSHAREDUSERDATA_POLICY_VALUE_CHANGED id1 A3BD0075 id2 13920028
ApplicationManagement AllowSharedUserAppData provider policy value has changed.

WNF_ENTR_RESTRICTAPPTOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD0875 id2 13920028
ApplicationManagement RestrictAppToSystemVolume provider policy value has changed.

WNF_ENTR_RESTRICTAPPDATATOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD1075 id2 13920028
ApplicationManagement RestrictAppDataToSystemVolume provider policy value has changed.

WNF_ENTR_ALLOWDEVELOPERUNLOCK_POLICY_VALUE_CHANGED id1 A3BD1875 id2 13920028
ApplicationManagement AllowDeveloperUnlock provider policy value has changed.

WNF_ENTR_ALLOWUPDATESERVICE_POLICY_VALUE_CHANGED id1 A3BD2075 id2 13920028
Update AllowUpdateService provider policy value has changed.

WNF_ENTR_UPDATESERVICEURL_POLICY_VALUE_CHANGED id1 A3BD2875 id2 13920028
Update UpdateServiceUrl provider policy value has changed.

WNF_ENTR_ALLOWNONMICROSOFTSIGNEDUPDATE_POLICY_VALUE_CHANGED id1 A3BD3075 id2 13920028
Update AllowNonMicrosoftSignedUpdate provider policy value has changed.

WNF_ENTR_ALLOW_WBA_EXECUTION_POLICY_VALUE_CHANGED id1 A3BD3875 id2 13920028
DisableWBA policy value has changed.

WNF_ENTR_DOMAIN_NAMES_FOR_EMAIL_SYNC_POLICY_VALUE_CHANGED id1 A3BD4075 id2 13920028
The domains for which email is disabled have changed.

WNF_ENTR_ALLOWCELLULARDATAROAMING_POLICY_VALUE_CHANGED id1 A3BD4875 id2 13920028
The AllowCellularDataRoaming policy value has changed.

WNF_ENTR_ALLOWCELLULARDATA_POLICY_VALUE_CHANGED id1 A3BD5075 id2 13920028
The AllowCellularData policy value has changed.

WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED id1 A3BD5C75 id2 13920028
EDPEnforcementLevel cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.

WNF_ENTR_PROTECTEDDOMAINNAMES_CACHED_POLICY_VALUE_CHANGED id1 A3BD6475 id2 13920028
EnterpriseProtectedDomainNames cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.

WNF_ENTR_ALLOWMESSAGESYNC_POLICY_VALUE_CHANGED id1 A3BD6875 id2 13920028
The AllowMessageSync policy value has changed.

WNF_ENTR_DISABLEADVERTISINGID_POLICY_VALUE_CHANGED id1 A3BD7075 id2 13920028
Privacy DisableAdvertisingId policy value has changed.

WNF_ENTR_EVALUATE_EDP_CONFIGURATION_STATE id1 A3BD7875 id2 13920028
EnterpriseDataProtection (EDP) state has changed.

WNF_ENTR_APPHVSI_CACHED_POLICY_VALUE_CHANGED id1 A3BD8475 id2 13920028
AllowAppHVSI cached policy has changed.

WNF_ENTR_NETWORKISOLATION_POLICY_VALUE_CHANGED id1 A3BD8875 id2 13920028
A NetworkIsolation area policy value has changed.

WNF_ENTR_EVALUATE_APPHVSI_CONFIGURATION_STATE id1 A3BD9075 id2 13920028
AppHVSI (Hypervisor-based Virtualized Security Isolation) state has changed.

WNF_ENTR_EDPSHOWICONS_CACHED_POLICY_VALUE_CHANGED id1 A3BD9C75 id2 13920028
EdpShowIcons policy value has changed.

WNF_ENTR_ALLOWWIFI_POLICY_VALUE_CHANGED id1 A3BDB075 id2 13920028
AllowWifi policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ALLOWMANUALWIFICONFIGURATION_POLICY_VALUE_CHANGED id1 A3BDB875 id2 13920028
AllowManualWifiConfiguration policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_SEARCH_ALLOW_INDEXER id1 A3BDC075 id2 13920028
Allow windows indexer.

WNF_ENTR_ALLOWWIFIDIRECT_POLICY_VALUE_CHANGED id1 A3BDC875 id2 13920028
AllowWifiDirect policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ALLOWPROJECTIONTOPC_POLICY_VALUE_CHANGED id1 A3BDD075 id2 13920028
AllowProjectionToPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_ALLOWMESSAGE_MMS_POLICY_VALUE_CHANGED id1 A3BDD875 id2 13920028
The AllowMessageMMS policy value has changed.

WNF_ENTR_ALLOWMESSAGE_RCS_POLICY_VALUE_CHANGED id1 A3BDE075 id2 13920028
The AllowMessageRCS policy value has changed.

WNF_ENTR_EDPSMB_POLICY_VALUE_CHANGED id1 A3BDE875 id2 13920028
SMBAutoEncryptedFileExtensions policy value has changed.

WNF_ENTR_APPHVSI_POLICY_VALUE_CHANGED id1 A3BDF075 id2 13920028
Any AppHVSI policy value is changed

WNF_ENTR_ALLOWSET24HOURCLOCK_POLICY_VALUE_CHANGED id1 A3BDF875 id2 13920028
The AllowSet24HourClock policy value has changed.

WNF_ENTR_ALLOWPROJECTIONFROMPC_POLICY_VALUE_CHANGED id1 A3BE0075 id2 13920028
AllowProjectionFromPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml

WNF_ENTR_EXPLOITGUARD_POLICY_VALUE_CHANGED id1 A3BE0875 id2 13920028
The ExploitGuard policy values have changed.

WNF_ENTR_WINDOWSDEFENDERSECURITYCENTER_POLICY_VALUE_CHANGED id1 A3BE1075 id2 13920028
The WindowsDefenderSecurityCenter policy values have changed.

WNF_ENTR_APPPRIVACY_POLICY_VALUE_CHANGED id1 A3BE1875 id2 13920028
Event fired when app privacy policy values have changed

WNF_ENTR_ENABLETOUCHKEYBOARDAUTOINVOKE_POLICY_VALUE_CHANGED id1 A3BE2075 id2 13920028
A TextInput EnableTouchKeyboardAutoInvokeInDesktopMode policy value has changed.

WNF_ENTR_FULLLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE2875 id2 13920028
A TextInput TouchKeyboardFullModeAvailability policy value has changed.

WNF_ENTR_WIDELAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3075 id2 13920028
A TextInput TouchKeyboardWideModeAvailability policy value has changed.

WNF_ENTR_NARROWLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3875 id2 13920028
A TextInput TouchKeyboardNarrowModeAvailability policy value has changed.

WNF_ENTR_HANDWRITING_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4075 id2 13920028
A TextInput TouchKeyboardHandwritingModeAvailability policy value has changed.

WNF_ENTR_SPLITLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4875 id2 13920028
A TextInput TouchKeyboardSplitModeAvailability policy value has changed.

WNF_ENTR_EMOJI_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE5075 id2 13920028
A TextInput TouchKeyboardEmojiButtonAvailability policy value has changed.

WNF_ENTR_FORCEDOCKED_TOUCHKEYBOARD_POLICY_VALUE_CHANGED id1 A3BE5875 id2 13920028
A TextInput ForceTouchKeyboardDockedState policy value has changed.

WNF_ENTR_TOUCHKEYBOARDDICTATION_POLICY_VALUE_CHANGED id1 A3BE6075 id2 13920028
A TextInput TouchKeyboardDictationButtonAvailability policy value has changed.

WNF_ENTR_BITS_POLICY_VALUE_CHANGED id1 A3BE6875 id2 13920028
BITS policy area value has changed.

WNF_ETW_SUBSYSTEM_INITIALIZED id1 A3BC0875 id2 41911A28
ETW subsystem initialized

WNF_EXEC_OSTASKCOMPLETION_REVOKED id1 A3BC0875 id2 2831628
This event signal when a task completion has been revoked due to memory pressure

WNF_EXEC_THERMAL_LIMITER_CLOSE_APPLICATION_VIEWS id1 A3BC1875 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates all application views should be closed

WNF_EXEC_THERMAL_LIMITER_TERMINATE_BACKGROUND_TASKS id1 A3BC2075 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates background tasks should be terminated

WNF_EXEC_THERMAL_LIMITER_DISPLAY_WARNING id1 A3BC2875 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates a warning should be displayed to the user

WNF_EXEC_THERMAL_LIMITER_STOP_MRC id1 A3BC3075 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates MRC should be stopped

WNF_WFS_SETTINGS id1 A3BC0875 id2 4195083A
Family Safety settings have changed in the cloud service but have not been downloaded and committed

WNF_WFS_TIMEREMAININGALERTS id1 A3BC1075 id2 4195083A
Family Safety time remaining alerts to warn the user the allocated time is running out. The data is published as json blob with fileds U.SID for User SID as wide character and TR for time remaining in minutes as int value

WNF_WFS_FAMILYMEMBERLOGIN id1 A3BC1875 id2 4195083A
Family member login event

WNF_WFS_SETTINGSREFRESH id1 A3BC2075 id2 4195083A
Family Safety settings have changed and have downloaded and committed. Clients should refresh Family Safety settings.

WNF_FDBK_QUESTION_NOTIFICATION id1 A3BC0875 id2 A840A2B
This event contains a feedback question for the user. Payload is a JSON string specifying the feedback question.

WNF_WFAS_FIREWALL_NETWORK_CHANGE_READY id1 A3BC0875 id2 1287083A
Free network available or not

WNF_FLYT_IDS_CHANGED id1 A3BC0875 id2 159F022B
Triggered every time there is a change in flight IDs

WNF_FLTN_WNF_ARRIVED id1 A3BC0875 id2 F92022B
Triggered every time upon WNS notification or policy change

WNF_FLT_RUNDOWN_WAIT id1 A3BC0875 id2 4192022B
Wait for rundown release in Filter Manager may be blocked by a suspended Modern application

WNF_FOD_STATE_CHANGE id1 A3BC0875 id2 4182012B
Installation status of Features on demand

WNF_FSRL_TIERED_VOLUME_DETECTED id1 A3BC0875 id2 D941D2B
This event signals when a tiered volume is mounted

WNF_FSRL_OPLOCK_BREAK id1 A3BC1075 id2 D941D2B
Oplock break acknowledgement may be blocked by a suspended Modern application

WNF_GC_INITIAL_PRESENT id1 A3BC0875 id2 41C60D2A
This event is signalled when the graphics driver presents the initial frame.

WNF_GIP_ADAPTER_CHANGE id1 A3BC0875 id2 4196072A
This event is fired for GIP adapter state change, such as connect/disconnect

WNF_LOC_DEVICE_BROKER_ACCESS_CHANGED id1 A3BC0875 id2 41850121
This event triggers when the user changes Geolocation access for an application or the user.

WNF_LOC_RESERVED_WNF_EVENT id1 A3BC1075 id2 41850121
Do not use this WNF event, it is deprecated. Was WIN32_API_ACCESS_CHANGED.

WNF_LOC_SHOW_SYSTRAY id1 A3BC1875 id2 41850121
This event triggers when there is an event that accesses location data -- this trigger starts LocationNotifications.exe which is a systray app.

WNF_LFS_STATE id1 A3BC0875 id2 41950821
This is triggered when an app is making use of the location service. It has two possible data values associated to it: BOOL TRUE: one or more applications are using location. BOOL FALSE: no application is using location.

WNF_LFS_RUNNING_STATE id1 A3BC1075 id2 41950821
This state is used to notify when the location service starts or stops running

WNF_LFS_MASTERSWITCH_STATE id1 A3BC1875 id2 41950821
This state is used to notify when the phone location master switch status changes with BOOL as payload. TRUE indicating master switch is ON and FALSE indicating master switch is OFF

WNF_LFS_GEOFENCETRACKING_STATE id1 A3BC2075 id2 41950821
This state is used to notify Geofence tracking state for the geofences added by the applications. TRUE if atleast one geofence is actively being tracked and FALSE if there are no geofences being tracked.

WNF_LFS_RESERVED_WNF_EVENT_2 id1 A3BC2875 id2 41950821
Do not use this WNF event, it is deprecated. Was WNF_LFS_BACKGROUND_PERMISSIONCHANGE_STATE

WNF_LFS_POSITION_AVAILABLE id1 A3BC3075 id2 41950821
This state is used to notify when a new freely available position can be queried from the location framework.

WNF_LFS_CLIENT_RECALCULATE_PERMISSIONS id1 A3BC3875 id2 41950821
This state is published whenever the permissions of an active client have changed. Every client on the system receives it, and should run domain-specific logic to see what the impact is (e.g., reconnect location session when permission re-allowed).

WNF_LFS_PERMISSION_TO_SHOW_ICON_CHANGED id1 A3BC4075 id2 41950821
This event notifies when the permission regarding the ability to show the location notification icon has changed. The current state needs to be queried for as it is different for each user.

WNF_LFS_ACTION_DIALOG_AVAILABLE id1 A3BC4875 id2 41950821
This event notifies when a new action dialog is available

WNF_LFS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5075 id2 41950821
This event notifies when there's a significant change in the location of the device.

WNF_LFS_VISITS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5875 id2 41950821
This event notifies when there's a visit or a significant change in the location of the device.

WNF_LFS_LOCATION_MDM_AREA_POLICY_CHANGED id1 A3BC6075 id2 41950821
This event is fired when an MDM Location policy change occurs.

WNF_LFS_LOCATION_MDM_POLICY_ENABLELOCATION_CHANGED id1 A3BC6875 id2 41950821
This event is fired when an MDM EnableLocation policy change occurs.

WNF_NLS_ACP_CHANGED id1 A3BC0875 id2 41950223
This state is notified when the ANSI codepage changes - The data value is a UINT that indicates the new ANSI codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_OEMCP_CHANGED id1 A3BC1075 id2 41950223
This state is notified when the OEM codepage changes - The data value is a UINT that indicates the new OEM codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_USER_DEFAULT_LOCALE_CHANGED id1 A3BC1835 id2 41950223
This state is notified when the user default locale changes - The data value is an LCID that indicates the new locale. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_USER_UILANG_CHANGED id1 A3BC2035 id2 41950223
This state is notified when the user default UI language changes - The data value is a LANGID that indicates the new UI language. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_LOCALE_INFO_CHANGED id1 A3BC2835 id2 41950223
This state is notified when the locale info changes by means of calling SetLocaleInfo - The data value is a DWORD that indicates the LCTYPE that changed. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_GEOID_CHANGED id1 A3BC3035 id2 41950223
This state is notified when the user Geo ID changes by means of calling SetUserGeoID - The data value is a DWORD that indicates the new GeoID. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_LANG_UPDATE_LAUNCH id1 A3BC3875 id2 41950223
Notification indicating lang update launcher needs to be started. SDDL comes from ID_CAP_EVERYONE, ID_CAP_NTSERVICES and ID_CAP_INPUT_LOCALES in %SDXROOT%\src\uxplat\Input\Packages\InputServer\InputServer.pkg.xml

WNF_NLS_SETTINGS_REPLICATOR_LAUNCH id1 A3BC4075 id2 41950223
Notification indicating NLS/MUI user settings replicator needs to be started. - The data value is the replication cookie GUID (binary). SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_NLS_SETTINGS_REPLICATION_COMPLETE id1 A3BC4875 id2 41950223
Notification indicating NLS/MUI user settings replication has completed. - The data value is an HRESULT. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_GLOB_USERPROFILE_LANGLIST_CHANGED id1 A3BC0875 id2 389022A
This state is notified when the globalization user profile has changed via SetUserProfileLanguagesWP. There is nothing in the payload - call GetUserProfileLanguagesWP to get the updated user profile language list. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_GPOL_SYSTEM_CHANGES id1 A3BC0875 id2 D891E2A
System policy has been updated

WNF_GPOL_USER_CHANGES id1 A3BC10F5 id2 D891E2A
User policy has been updated

WNF_HAS_VERIFY_HEALTH_CERT id1 A3BC0875 id2 41950F25
This event signals a request to get (if needed) and verify Health Certificate with HAS

WNF_HOLO_USER_DISPLAY_CONTEXT id1 A3BC0835 id2 E8A0125
Event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext

WNF_HOLO_USER_INPUT_CONTEXT id1 A3BC1035 id2 E8A0125
Event raised when the input context changes (ex. from 3D input to 2D Desktop input). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext

WNF_HOLO_SHELL_STATE id1 A3BC1835 id2 E8A0125
Event raised when the Holographic Shell running state changes (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState

WNF_HOLO_INPUT_FOCUS_CHANGE id1 A3BC2075 id2 E8A0125
This event signals when input focus changes to a different window. Data is a MPCInputFocusChange struct.

WNF_HOLO_FORCE_ROOM_BOUNDARY id1 A3BC2835 id2 E8A0125
If payload is non-zero, room boundary is forced to be visible.

WNF_HOLO_STREAMING_STATE id1 A3BC3035 id2 E8A0125
This event signals whether streaming is active. Data contains a bool indicating if streaming is active.

WNF_HOLO_ROOM_BOUNDARY_DATA_CHANGED id1 A3BC3835 id2 E8A0125
This event signals that the persisted room boundary data has changed.

WNF_HOLO_ROOM_BOUNDARY_VISIBILITY id1 A3BC4035 id2 E8A0125
A non-zero payload indicates the room boundary is visible to the user. Writable by DWM and System.

WNF_HOLO_SHELL_INPUT_3DSWITCH_DISABLE id1 A3BC4835 id2 E8A0125
This event signals when various input types should be disabled from natively working in the Windows Holographic shell, useful for apps that simulate GGV via mouse and/or gamepad. Data contains a DWORD of bitflags from Windows::Internal::Shell::Holographic::ShellInput3DSwitchDisableFlags.

WNF_HOLO_ENVIRONMENT_AUDIO_ASSET id1 A3BC5075 id2 E8A0125
This event contains the file path for the environment app's audio asset, which is used by Triton

WNF_HOLO_UNINSTALL_PREPARE id1 A3BC5875 id2 E8A0125
This event signals that it's time for uninstall preparations, which includes shutting down Oasis apps.

WNF_HOLO_UNINSTALL_COMPLETE id1 A3BC6075 id2 E8A0125
This event signals that uninstall has finished. Data contains a HRESULT representing uninstall success.

WNF_HOLO_SET_SHELL_SPAWN_POINT id1 A3BC6835 id2 E8A0125
This event signals that the shell spawn point should be moved. Data is a DWORD indicating the id of the point that should be set.

WNF_HOLO_RETAIL_DEMO_TIMER id1 A3BC7035 id2 E8A0125
Event raised when the Windows Mixed Reality retail demo timer state changes. Data contains a DWORD equivalent to MixedRealityPortal::RetailDemoTimerState.

WNF_HOLO_DISPLAY_QUALITY_LEVEL id1 A3BC7835 id2 E8A0125
Event raised when the benchmarked quality level changes. Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:DisplayQualityState

WNF_HOLO_UNINSTALL_PREPARE_COMPLETE id1 A3BC8075 id2 E8A0125
This event signals that a HoloCoordinator completed uninstall preparation.

WNF_HOLO_SYSTEM_DISPLAY_CONTEXT_CHANGE id1 A3BC8875 id2 E8A0125
System scoped event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext

WNF_HOLO_REQUEST_HMD_USE_STATE id1 A3BC9035 id2 E8A0125
This event signals the desire to change the HMD use state (the overrideable internal setting, not the physical presence state reported by the HMD). Meant to be used by non-shell inbox applications to trigger the equivalent of the input switch hotkey. Data contains a DWORD equivalent to a bool; true = HmdUseState::InUse, false = HmdUseState::Idle.

WNF_HOLO_REQUEST_HOLOGRAPHIC_ACTIVATION_REALM id1 A3BC9835 id2 E8A0125
This event signals the desire to change the current input foreground to go to the last active 3D window. Meant to be used by non-shell inbox applications to return focus to 3D realm.

WNF_HOLO_RESET_IDLE_TIMER id1 A3BCA035 id2 E8A0125
This event signals a reset of the holographic idle timer. Writable by DWM and System.

WNF_HOLO_SHELL_STATE_INTERACTIVE_USER id1 A3BCA875 id2 E8A0125
Event raised when the Holographic Shell running state changes on the interactive users session (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState

WNF_HOLO_SHARING_SESSION_CONTEXT id1 A3BCB035 id2 E8A0125
This event signals whether sharing session is active. Data contains a name of the data provider.

WNF_HOLO_PROJECTION_REQUEST id1 A3BCB835 id2 E8A0125
This event signals a miracast projection to establish.

WNF_HOLO_CAPTURE_STATE id1 A3BCC035 id2 E8A0125
This event signals whether recording is active. Data contains a bool indicating if recording is active.

WNF_HVL_CPU_MGMT_PARTITION id1 A3BC0875 id2 418A1825
This state signals NTOS has CPU management privileges in the current partition.

WNF_HYPV_HOST_WMI_OBJECT_PROVIDER_STATE id1 A3BC0875 id2 17961725
The state of Hyper-V's host-only WMI object provider.

WNF_HYPV_HOST_WMI_EVENT_PROVIDER_STATE id1 A3BC1075 id2 17961725
The state of Hyper-V's host-only WMI event provider.

WNF_IMSN_MONITORMODECHANGED id1 A3BC0835 id2 F950324
A monitor has changed immersive modes

WNF_IMSN_LAUNCHERVISIBILITY id1 A3BC1035 id2 F950324
The immersive launcher's visibility has changed

WNF_IMSN_IMMERSIVEMONITORCHANGED id1 A3BC1835 id2 F950324
The monitor the immersive environment is running on has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_IMSN_KILL_LOGICAL_FOCUS id1 A3BC3035 id2 F950324
User-perceived focus has left an edit box.

WNF_IMSN_PROJECTIONDISPLAYAVAILABLE id1 A3BC3835 id2 F950324
Projection display availability has changed

WNF_IMSN_TRANSPARENCYPOLICY id1 A3BC4035 id2 F950324
The user experience transparency policy stores the global system transparency policy as a DWORD which contains 0 for disabled and 1 for enabled.

WNF_IMSN_GLOBALLIGHTSINVALIDATED id1 A3BC4835 id2 F950324
The global/shared lights have changed.

WNF_IUIS_SCALE_CHANGED id1 A3BC0835 id2 128F1B24
The immersive UI scale has changed for the current session.

WNF_ISM_LAST_USER_ACTIVITY id1 A3BC0835 id2 418B1D24
Last recorded user activity

WNF_ISM_INPUT_UPDATE_AFTER_TRACK_INTERVAL id1 A3BC1035 id2 418B1D24
Fires if there is new input after track interval.

WNF_ISM_CURSOR_MANAGER_READY id1 A3BC1835 id2 418B1D24
Cursor Manager is initialized. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_ISM_GAMECONTROLLER_ZEPHYRUS_FAULT id1 A3BC2075 id2 418B1D24
This event signals when the Zephyrus controller has encountered a fault that requires a shell notification.

WNF_IOT_EMBEDDED_MODE_POLICY_VALUE_CHANGED id1 A3BC0875 id2 41920124
Embedded mode policy value has changed.

WNF_IOT_STARTUP_SETTINGS_CHANGED id1 A3BC1075 id2 41920124
settings for the foreground app and/or iot startup type background tasks have changed

WNF_LANG_FOD_INSTALLATION_STARTED id1 A3BC0875 id2 6880F21
Installation of language features on demand was started (either through Settings or through installation task).

WNF_LED_SETTINGSCHANGED id1 A3BC0875 id2 41820B21
LedAlert settings has changed

WNF_LM_PACKAGE_SUSPEND_REQUIRED id1 A3BC0875 id2 41C60321
A running package's license is now invalid and the package must be suspended or terminated.

WNF_LM_CONTENT_LICENSE_CHANGED id1 A3BC1075 id2 41C60321
A content license's state has been modified.

WNF_LM_ROOT_LICENSE_CHANGED id1 A3BC1875 id2 41C60321
A root license's state has been modified.

WNF_LM_OPTIONAL_PACKAGE_SUSPEND_REQUIRED id1 A3BC2075 id2 41C60321
A running optional package's license is lost.

WNF_LM_APP_LICENSE_EVENT id1 A3BC2875 id2 41C60321
Multi-purpose event for app license notifications.

WNF_LM_OFFLINE_PC_CHANGED id1 A3BC3075 id2 41C60321
A offline pc state has been changed.

WNF_LM_LICENSE_REFRESHED id1 A3BC3875 id2 41C60321
Licenses have been refreshed.

WNF_LIC_NO_APPLICABLE_LICENSES_FOUND id1 A3BC0875 id2 41850721
Failed to launch the modern app because no valid licenses and leases were found

WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_OUT_OF_TOLERANCE id1 A3BC1075 id2 41850721
The device license hardware ID is out of tolerance with the device's hardware ID

WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_IN_TOLERANCE id1 A3BC1875 id2 41850721
The hardware ID has changed but is still with in tolerance with the device's hardware ID

WNF_LIC_DEVICE_LICENSE_UPDATED id1 A3BC2075 id2 41850721
A new device license with a different device ID was installed

WNF_LIC_DEVICE_LICENSE_REMOVED id1 A3BC2875 id2 41850721
The device license was uninstalled

WNF_LIC_DEVICE_LICENSE_MISSING id1 A3BC3075 id2 41850721
The required device license was nout found

WNF_LIC_INT_DEVICE_LICENSE_EXPIRED id1 A3BC3875 id2 41850721
The integration device license has expired and can no longer be used to verify or decrypt modern app licenses.

WNF_LIC_LOCAL_MIGRATED_LICENSES_FOUND id1 A3BC4075 id2 41850721
Found a local migrated license which needs to be refereshed with a store signed license.

WNF_LIC_MANAGE_DEVICE_REGISTRATION_AND_REACTIVATION id1 A3BC4875 id2 41850721
The MDM Licensing Device Registration Policy has been refreshed.

WNF_OLIC_OS_EDITION_CHANGE id1 A3BC5075 id2 28F0222
OS Edition has changed.

WNF_OLIC_OS_LICENSE_POLICY_CHANGE id1 A3BC5875 id2 28F0222
OS Policy has changed.

WNF_OLIC_OS_LICENSE_TERMS_ACCEPTED id1 A3BC6075 id2 28F0222
The License Terms can be considered as accepted on this device.

WNF_OLIC_OS_LICENSE_NON_GENUINE id1 A3BC6875 id2 28F0222
OS will soon notify user of non-genuine state.

WNF_LOGN_EOA_FLYOUT_POSITION id1 A3BC0835 id2 F810121
Indicates where the ease of access flyout should appear in LogonUI and User Oobe, the data type is RECT. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts

WNF_LOGN_SLIDE_TO_SHUTDOWN id1 A3BC1035 id2 F810121
Indicates that a shutdown has been triggered via Slide-to-shutdown. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts

WNF_LOGN_RETURN_TO_LOCK id1 A3BC1835 id2 F810121
Indicates that user intends to interact with the lock screen (e.g. for Projection or Cortana) and LogonUI should return to the lock screen.

WNF_LOGN_PINPAD_VISIBLE id1 A3BC2035 id2 F810121
Indicates that the mobile pinpad is visible.

WNF_LOGN_LOCAL_SIGNON id1 A3BC2875 id2 F810121
Indicates logon from local console happened, the data type is a GUID which represents the logged-on credential provider CLSID. The sddl string grants subscribe and publish permission to System

WNF_LOGN_CREDENTIAL_TILE_SELECTION_CHANGED id1 A3BC3075 id2 F810121
This event signals when a credential tile has been selected or deselected.

WNF_LOGN_SUPPRESS_FINGERPRINT_WAKE id1 A3BC3835 id2 F810121
Indicates that device wake via fingerprint sensor should be disabled. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts, and to App Containers with the userSignInSupport Capability

WNF_MAPS_MAPLOADER_PROGRESS id1 A3BC1075 id2 12960F20
Current progress of the MapLoader background engine.

WNF_MAPS_MAPLOADER_STATUS_CHANGE id1 A3BC1875 id2 12960F20
The new status of ODML.

WNF_MAPS_MAPLOADER_PACKAGE_CHANGE id1 A3BC2075 id2 12960F20
A map package has been added or removed or repositioned in the list.

WNF_SYNC_REQUEST_PROBE id1 A3BC0875 id2 288173E
Sync sets this value to request a wifi probe due to SSL error. SDDL comes from ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_MUR_MEDIA_UI_REQUEST_WLAN id1 A3BC0875 id2 41941B20
Interface to Media-UI-request-State mapping for WLAN (802.1x) interfaces

WNF_MUR_MEDIA_UI_REQUEST_LAN id1 A3BC1075 id2 41941B20
Interface to Media-UI-request-State mapping for LAN (802.3) interfaces

WNF_MSA_ACCOUNTSTATECHANGE id1 A3BC0835 id2 41871D20
Notification for alerting client apps that the connected account ticketing state has changed

WNF_MSA_TPM_AVAILABLE id1 A3BC1475 id2 41871D20
Notification for alerting client apps that the server has reported TPM claims are available in new tickets. Payload is DWORD (enum TpmKeyStateServer) and permanent since it represents device capability needed across reboot.

WNF_MSA_TPM_SERVER_CLIENT_KEY_STATE_UPDATED id1 A3BC1875 id2 41871D20
Notification for alerting client apps about the current client and server TPM state for logging and retry logic. Payload is a struct of two DWORDs (enum TpmKeyStateServer, enum TpmKeyStateClient).

WNF_MM_BAD_MEMORY_PENDING_REMOVAL id1 A3BC0875 id2 41C60320
This notification is raised when the memory manager is unable to automatically offline a bad memory page

WNF_MON_THERMAL_CAP_CHANGED id1 A3BC0875 id2 41880120
Triggered by a monitor device when the thermal limit on brightness is changed. Payload is a MONITOR_THERMAL_BRIGHTNESS_LIMIT_LIST.

WNF_MRT_QUALIFIER_CONTRAST_CHANGED id1 A3BC0875 id2 41921C20
This state is notified when the constrast qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml

WNF_MRT_QUALIFIER_THEME_CHANGED id1 A3BC1075 id2 41921C20
This state is notified when the theme qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml

WNF_MRT_PERSISTENT_QUALIFIER_CHANGED id1 A3BC1C75 id2 41921C20
This state is notified when some persistent qualifier changed its value. Payload is qualifier@package_name with a max length of 512 bytes (256 WCHARs including null terminator). Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers

WNF_MRT_MERGE_SYSTEM_PRI_FILES id1 A3BC2075 id2 41921C20
This state is notified when system PRI files are merged. Payload has a max length of 128 bytes (64 WCHARs including null terminator) and consists of 'start [starting timestamp]' or 'done [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers

WNF_MRT_SYSTEM_PRI_MERGE id1 A3BC2875 id2 41921C20
This state is notified when a system PRI file is merged. Payload has a max length of 512 bytes (256 WCHARs including null terminator) and consists of either 'start [path] [starting timestamp]' or '{done,skipped} [path] [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_NASV_USER_PRESENT id1 A3BC0835 id2 17950F23
NaAuth User Presence Status

WNF_NASV_SERVICE_RUNNING id1 A3BC1075 id2 17950F23
NaAuth Service Running

WNF_NASV_USER_AUTHENTICATION id1 A3BC1835 id2 17950F23
NaAuth User Authentication Status

WNF_NASV_DYNAMIC_LOCK_BLUETOOTH_STATUS id1 A3BC2075 id2 17950F23
NaAuth Extended Dynamic Lock Status for Bluetooth plugin

WNF_NCB_APP_AVAILABLE id1 A3BC0875 id2 41840D23
NCB indication of CCT or Socket Broker Based App availability.

WNF_NDIS_ADAPTER_ARRIVAL id1 A3BC0875 id2 128F0A23
NDIS finds a network adapter that needs to be configured by NetSetupSvc.

WNF_NDIS_CORRUPTED_STORE id1 A3BC1075 id2 128F0A23
NDIS detects corruption in the binding store.

WNF_NLM_VPN_RECONNECT_CHANGE id1 A3BC0875 id2 418B0223
This event is signalled by rasman about reconnect VPN state change and is used by NLM

WNF_NLM_INTERNET_PRESENT id1 A3BC1075 id2 418B0223
This event is signalled by NLM when the aggregated network conditions indicate that a connection to the internet is present

WNF_NFC_SE_CARD_EMULATION_STATE_CHANGED id1 A3BC0875 id2 41850823
This state is used to notify that the NFC CE policy changed.

WNF_PAY_CANMAKEPAYMENT_BROKER_READY id1 A3BC0875 id2 419F0F3D
This state is used to notify that the CanMakePayment background broker is initialized and ready.

WNF_NGC_PREGEN_TRIGGER id1 A3BC0875 id2 41850923
This event signals when an caller wants to trigger KeyPregenTask.

WNF_NGC_AIKCERT_TRIGGER id1 A3BC1075 id2 41850923
This event signals when an caller wants to trigger AikCertEnrollTask.

WNF_NGC_PRO_CSP_POLICY_CHANGED id1 A3BC1875 id2 41850923
This event is fired when a policy change occurs in the NGC Pro CSP.

WNF_NGC_PREGEN_DELAY_TRIGGER id1 A3BC2075 id2 41850923
This event signals when an caller wants to trigger KeyPregenTask with some delay.

WNF_NGC_GESTURE_AUTHENTICATED id1 A3BC2875 id2 41850923
This event signals when NGC container service (ngcctnrsvc) authenticates a gesture.

WNF_NGC_CRYPTO_MDM_POLICY_CHANGED id1 A3BC3075 id2 41850923
This event is fired when an MDM cryptographic policy change occurs.

WNF_NGC_CREDENTIAL_REFRESH_REQUIRED id1 A3BC3875 id2 41850923
This event is fired when an activity occurs that requires the NGC PIN cred prov to refresh its credential state.

WNF_NGC_PIN_RESET_SCENARIO_STATE_CHANGE id1 A3BC4035 id2 41850923
This event is fired when the state has changed during the PIN reset scenario.

WNF_NGC_LAUNCH_PIN_RESET_SCENARIO id1 A3BC4875 id2 41850923
This event is fired from the NGC PIN cred prov to signal that the PIN reset scenario should be launched.

WNF_NGC_CREDENTIAL_RESET_EXPERIENCE_ACTIVE id1 A3BC5075 id2 41850923
Boolean state representing whether or not the Credential Reset User Experience is active.

WNF_NGC_CONTAINER_CREATED_OR_DELETED id1 A3BC5875 id2 41850923
This event is fired from NGC container service (ngcctnrsvc) when containers are created or deleted.

WNF_NGC_LAUNCH_NTH_USER_SCENARIO id1 A3BC6075 id2 41850923
This event is fired from the NGC PIN cred prov to signal that an Nth user scenario should be launched.

WNF_NGC_PREGEN_NGCISOCTNR_TRIGGER id1 A3BC6875 id2 41850923
This event triggers the NgcIsoCtnr key pre-gen pool to start generating a key.

WNF_NLA_CAPABILITY_CHANGE id1 A3BC0875 id2 41870223
This event is notified when NCSI detects a capability change

WNF_NLA_TASK_TRIGGER id1 A3BC1875 id2 41870223
State name triggering WiFiTask from NlaSvc

WNF_WPN_USER_PLATFORM_READY id1 A3BC08F5 id2 41881E3A
This WNF state indicates to users of WPN endpoints (except AppEndpoint) that platform is ready to use. This state can also be used to know if WPN platform restarted.

WNF_WPN_PLATFORM_INITIALIZED id1 A3BC10F5 id2 41881E3A
This WNF state can be used by first party Apps / Services to determine when WPN platform is ready to handle app related requests like posting toast / tile and getting channel uri.

WNF_WPN_SYSTEM_PLATFORM_READY id1 A3BC1875 id2 41881E3A
State indicating that system notification platform has been registered and ready to user.

WNF_WPN_USER_IN_SESSION_PLATFORM_READY id1 A3BC2035 id2 41881E3A
This WNF state indicates that USER_PLATFORM_READY was fired for a user in the current session. This is intended to provide a workaround for the inability to use RtlSubscribeWnfStateChangeNotification for a user other than the current process token. A process can register for this WNF and then poll the per-user WNF states under impersonation.

WNF_NPSM_SERVICE_STARTED id1 A3BC0875 id2 C951E23
This notification is to indicate that the NPSM service has started up.

WNF_NSI_SERVICE_STATUS id1 A3BC0875 id2 418F1D23
NSI service status. The SDDL grants subscribe access to all who have access to NSI RPC interface and subcribe + publish access to NSI service.

WNF_CSC_SERVICE_START id1 A3BC0875 id2 41851D2E
CSC Service start trigger

WNF_WOSC_ML_MODELS_CHANGED id1 A3BC0875 id2 295013A
Triggered every time there is a change in the OneSettings configuration for machine learning model configurations

WNF_WOSC_FEATURE_CONFIGURATION_CHANGED id1 A3BC1075 id2 295013A
Triggered every time there is a change in the OneSettings configuration for Velocity feature configurations

WNF_OOBE_SHL_MAGNIFIER_QUERY id1 A3BC0835 id2 4840122
Notification from ISM to OOBE to query the user whether to activate the always-on Magnifier in OOBE

WNF_OOBE_SHL_MAGNIFIER_CONFIRM id1 A3BC1035 id2 4840122
Notification from OOBE to ISM whether the user confirms to activate the always-on Magnifier in OOBE

WNF_OOBE_SHL_MONITOR_STATE id1 A3BC1875 id2 4840122
Notification to User OOBE monitor on where the progress is

WNF_OOBE_SHL_SPEECH_CONTROLLER id1 A3BC2035 id2 4840122
Notification of speech controller state change. Payload is state type plus string of length 512

WNF_OVRD_OVERRIDESCALEUPDATED id1 A3BC0875 id2 5941822
The window's override scale has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_PFG_PEN_FIRST_TAP id1 A3BC0875 id2 4181083D
First Pen Tap Gesture

WNF_PFG_PEN_FIRST_DRAG id1 A3BC1075 id2 4181083D
First Pen Drag Gesture

WNF_PO_SCENARIO_CHANGE id1 A3BC0875 id2 41C6013D
Sent when the WDI session corresponding to a power scenario changes

WNF_PO_COMPOSITE_BATTERY id1 A3BC1075 id2 41C6013D
Sent when the composite battery is updated

WNF_PO_POWER_STATE_CHANGE id1 A3BC1875 id2 41C6013D
Sent after WNF_PO_COMPOSITE_BATTERY when batteries are added or removed and when one or more batteries' AC, charging, or discharging states changes

WNF_PO_ENERGY_SAVER_STATE id1 A3BC2075 id2 41C6013D
Triggered when Energy Saver state changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_PO_ENERGY_SAVER_SETTING id1 A3BC2875 id2 41C6013D
Triggered when Energy Saver setting changes

WNF_PO_ENERGY_SAVER_OVERRIDE id1 A3BC3075 id2 41C6013D
Triggered to indicate Energy Saver override settings

WNF_PO_THERMAL_STANDBY id1 A3BC3875 id2 41C6013D
Triggered to indicate CR3 condition

WNF_PO_THERMAL_SHUTDOWN_OCCURRED id1 A3BC4075 id2 41C6013D
Sent when the previous shutdown was due to a thermal trip

WNF_PO_THERMAL_HIBERNATE_OCCURRED id1 A3BC4875 id2 41C6013D
Sent when the previous hibernate was due to a thermal trip

WNF_PO_DISCHARGE_ESTIMATE id1 A3BC5075 id2 41C6013D
Estimated time until full discharge in seconds

WNF_PO_DISCHARGE_START_FILETIME id1 A3BC5C75 id2 41C6013D
Filetime of last known start of discharge

WNF_PO_CHARGE_ESTIMATE id1 A3BC6075 id2 41C6013D
Estimated time until full charge in seconds

WNF_PO_THERMAL_OVERTHROTTLE id1 A3BC6875 id2 41C6013D
Triggered to indicate excessive thermal throttling

WNF_PO_USER_AWAY_PREDICTION id1 A3BC7075 id2 41C6013D
Sent to indicate whenever user-away prediction is updated.

WNF_PO_DISPLAY_REQUEST_ACTIVE id1 A3BC7835 id2 41C6013D
Sent to indicate whether a display request is active in the current session.

WNF_PO_BATTERY_CHARGE_LEVEL id1 A3BC8075 id2 41C6013D
Triggered when battery charge crosses well-known charge level boundaries.

WNF_PO_SLEEP_STUDY_USER_PRESENCE_CHANGED id1 A3BC8875 id2 41C6013D
Sent when the global user presence changes.

WNF_PO_BACKGROUND_ACTIVITY_POLICY id1 A3BC9075 id2 41C6013D
Sent when the background activity policy changes.

WNF_PO_BATTERY_DISCHARGING id1 A3BC9875 id2 41C6013D
Triggered when battery is being discharged, irrespective of AC/DC state of the system.

WNF_PO_PRIMARY_DISPLAY_VISIBLE_STATE id1 A3BCA075 id2 41C6013D
Visible state of the primary display as MONITOR_DISPLAY_STATE

WNF_PO_PRIMARY_DISPLAY_LOGICAL_STATE id1 A3BCA875 id2 41C6013D
Logical state of the primary display as MONITOR_LOGICAL_DISPLAY_STATE

WNF_PO_PREVIOUS_SHUTDOWN_STATE id1 A3BCB075 id2 41C6013D
Sent on every boot to notify previous shutdown state

WNF_PO_MODERN_STANDBY_EXIT_INITIATED id1 A3BCB875 id2 41C6013D
Triggered at the start of a transition to exit modern standby

WNF_PO_SW_HW_DRIPS_DIVERGENCE id1 A3BCC075 id2 41C6013D
Sent when SW DRIPS is more than HW DRIPS by a specific threshold

WNF_PO_DRIPS_DEVICE_CONSTRAINTS_REGISTERED id1 A3BCC875 id2 41C6013D
Sent once platform idle states and associated device constraints have been registered

WNF_PO_BASIC_BRIGHTNESS_ENGINE_DISABLED id1 A3BCD075 id2 41C6013D
One time system-wide transition to switch from the basic brightness engine to the high-precision brightness engine.

WNF_PO_BRIGHTNESS_ALS_OFFSET id1 A3BCD875 id2 41C6013D
ALS brightness offset consumed by the basic brightness engine.

WNF_PO_VIDEO_INITIALIALIZED id1 A3BCE075 id2 41C6013D
Set to TRUE when the video system is initialized.

WNF_PO_OVERLAY_POWER_SCHEME_UPDATE id1 A3BCE875 id2 41C6013D
Notification for power-setting overlay scheme change.

WNF_PO_CAD_STICKY_DISABLE_CHARGING id1 A3BCF075 id2 41C6013D
Set when an you want IOCTL_CAD_DISABLE_CHARGING to behave in a sticky manner

WNF_PO_POWER_BUTTON_STATE id1 A3BCF875 id2 41C6013D
Describes the current state of the power button.

WNF_PO_SYSTEM_TIME_CHANGED id1 A3BD0075 id2 41C6013D
Supplies the notification about system time changed. Payload has 2 ULONGLONG for new time and old time.

WNF_PO_WEAK_CHARGER id1 A3BD0875 id2 41C6013D
Triggered when a weak charger is detected. Note that there may be several minute delay between when charger is plugged in and when the notification is produced.

WNF_PO_PRESLEEP_NOTIFICATION id1 A3BD1075 id2 41C6013D
Triggered several minutes prior to idling to sleep.

WNF_PO_INPUT_SUPPRESS_NOTIFICATION id1 A3BD1875 id2 41C6013D
Triggered when device is sourced from battery(DC) with lid closed and no external monitor connected.

WNF_PO_WAKE_ON_VOICE_STATE id1 A3BD2075 id2 41C6013D
Sent when wake on voice state changes.

WNF_PO_OPPORTUNISTIC_CS id1 A3BD2875 id2 41C6013D
Sent to indicate period of opportunistic connectivity in standby.

WNF_PO_INPUT_SUPPRESS_NOTIFICATION_EX id1 A3BD3075 id2 41C6013D
Describes the input suppression state for modern standby system based on power source, lid state, monitor state, external monitor state and system opted-in policy.

WNF_PO_BATTERY_CHARGE_LIMITING_MODE id1 A3BD3875 id2 41C6013D
Set to TRUE when one of the battery is in charge limiting mode and FALSE when none of the battery is in charge limiting mode.

WNF_PNPA_DEVNODES_CHANGED id1 A3BC0875 id2 96003D
This corresponds to a DBT_DEVNODES_CHANGED message

WNF_PNPA_DEVNODES_CHANGED_SESSION id1 A3BC1035 id2 96003D
This corresponds to a DBT_DEVNODES_CHANGED message

WNF_PNPA_VOLUMES_CHANGED id1 A3BC1875 id2 96003D
This corresponds to a drive letter arrival/removal message

WNF_PNPA_VOLUMES_CHANGED_SESSION id1 A3BC2035 id2 96003D
This corresponds to a drive letter arrival/removal message

WNF_PNPA_HARDWAREPROFILES_CHANGED id1 A3BC2875 id2 96003D
This corresponds to a hardware profiles changed message

WNF_PNPA_HARDWAREPROFILES_CHANGED_SESSION id1 A3BC3035 id2 96003D
This corresponds to a hardware profiles changed message

WNF_PNPA_PORTS_CHANGED id1 A3BC3875 id2 96003D
This corresponds to a ports changes message

WNF_PNPA_PORTS_CHANGED_SESSION id1 A3BC4035 id2 96003D
This corresponds to a ports changes message

WNF_PNPB_AWAITING_RESPONSE id1 A3BC0875 id2 396003D
This corresponds to kernel PNP waiting synchronously for user-mode clients

WNF_PNPC_REBOOT_REQUIRED id1 A3BC0875 id2 296003D
This corresponds to a reboot of the system needs to be performed due to a device installation

WNF_PNPC_DEVICE_INSTALL_REQUESTED id1 A3BC1075 id2 296003D
Device installation is requested.

WNF_PNPC_CONTAINER_CONFIG_REQUESTED id1 A3BC1875 id2 296003D
A change that requires a device container to be updated has occured.

WNF_PROV_TURN_COMPLETE id1 A3BC0875 id2 17891C3D
Fired when a full set of packages are processed.

WNF_PROV_TPM_ATTEST_COMPLETE id1 A3BC1075 id2 17891C3D
Fired when TPM, NGC, and MSA all report ready for new tickets to contain the TPM claim. Event contains the HRESULT for the operation.

WNF_PROV_AUTOPILOT_PROFILE_AVAILABLE id1 A3BC1875 id2 17891C3D
Fired when an AutoPilot profile is available locally and is non-empty. Event contains the HRESULT for the operation.

WNF_PROV_AUTOPILOT_ASYNC_COMPLETE id1 A3BC2075 id2 17891C3D
Fired when the AutoPilot profile manager completes and is ready to unload.

WNF_PROV_AUTOPILOT_TPM_MSA_TRIGGER id1 A3BC2875 id2 17891C3D
Fired when the AutoPilot profile manager determines that the MSA client may need to update TPM state

WNF_PROV_DEVICE_BOOTSTRAP_COMPLETE id1 A3BC3075 id2 17891C3D
Fired when the Server provisioning in the blocking Device Bootstrap page of commercial OOBE is complete. Data passed in is a DWORD. 0x1, if Bootstrap is complete.

WNF_DEVM_PROVISIONING_COMPLETE id1 A3BC0875 id2 C900B29
State of boot provisioning tasks. Set to 1 when provisioning is complete. SDDL comes from ID_CAP_PHONEPROVISIONER_EVENTS and PhoneProvisioner in %SDXROOT%\src\devmgmt\dm\packages\provisioning\provisioning.pkg.xml and MvProvisionHost in %SDXROOT%\src\devmgmt\dm\packages\multivariant\multivariant.pkg.xml

WNF_DEVM_DMWAPPUSHSVC_READY id1 A3BC1875 id2 C900B29
Multivariant is ready to deliver SMS messages to RILAdaptation (or any registered recipient)

WNF_DEVM_MULTIVARIANT_PROVISIONING_SESSIONS id1 A3BC3075 id2 C900B29
Multivariant provisioning session status (per slot). Everyone (WD) can subscribe, but just Local System and Admin can publish (SY, BA).

WNF_PS_WAKE_CHARGE_RESOURCE_POLICY id1 A3BC0875 id2 41C61D3D
This corresponds to an application that has eclipsed job wake charge resource policy

WNF_PTI_WNS_RECEIVED id1 A3BC0875 id2 418F1A3D
A WNS notification has been received and the Push To Install service should process it.

WNF_SRC_SYSTEM_RADIO_CHANGED id1 A3BC0875 id2 41851C3E
This event signals when system radio is changed

WNF_RDR_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC0875 id2 41940A3F
This event signals when the client didn't discover SMB1 usage for a specific period

WNF_RM_MEMORY_MONITOR_USAGE_LEVEL id1 A3BC0875 id2 41C6033F
Supplies the current RM memory monitor memory usage level. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_RM_GAME_MODE_ACTIVE id1 A3BC1075 id2 41C6033F
Supplies the process ID of the current game mode recipient, or 0 if no recipient is active

WNF_RM_QUIET_MODE id1 A3BC1875 id2 41C6033F
Supplies the current quiet mode state as recorded by central resource manager

WNF_HAM_SYSTEM_STATE_CHANGED id1 A3BC0875 id2 418B0F25
Supplies the current state of the system as recorded by the system state tracker

WNF_RPCF_FWMAN_RUNNING id1 A3BC0875 id2 7851E3F
This event signals when the RPC firewall manager is initialized

WNF_RTDS_RPC_INTERFACE_TRIGGER_CHANGED id1 A3BC0875 id2 12821A3F
An RPC service trigger has been added or removed

WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED id1 A3BC1875 id2 12821A3F
A named pipe service trigger has been added or removed

WNF_SCM_AUTOSTART_STATE id1 A3BC0875 id2 418B0D3E
This event triggers to indicate SCM autostart state

WNF_SBS_UPDATE_AVAILABLE id1 A3BC0875 id2 41950C3E
This event signals that there is an update available to the Secure Boot variables.

WNF_WSC_SECURITY_CENTER_USER_NOTIFICATION id1 A3BC0875 id2 41851D3A
A notification dialog should be shown to the user.

WNF_SDO_ORIENTATION_CHANGE id1 A3BC0875 id2 41890A3E
This event triggers when there is a simple device orientation change. It's data value is one of the SimpleDeviceOrientation enum values. Rights: SensorService can publish, Everyone can subscribe.

WNF_DEP_OOBE_COMPLETE id1 A3BC0C75 id2 41960B29
This event triggers when the system has completed OOBE (Windows Welcome)

WNF_DEP_UNINSTALL_DISABLED id1 A3BC1475 id2 41960B29
This event triggers when the Uninstall of the system has been disabled

WNF_SHEL_IMMERSIVE_SHELL_RUNNING id1 A3BC0875 id2 D83063E
This event signals when the Immersive Shell is started

WNF_SHEL_NOTIFICATIONS id1 A3BC1035 id2 D83063E
Set to 0 or more to indicate whether there are any unseen notifications in the notification center. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable the notification on OneCore

WNF_SHEL_LOGON_COMPLETE id1 A3BC1875 id2 D83063E
This system-scope event is signaled each time a user's desktop becomes ready. Consider using WNF_SHEL_SESSION_LOGON_COMPLETE for a session-scoped version.

WNF_SHEL_OOBE_USER_LOGON_COMPLETE id1 A3BC2475 id2 D83063E
This event signals when logon of the first user after OOBE is complete. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed access.

WNF_SHEL_VEEVENT_DISPATCHER_CLIENT_PIPE_CLOSED id1 A3BC2875 id2 D83063E
TDL dispatcher pipe has been closed

WNF_SHEL_TILECHANGE id1 A3BC3075 id2 D83063E
This event is signalled when there is a tile change to a background task

WNF_SHEL_NOTIFICATION_SETTINGS_CHANGED id1 A3BC3835 id2 D83063E
Event signals when toast notification settings have changed.

WNF_SHEL_SOFTLANDING_RULE_TRIGGERED id1 A3BC4075 id2 D83063E
This event signals when a SoftLanding rule is triggered

WNF_SHEL_START_LAYOUT_READY id1 A3BC4875 id2 D83063E
This event signals when Start Experience Host completes loading the Start menu layout

WNF_SHEL_APPRESOLVER_SCAN id1 A3BC5075 id2 D83063E
Event signals a full app resolver scan has been invoked.

WNF_SHEL_LOCKSCREEN_ACTIVE id1 A3BC5835 id2 D83063E
Set to 0 or 1 to indicate whether the lock screen is active. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and system can write. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.

WNF_SHEL_START_APPLIFECYCLE_INSTALL_FINISHED id1 A3BC6075 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_INSTALL_FINISHED event from TDL

WNF_SHEL_START_APPLIFECYCLE_DOWNLOAD_STARTED id1 A3BC6875 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_DOWNLOAD_STARTED event from TDL

WNF_SHEL_APPLICATION_STATE_UPDATE id1 A3BC7075 id2 D83063E
Event is for the shell to notify when app layout state is changed. Payload is ShellApplicationStateWnf struct.

WNF_SHEL_FOCUS_CHANGE id1 A3BC7875 id2 D83063E
This event signals when focus changes to a different process, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.

WNF_SHEL_GAMECONTROLLER_LISTENER_INFO id1 A3BC8075 id2 D83063E
This event signals to toggle exclusive gamepad listening on and off, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.

WNF_SHEL_GAMECONTROLLER_FOCUS_INFO id1 A3BC8875 id2 D83063E
This event signals to toggle exclusive gamepad input on and off

WNF_SHEL_ENTERPRISE_START_LAYOUT_POLICY_VALUE_CHANGED id1 A3BC9475 id2 D83063E
This even signals when Start layout MDM policy has been applied

WNF_SHEL_CORTANA_APPINDEX_UPDATED id1 A3BC9875 id2 D83063E
Event signals when the apps have been pushed to the indexer has completed

WNF_SHEL_SOFTLANDING_RULES_UPDATED id1 A3BCA075 id2 D83063E
This event signals when SoftLanding rules folder is updated

WNF_SHEL_NOTIFICATIONS_CRITICAL id1 A3BCA835 id2 D83063E
This event signals that a critical notification such as an incoming call was posted. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable notification on OneCore

WNF_SHEL_START_VISIBILITY_CHANGED id1 A3BCB035 id2 D83063E
This event signals when Start visibility changes

WNF_SHEL_TRAY_SEARCHBOX_VISIBILITY_CHANGED id1 A3BCB875 id2 D83063E
Set to 0 or 1 to indicate whether the searchbox is visibile in the tray. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write.

WNF_SHEL_DEVICE_UNLOCKED id1 A3BCC075 id2 D83063E
This event signals that the device is unlocked in the current session

WNF_SHEL_PLACES_CHANGED id1 A3BCC875 id2 D83063E
This event signals the changes in places' database (clientgraph)

WNF_SHEL_SUSPEND_APP_BACKGROUND_ACTIVITY id1 A3BCD075 id2 D83063E
Event is for the shell to notify when app background activity should be suspended. Payload is DWORD set to 1 or 0.

WNF_SHEL_CREATIVE_EVENT_TRIGGERED id1 A3BCD875 id2 D83063E
This event signals a creative event has been triggered

WNF_SHEL_JUMPLIST_CHANGED id1 A3BCE075 id2 D83063E
Event signals that the jumplist for an app has changed. Payload is a struct containing the current sessionId as well as a string representing the aumid of the app whose jumplist was updated.

WNF_SHEL_START_APPLIFECYCLE_UNINSTALL_FINISHED id1 A3BCE875 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_UNINSTALL_FINISHED event from TDL

WNF_SHEL_GAMECONTROLLER_NEXUS_INFO id1 A3BCF075 id2 D83063E
This event signals whenever the nexus button policy changes.

WNF_SHEL_SETTINGS_CHANGED id1 A3BCF875 id2 D83063E
This event signals when a settings toggle has changed

WNF_SHEL_TOAST_PUBLISHED id1 A3BD0035 id2 D83063E
This event signals when a new toast is published

WNF_SHEL_SOFTLANDING_PUBLISHED id1 A3BD0835 id2 D83063E
This event signals when a new soft landing tip is published

WNF_SHEL_REQUEST_CORTANA_SETTINGSCONSTRAINTINDEX_BUILD id1 A3BD1075 id2 D83063E
Event signals when an app requests cortana to build the settings constraint index

WNF_SHEL_DICTATION_RUNNING id1 A3BD1835 id2 D83063E
This is the state of dictation. SDDL comes from dwm.exe in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml and WPNarrator in %SDXROOT%\src\media\apps\packages\Apps\WPNarrator.pkg.xml. And Phone DefApps group is required too.

WNF_SHEL_DDC_COMMAND_AVAILABLE id1 A3BD2075 id2 D83063E
This event signals when a parsed command is ready for processing

WNF_SHEL_DDC_WNS_COMMAND id1 A3BD2875 id2 D83063E
This event signals when a command has been delivered via WNS

WNF_SHEL_DDC_SMS_COMMAND id1 A3BD3075 id2 D83063E
This event signals when a command has been delivered via SMS

WNF_SHEL_DEVICE_LOCKED id1 A3BD3875 id2 D83063E
This event signals that the device is locked in the current session

WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_ACTIVATED id1 A3BD4075 id2 D83063E
This event signals a subscription has been activated.

WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_UPDATED id1 A3BD4875 id2 D83063E
This event signals the content of one or more subscriptions has been updated.

WNF_SHEL_LOCKSCREEN_IMAGE_CHANGED id1 A3BD5075 id2 D83063E
This event signals that lock screen image had changed. It contains the user sid whose image was changed

WNF_SHEL_SCREEN_COVERED id1 A3BD5875 id2 D83063E
Set to 0 (uncovered or unknown) or 1 (covered).

WNF_SHEL_DDC_CONNECTED_ACCOUNTS_CHANGED id1 A3BD6075 id2 D83063E
This event signals when connected accounts have changed and register device should be called

WNF_SHEL_OOBE_ENABLE_PROVISIONING id1 A3BD6835 id2 D83063E
This event signals when OOBE in a Shell should enable its provisioning flow

WNF_SHEL_LOCK_APP_SHOWN id1 A3BD7035 id2 D83063E
This event signals that the Lock application has been presented to the user. It contains an instance cookie as specified from LogonUI.

WNF_SHEL_LOCK_APP_REQUESTING_UNLOCK id1 A3BD7835 id2 D83063E
This event signals that the Lock application is requesting to unlock so the user can enter credentials.

WNF_SHEL_TILEINSTALL id1 A3BD8075 id2 D83063E
This event is signalled when there is a tile install to a background task

WNF_SHEL_TILEUPDATE id1 A3BD8875 id2 D83063E
This event is signalled when there is a tile update to a background task

WNF_SHEL_TILEUNINSTALL id1 A3BD9075 id2 D83063E
This event is signalled when there is a tile uninstall to a background task

WNF_SHEL_ABOVE_LOCK_APP_ACTIVE id1 A3BD9835 id2 D83063E
This event is signalled when there is an app launched (1) or terminated (0) above lock. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed full access, while all other app containers have read access.

WNF_SHEL_RADIALCONTROLLER_EXPERIENCE_RESTART id1 A3BDA035 id2 D83063E
This event is signalled when the RadialController Experience has restarted to allow registered API component to re-establish connection and repopulate state

WNF_SHEL_ABOVE_LOCK_BIO_ACTIVE id1 A3BDA835 id2 D83063E
This event is signalled when there is bio feedback active (1) or inactive (0) above lock

WNF_SHEL_CORTANA_SPEECH_CANCELHANDSFREE_REQUESTED id1 A3BDB035 id2 D83063E
This event can be signalled when a handsfree device needs to request Cortana to cancel speech activity.

WNF_SHEL_CALM_DISPLAY_ACTIVE id1 A3BDB875 id2 D83063E
Set to 0 (inactive) or 1 (active).

WNF_SHEL_INSTALL_PLACEHOLDER_TILES id1 A3BDC075 id2 D83063E
This event signals a start layout change to a background task so that assets can be retrieved if necessary. Payload is PlaceholderTileWnf.

WNF_SHEL_PEOPLE_PINNED_LIST_CHANGED id1 A3BDC835 id2 D83063E
This event is signalled when there is a change to the Pinned People list

WNF_SHEL_LOCKSTATE id1 A3BDD075 id2 D83063E
Current lock state of the device. Payload is DEVICE_LOCKSTATE. On multisession SKUs, everyone can read while only SYSTEM can write. On single session SKUs, everyone can read while only DefaultAccount can write. On single session SKUs, also include allow list from the SDDL for DEVICE_LOCK_STATE. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.

WNF_SHEL_APPLICATION_SPATIAL_INFO_UPDATE id1 A3BDD875 id2 D83063E
Event is for the shell to notify when app spatial information has changed. Payload is ApplicationSpatialInformationWnf struct.

WNF_SHEL_CORTANA_AUDIO_ACTIVE id1 A3BDE075 id2 D83063E
Indicates the state of Cortana speech input and output.

WNF_SHEL_LOCKSCREEN_INFO_UPDATED id1 A3BDE835 id2 D83063E
This event signals that the LockScreen info is updated.

WNF_SHEL_CDM_FEATURE_CONFIG_FIRST_USAGE id1 A3BDF875 id2 D83063E
This event notifies the CDM when a new feature configuration is first used. The SDDL is scoped to AuthenticatedUsers, AppContainers and LPACs (CAPABILITY_SID_LpacAppExperience)

WNF_SHEL_APPLICATION_STARTED id1 A3BE0075 id2 D83063E
This event is signals when an application launches. The Payload is the appID.

WNF_SHEL_APPLICATION_TERMINATED id1 A3BE0875 id2 D83063E
This event is signals when an application is terminated. The Payload is the appID.

WNF_SHEL_WINDOWSTIP_CONTENT_PUBLISHED id1 A3BE10F5 id2 D83063E
This event is signals when a request is made to show a Windows Tip bubble. The Payload is the content id(String).

WNF_SHEL_USER_IDLE id1 A3BE1875 id2 D83063E
This event signals when the first time a user is idle after logon. The payload is the time the user has been idled for

WNF_SHEL_PEOPLE_PANE_VIEW_CHANGED id1 A3BE2035 id2 D83063E
This event is signalled when there is a change to the People Pane Views

WNF_SHEL_LOCK_APP_RELOCK id1 A3BE2835 id2 D83063E
This event signals that the lock screen should be reset due to a re-lock request.

WNF_SHEL_LOCK_APP_READY id1 A3BE3035 id2 D83063E
This event signals that the lock screen is ready after a reset was requested.

WNF_SHEL_SESSION_LOGON_COMPLETE id1 A3BE3835 id2 D83063E
This event is scoped to the user session and signaled when the desktop is ready after a logon

WNF_SHEL_HEALTH_STATE_CHANGED id1 A3BE4075 id2 D83063E
This event signals when the health state of the device changes

WNF_SHEL_CONTENT_DELIVERY_MANAGER_NEEDS_REMEDIATION id1 A3BE4875 id2 D83063E
This event signals that Content Delivery Manager content needs remediation

WNF_SHEL_DESKTOP_APPLICATION_STARTED id1 A3BE5075 id2 D83063E
This event is signals when a desktop application launches. The Payload is the executable name.

WNF_SHEL_DESKTOP_APPLICATION_TERMINATED id1 A3BE5875 id2 D83063E
This event is signals when a desktop application is terminated. The Payload is the executable name.

WNF_SHEL_SUGGESTED_APP_READY id1 A3BE60F5 id2 D83063E
This event signals that the app launched by sign in suggestions is ready.

WNF_SHEL_CDM_REGISTRATION_COMPLETE id1 A3BE6835 id2 D83063E
This event is scoped to the user session and signaled when the CDM registration is complete

WNF_SHEL_CONTENT_DELIVERY_MANAGER_MONITORING id1 A3BE70F5 id2 D83063E
This event signals that Content Delivery Manager Cache Monitoring is Enabled or not.

WNF_SHEL_SIGNAL_LOGONUI id1 A3BE7835 id2 D83063E
Used to signal logon controller across the desktop boundary. Only local system or the composer can read and write. Currently payload is present but ignored.

WNF_SHEL_ENTERPRISE_HIDE_PEOPLE_BAR_POLICY_VALUE_CHANGED id1 A3BE8075 id2 D83063E
This event signals when the HidePeopleBar MDM policy has been updated

WNF_SHEL_CORTANA_MIC_TRAINING_COMPLETE id1 A3BE88F5 id2 D83063E
This event signals when cortana speech training for 'Respond only to me' is complete

WNF_SHEL_CDM_FEATURE_USAGE id1 A3BE9075 id2 D83063E
This event notifies the CDM when a feature configuration is used

WNF_SHEL_OOBE_PROVISIONING_COMPLETE id1 A3BE9C75 id2 D83063E
This event signals when OOBE in a Shell has completed its provisioning flow. It is permanent since provisioning is only supported during first user OOBE.

WNF_SHEL_SIGNAL_MANAGER_SIGNAL_TRIGGERED id1 A3BEA075 id2 D83063E
This event signals when the signal manager fires a signal

WNF_SHEL_CLOUD_FILE_INDEXED_CHANGE id1 A3BEA875 id2 D83063E
Notification is incremented / signaled when a cloudfile state change is detected by the indexer service. Payload is count of changes. User can subscribe, but only service (indexer) can publish

WNF_SHEL_CLOUD_FILE_PROGRESS_CHANGE id1 A3BEB075 id2 D83063E
Notification when a sync client or shell session updates in-memory progress within the indexer service. Payload is the tick count when the last change occurred. User can subscribe, but only service (indexer) can publish

WNF_SHEL_START_LAYOUT_MIGRATED id1 A3BEB8F5 id2 D83063E
This event signals when Start Experience Host completes a layout migration

WNF_SHEL_ENTERPRISE_START_PLACES_POLICY_VALUE_CHANGED id1 A3BEC075 id2 D83063E
This event signals when a Start place MDM policy (AllowPinnedFolder*) has been applied

WNF_SHEL_SIGNAL_MANAGER_FEATURE_TRIGGERED id1 A3BEC875 id2 D83063E
This event is used by the Signal Manager for WIL Feature Usage subscriptions required by registered signal triggers.

WNF_SHEL_ACTIONCENTER_VIEWSTATE_CHANGED id1 A3BED035 id2 D83063E
This event signals the current view state of action center.

WNF_SHEL_CACHED_CLOUD_NETWORK_STATE id1 A3BED875 id2 D83063E
State of the network as reflected by shell32 listeners. Subscribed to, and published from, explorer.exe, a user process.

WNF_SHEL_SIGNAL_MANAGER_TESTING id1 A3BEE075 id2 D83063E
This wnf is used for testing purposes.

WNF_SHEL_APPLIFECYCLE_INSTALL_STATE id1 A3BEE875 id2 D83063E
This event signals for different app install state from the Store. The Payload is the aumId and app state.

WNF_SHEL_RESTORE_PAYLOAD_COMPLETE id1 A3BEF075 id2 D83063E
CDS restore payload data is downloaded during OOBE

WNF_SHEL_LATEST_CONNECTED_AUTOPLAY_DEVICE id1 A3BEF875 id2 D83063E
This wnf is signaled everytime the user connects an autoplay device. The payload is the device id (VID and PID).

WNF_SHEL_CORTANA_QUIET_MOMENT_AT_HOME id1 A3BF0475 id2 D83063E
This wnf is signaled when Cortana's QuietMoment @Home inferred that the user has arrived of left home .

WNF_SHEL_CORTANA_BEACON_STATE_CHANGED id1 A3BF1075 id2 D83063E
This wnf is signaled everytime the Action Center/Cortana beacon state changes. Payload is an int mapping to an enum representing the new state.

WNF_SHEL_QUIETHOURS_ACTIVE_PROFILE_CHANGED id1 A3BF1C75 id2 D83063E
This wnf is signaled whenever active quiet hours profile/mode changes. The value is the restrictive level of an active profile and the restrictive level is unique per profile

WNF_SHEL_LOCK_ON_LOGON id1 A3BF2035 id2 D83063E
This wnf is signaled when WinLogon detects an automatic lock on logon sequence to optimize displaying the user lock screen when the shell is ready.

WNF_SHEL_DEVICE_OPEN id1 A3BF2875 id2 D83063E
This wnf indicates for some types of devices if a lid, cover or enclosure around it is closed (zero value) or open (non-zero value).

WNF_SHEL_CREATIVE_EVENT_BATTERY_SAVER_OVERRIDE_TRIGGERED id1 A3BF3075 id2 D83063E
This event signals a creative event has been triggered that will allow to run during battery saver

WNF_SHEL_START_PROCESS_SUSPENDED_INTERNAL id1 A3BF3835 id2 D83063E
This event allows user-mode services such as Windows Notification Platform to determine when Start is suspended

WNF_SHEL_SYSTEMDIALOG_PUBLISHED id1 A3BF4035 id2 D83063E
This event signals when a new System Dialog toast is published

WNF_SHEL_SETTINGS_ENVIRONMENT_CHANGED id1 A3BF4875 id2 D83063E
This wnf indicates that a variable in the settings environment has changed. The payload is the current sessionId.

WNF_SHEL_QUIET_MOMENT_GAME_MODE_CHANGED id1 A3BF5075 id2 D83063E
This event signals when Quiet Hours game mode state changes

WNF_SHEL_NEXT_NOTIFICATION_SINK_SESSION_ID id1 A3BF5875 id2 D83063E
A system-wide unique rolling id for notification controller sink sessions

WNF_SHEL_TAB_SHELL_INIT_COMPLETE id1 A3BF6035 id2 D83063E
Event signals Tab Shell component initialization is complete, potentially after an explorer crash. Payload is an incrementing DWORD that can be used to poll if the current objects are new.

WNF_SHEL_LOCKAPPHOST_ACTIVE id1 A3BF6835 id2 D83063E
Set to 0 or 1 to indicate whether lockapphost is currently active. Anyone (including apps) can read, system has write access (but on multi-session skus authenticated users also have write access). Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.

WNF_SHEL_CORTANA_CAPABILTIES_CHANGED id1 A3BF7035 id2 D83063E
This wnf indicates that a cortana capabilties have changed. The payload will be the changed capabilties. The below sids are the cortana app and test app sids

WNF_SHEL_TASKBAR_PINS_UPDATED id1 A3BF7875 id2 D83063E
This event indicates taskbar pins were updated. The SDDL is scoped to AuthenticatedUsers.

WNF_SHEL_WCOS_SESSION_ID id1 A3BF8075 id2 D83063E
This system-scope event is signaled each time the shell attempts to start a local session on WCOS-based SKUs. It carries the latest session ID. Everyone can read from it. Authenticated users can write to it. Apps in general can read from it. Apps with WINCAP_SHELL_EXPERIENCE_COMPOSER can write to it.

WNF_SHEL_ASSISTANT_STATE_CHANGE id1 A3BF8875 id2 D83063E
This wnf indicates that the assistant state has changed, e.g Talking, idle, thinking, notification pending etc

WNF_SIO_PIN_ENROLLED id1 A3BC0875 id2 4189073E
Used to notify the PIN list that a PIN has been enrolled and that it should refresh.

WNF_SIO_BIO_ENROLLED id1 A3BC1075 id2 4189073E
Used to notify the Delay Lock settings that Biometric enrollment has been modified.

WNF_SKYD_FILE_SYNC id1 A3BC0875 id2 59F053E
A file has changed on storage and a request is received to sync.

WNF_SKYD_QUOTA_CHANGE id1 A3BC1075 id2 59F053E
A user's quota has changed.

WNF_SMS_CHECK_ACCESS id1 A3BC0875 id2 4195033E
This event triggers when the user revokes SMS access.

WNF_SMSS_MEMORY_COOLING_COMPATIBLE id1 A3BC0875 id2 1295033E
This event triggers when the system has multiple memory channels and memory cooling can be started

WNF_SPAC_SPACEPORT_PROPERTY_CHANGED id1 A3BC0875 id2 2871E3E
This notification is issued when a property of an object changes

WNF_SPAC_SPACEPORT_WORK_REQUESTED id1 A3BC1075 id2 2871E3E
This notification is issued to request work in user-mode

WNF_SPCH_INPUT_STATE_UPDATE id1 A3BC0835 id2 9851E3E
Indicates the state of the shared recognizer.

WNF_SPCH_REMOTE_SESSION_REQUEST id1 A3BC1075 id2 9851E3E
Indicates the data pertaining to a remote request to start/stop a speech recognition session. Published by BTAGService and HidSrv

WNF_SPCH_DISABLE_KWS_REQUEST id1 A3BC1875 id2 9851E3E
Indicates the KWS request from a remote device. Certain peripherals that support in-built KWS may request the system to disable the KWS runnning on Windows. Published by BTAGService

WNF_SRUM_SCREENONSTUDY_SESSION id1 A3BC0875 id2 C931C3E
Sent when a screen on study session starts or ends

WNF_SRV_SRV2_STATE_CHANGE id1 A3BC0875 id2 41901C3E
This event signals when the server (SRV2) start/stop

WNF_SRV_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC1075 id2 41901C3E
This event signals when the server didn't discover SMB1 usage for a specific period

WNF_OSWN_STORAGE_PRESENCE_CHANGE id1 A3BC6075 id2 F911D22
This event indicates a change in the mount state of an SD card.

WNF_OSWN_STORAGE_VOLUME_STATUS_CHANGE id1 A3BC6875 id2 F911D22
This event indicates a change in the volume status of an SD card.

WNF_OSWN_STORAGE_FREE_SPACE_CHANGE id1 A3BC7075 id2 F911D22
This event indicates a change in the free space state of storage.

WNF_OSWN_STORAGE_TEMP_CLEANUP_CHANGE id1 A3BC7875 id2 F911D22
This event indicates a change in the temp file cleanup state of storage.

WNF_OSWN_STORAGE_FINISHED_USAGE_CATEGORY_UPDATE id1 A3BCB875 id2 F911D22
This event indicates completion of an update of storage usage categories.

WNF_OSWN_SYSTEM_CLOCK_CHANGED id1 A3BC5875 id2 F911D22
This event informs the system tray that the date-time has changed

WNF_OSWN_STORAGE_SHELLHWD_EVENT id1 A3BCC075 id2 F911D22
This event informs StorSvc that SHSVCS received a device handle event.

WNF_OSWN_STORAGE_APP_PAIRING_CHANGE id1 A3BC8075 id2 F911D22
This event indicates a change in the app pairing state of an SD card.

WNF_SUPP_ENABLE_ERROR_DETAILS_CACHE id1 A3BC0875 id2 11961B3E
Enable the Error Details Cache

WNF_SYS_SHUTDOWN_IN_PROGRESS id1 A3BC0875 id2 4195173E
The state is published when the system has begun the shutdown or reboot process.

WNF_SEB_INTERNET_PRESENT id1 A3BC0875 id2 41840B3E
Internet available or not

WNF_SEB_FREE_NETWORK_PRESENT id1 A3BC1075 id2 41840B3E
Free network available or not

WNF_SEB_SMS_RECEIVED id1 A3BC1875 id2 41840B3E
SMS has been received

WNF_SEB_NETWORK_STATE_CHANGES id1 A3BC2075 id2 41840B3E
Network state has changed

WNF_SEB_MBAE_NOTIFICATION_RECEIVED id1 A3BC2875 id2 41840B3E
Radio Operator Message received

WNF_SEB_NETWORK_CONTROL_CHANNEL_TRIGGER_RESET id1 A3BC3075 id2 41840B3E
Network control channel triggers have been reset

WNF_SEB_TIME_ZONE_CHANGE id1 A3BC3875 id2 41840B3E
Time zone change

WNF_SEB_ONLINE_ID_CONNECTED_STATE_CHANGE id1 A3BC4075 id2 41840B3E
Online ID connected state changed. SDDL comes from ID_CAP_EVERYONE in %SDXROOT%\src\baseos\prod\packages\WLId\WLId.pkg.xml

WNF_SEB_SYSTEM_IDLE id1 A3BC4875 id2 41840B3E
system is idle or not

WNF_SEB_BATTERY_LEVEL id1 A3BC5075 id2 41840B3E
System is idle or not

WNF_SEB_DOMAIN_JOINED id1 A3BC5875 id2 41840B3E
System is domain joined or not

WNF_SEB_BOOT id1 A3BC6075 id2 41840B3E
System has booted

WNF_SEB_USER_PRESENT id1 A3BC6875 id2 41840B3E
System has at least 1 user present

WNF_SEB_SYSTEM_AC id1 A3BC7075 id2 41840B3E
System is AC or DC

WNF_SEB_MONITOR_ON id1 A3BC7875 id2 41840B3E
Monitor is ON or OFF

WNF_SEB_IP_ADDRESS_AVAILABLE id1 A3BC8075 id2 41840B3E
IP address is available or not

WNF_SEB_BACKGROUND_WORK_COST_CHANGE id1 A3BC8875 id2 41840B3E
Indicate a change in the background work cost

WNF_SEB_BACKGROUND_WORK_COST_HIGH id1 A3BC9075 id2 41840B3E
Background work cost is high or not

WNF_SEB_SYSTEM_LPE id1 A3BC9875 id2 41840B3E
System is in Low Power Epoch or not

WNF_SEB_SMART_CARD_TRANSACTION_NOTIFICATION id1 A3BCA075 id2 41840B3E
Smart card transaction notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml

WNF_SEB_SYSTEM_MAINTENANCE id1 A3BCA875 id2 41840B3E
System is in good state for maintenance

WNF_SEB_GEOLOCATION id1 A3BCB075 id2 41840B3E
Geolocation service should be started

WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCB875 id2 41840B3E
OEM custom notification received

WNF_SEB_MOB_OPERATOR_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCC075 id2 41840B3E
MO custom notification received

WNF_SEB_CACHED_FILE_UPDATED id1 A3BCC875 id2 41840B3E
Cached file has updated

WNF_SEB_SMART_CARD_FIELD_INFO_NOTIFICATION id1 A3BCD075 id2 41840B3E
Smart card field entry/exit notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml

WNF_SEB_SMART_CARD_HCE_APPLICATION_ACTIVATION_NOTIFICATION id1 A3BCD875 id2 41840B3E
Smart card HCE application activation notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml

WNF_SEB_DEPRECATED7 id1 A3BCE075 id2 41840B3E
Unused notification

WNF_SEB_DEPRECATED8 id1 A3BCE875 id2 41840B3E
Unused notification

WNF_SEB_LOW_LATENCY_POWER_REQUEST id1 A3BCF075 id2 41840B3E
Low-latency power request notification

WNF_SEB_RESILIENCY_NOTIFICATION_PHASE id1 A3BCF875 id2 41840B3E
Resiliency phase notification

WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK id1 A3BD0075 id2 41840B3E
Fullscreen video playback notification

WNF_SEB_NFC_PERF_BOOST id1 A3BD0875 id2 41840B3E
Indicates high-performance boost mode for critical NFC background activity

WNF_SEB_APP_LAUNCH_PREFETCH id1 A3BD1075 id2 41840B3E
Indicates app launch pre-fetch phase

WNF_SEB_DEPRECATED1 id1 A3BD1875 id2 41840B3E
Unused notification

WNF_SEB_APP_RESUME id1 A3BD2075 id2 41840B3E
Indicates app resume phase

WNF_SEB_DEPRECATED2 id1 A3BD2875 id2 41840B3E
Unused notification

WNF_SEB_DEPRECATED3 id1 A3BD3075 id2 41840B3E
Unused notification

WNF_SEB_DEPRECATED4 id1 A3BD3875 id2 41840B3E
Unused notification

WNF_SEB_DEPRECATED5 id1 A3BD4075 id2 41840B3E
Unused notification

WNF_SEB_DEPRECATED6 id1 A3BD4875 id2 41840B3E
Unused notification

WNF_SEB_CALL_STATE_CHANGED id1 A3BD5075 id2 41840B3E
Call state change notification

WNF_SEB_VOICEMAIL_CHANGED id1 A3BD5875 id2 41840B3E
Voicemail change notification

WNF_SEB_CALL_HISTORY_CHANGED id1 A3BD6075 id2 41840B3E
Call history change notification

WNF_SEB_LINE_CHANGED id1 A3BD6875 id2 41840B3E
Phone line change notification

WNF_SEB_AIRPLANE_MODE_DISABLED_FOR_EMERGENCY_CALL id1 A3BD7075 id2 41840B3E
Airplane mode disabled for emergency call notification

WNF_SEB_MOBILE_BROADBAND_REGISTRATION_STATE_CHANGE id1 A3BD7875 id2 41840B3E
Registration state has changed

WNF_SEB_MOBILE_BROADBAND_RADIO_STATE_CHANGE id1 A3BD8075 id2 41840B3E
Radio state has changed

WNF_SEB_MOBILE_BROADBAND_PIN_LOCK_STATE_CHANGE id1 A3BD8875 id2 41840B3E
Pin lock state has changed

WNF_SEB_MOBILE_BROADBAND_DEVICE_SERVICE_NOTIFICATION id1 A3BD9075 id2 41840B3E
Device service command has been received

WNF_SEB_DEFAULT_SIGN_IN_ACCOUNT_CHANGE id1 A3BD9875 id2 41840B3E
Default Sign In account has changed

WNF_SEB_NETWORK_CONNECTIVITY_IN_STANDBY id1 A3BDA075 id2 41840B3E
Network connectivity in Standby

WNF_SEB_USER_PRESENCE_CHANGED id1 A3BDA875 id2 41840B3E
User presence changed

WNF_SEB_AUDIO_ACTIVITY id1 A3BDB075 id2 41840B3E
Audio activity in progress

WNF_SEB_FULL_SCREEN_HDR_VIDEO_PLAYBACK id1 A3BDB875 id2 41840B3E
Fullscreen HDR video playback notification

WNF_SEB_UWP_APP_LAUNCH id1 A3BDC075 id2 41840B3E
Indicates UWP app launch phase

WNF_SEB_MOBILE_BROADBAND_PCO_VALUE_CHANGE id1 A3BDC875 id2 41840B3E
Pco data has been received

WNF_SEB_MIXED_REALITY id1 A3BDD075 id2 41840B3E
Mixed reality notification

WNF_SEB_GAME_MODE id1 A3BDD875 id2 41840B3E
Game mode scenario

WNF_SPI_LOGICALDPIOVERRIDE id1 A3BC0835 id2 418F1E3E
Signals a change caused by SystemParametersInfo(SPI_SETLOGICALDPIOVERRIDE). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_SPI_PRIMARY_MONITOR_DPI_CHANGED id1 A3BC1035 id2 418F1E3E
This is triggered when the Primary monitor's DPI is different than the session's DPI.

WNF_TMCN_ISTABLETMODE id1 A3BC0835 id2 F850339
The computer has changed density mode. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TEAM_SHELL_HOTKEY_PRESSED id1 A3BC0875 id2 C870B39
Indicates a hotkey was pressed

WNF_TEL_STORAGE_CAPACITY id1 A3BE0875 id2 418A0B39
This is fired every time an SENSE's storage fullness crosses into a new tier or is reset. struct { DWORD PercentageFull[4]; }

WNF_TEL_DAILY_UPLOAD_QUOTA id1 A3BE1075 id2 418A0B39
This is fired every time an SENSE's daily upload quota crosses into a new tier or is reset. struct { DWORD PercentageFull; }

WNF_TEL_ONESETTINGS_UPDATED id1 A3BE1875 id2 418A0B39
This is fired every time a onesettings namespace is updated. {UINT64 SettingsCount; struct {UINT64 NamespaceHash; UINT64 TimeLastChanged;}[16]}

WNF_TEL_SETTINGS_PUSH_NOTIFICATION_RECEIVED id1 A3BE2075 id2 418A0B39
This is fired every time a push notification is received from the OneSettings service. UTF8 string.

WNF_TEL_TIMER_RECONFIGURED id1 A3BE2875 id2 418A0B39
This is fired every time a UTC service timer changes its configuration values so subscribers can call GetTimerConfiguration to check any new values.

WNF_PHN_CALL_STATUS id1 A3BC2875 id2 4188063D
Bitmask containing the current relevant call states. Any 3rd party app is allowed to listen to this. See PhoneWnf.h for valid values. SID referenced below is that of the Phone service.

WNF_PHN_CALLFORWARDING_STATUS_LINE0 id1 A3BC3075 id2 4188063D
Bitmask containing the call forwarding state for phone line 0. See PhoneWnf.h for valid values. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_PHNP_SERVICE_INITIALIZED id1 A3BC3875 id2 1188063D
BOOL indicating whether the Phone service has been initialized. SDDL comes from phoneCall and ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%%\src\src\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_PHNP_SIMSEC_READY id1 A3BC4075 id2 1188063D
BOOL indicating whether SimSec is ready to receive requests. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml

WNF_PHNP_ANNOTATION_ENDPOINT id1 A3BC4875 id2 1188063D
Wide string indicating the call annotation provider's RPC endpoint name. SDDL comes from ID_CAP_CALLMESSAGING_FILTER and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_PHNL_LINE1_READY id1 A3BC4075 id2 D88063D
BOOL indicating whether the line is ready. SDDL comes from PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_TETH_TETHERING_STATE id1 A3BC0875 id2 9920B39
State name for the Tethering service notification of all state changes

WNF_TETH_AUTOSTART_BLUETOOTH id1 A3BC1075 id2 9920B39
State name for starting Tethering service over Bluetooth

WNF_IME_INPUT_MODE_LABEL id1 A3BC0875 id2 41830324
Input Mode Indicator label IME want to show on systray. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_IME_EXPLICIT_PRIVATE_MODE id1 A3BC1035 id2 41830324
Explicit IME private mode status. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622

WNF_IME_AUTOMATIC_PRIVATE_MODE id1 A3BC1835 id2 41830324
Automatic IME private mode status.

WNF_THME_THEME_CHANGED id1 A3BC0875 id2 48B0639
Notifies when the theme of the system changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TZ_LEGACY_STORE_CHANGED id1 A3BC0875 id2 41C61439
Time Zone Legacy store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TZ_STORE_CHANGED id1 A3BC1075 id2 41C61439
Time Zone store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TZ_TIMEZONE_CHANGED id1 A3BC1875 id2 41C61439
This state is notified when the timezone is changed via SetTimeZoneInformationByID - The data value is a UINT that indicates the new TZID. SDDL comes from ID_CAP_BUILTIN_SETTIME, ID_CAP_EVERYONE and tzautoupdate in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml

WNF_TZ_LAST_TIME_SYNC_INFO id1 A3BC2075 id2 41C61439
This event has information about last time sync. SDDL comes from autotimesvc's account.

WNF_TZ_NETWORK_TIME_SYNC_TRIGGER id1 A3BC2875 id2 41C61439
This event is used to trigger Network Sync. SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml

WNF_TZ_AUTOTIMEUPDATE_STATE_CHANGED id1 A3BC3075 id2 41C61439
This state is notified when autotimeupdate state changed. The data value is a DWORD that indicates if autotimeupdate is enabled (1) or disabled (0). SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml

WNF_TOPE_INP_POINTER_DEVICE_ACTIVITY id1 A3BC0875 id2 4960139
Touch Event

WNF_TKBN_KEYBOARD_VISIBILITY id1 A3BC0835 id2 F840539
The touch keyboard's appearance on the screen has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_RESTRICTED_KEYBOARD_VISIBILITY id1 A3BC1035 id2 F840539
The restricted mode touch keyboard's appearance on the screen has changed.

WNF_TKBN_IMMERSIVE_FOCUS_TRACKING id1 A3BC1835 id2 F840539
An immersive application has encountered a focus change. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_TOUCH_EVENT id1 A3BC2035 id2 F840539
An application encountered a touch down/up event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_RESTRICTED_TOUCH_EVENT id1 A3BC2835 id2 F840539
An application encountered a touch down/up event

WNF_TKBN_LANGUAGE id1 A3BC3035 id2 F840539
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_FOREGROUND_WINDOW id1 A3BC3835 id2 F840539
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_CARET_TRACKING id1 A3BC4035 id2 F840539
Caret tracking has updated on the desktop. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_AUTOCOMPLETE id1 A3BC4835 id2 F840539
The autocomplete window has been updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_MODERN_KEYBOARD_FOCUS_TRACKING id1 A3BC5035 id2 F840539
Determines whether focus is in an editable field for the purposes of the modern keyboard. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_KEYBOARD_VIEW_CHANGE id1 A3BC5835 id2 F840539
The view being shown by the touch keyboard has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_RESTRICTED_KEYBOARD_VIEW_CHANGE id1 A3BC6035 id2 F840539
The view being shown by the restricted mode touch keyboard has changed.

WNF_TKBN_KEYBOARD_GESTURE id1 A3BC6835 id2 F840539
The keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_RESTRICTED_KEYBOARD_GESTURE id1 A3BC7035 id2 F840539
The restricted keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact.

WNF_TKBN_CANDIDATE_WINDOW_STATE id1 A3BC7835 id2 F840539
The candidate window state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_KEYBOARD_LAYOUT_CHANGE id1 A3BC8035 id2 F840539
The layout being shown by the touch keyboard has changed.

WNF_TKBN_RESTRICTED_KEYBOARD_LAYOUT_CHANGE id1 A3BC8835 id2 F840539
The layout being shown by the restricted mode touch keyboard has changed.

WNF_TKBN_COMPOSITION_STATE id1 A3BC9035 id2 F840539
The composition state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_SYSTEM_IMMERSIVE_FOCUS_TRACKING id1 A3BC9835 id2 F840539
A System Mode Application(Logon/OOBE) has encountered a focus change

WNF_TKBN_SYSTEM_TOUCH_EVENT id1 A3BCA035 id2 F840539
A System Mode application(Logon/OOBE) encountered a touch down/up event

WNF_TKBN_INPUT_PANE_DISPLAY_POLICY id1 A3BCA835 id2 F840539
The edit control in focus has changed the input pane display policy (manual/automatic). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_DESKTOP_MODE_AUTO_IHM id1 A3BCB035 id2 F840539
The system is in desktop mode but the user prefers tablet-mode IHM behavior. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_KEYBOARD_SET_VISIBLE id1 A3BCB835 id2 F840539
The touch keyboard should show or hide. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBN_KEYBOARD_SET_VISIBLE_NOTIFICATION id1 A3BCC035 id2 F840539
Update the show/hide status of touch keyboard that is being tracked in tabtip. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_TKBR_CHANGE_SYSTEM id1 A3BC08F5 id2 13840539
This state name is used to notify system components about state changes in the Token Broker

WNF_TKBR_CHANGE_APP id1 A3BC1075 id2 13840539
This state name is used to notify apps about state changes in the Token Broker

WNF_TKBR_CHANGE_APP_INTERNAL id1 A3BC18F5 id2 13840539
This state name is used to notify apps about state changes in the Token Broker

WNF_TPM_OWNERSHIP_TAKEN id1 A3BC0875 id2 418B1E39
This event signals when the Win32_TPM provider has completed taking ownership of the TPM.

WNF_TPM_DEVICEID_STATE id1 A3BC1075 id2 418B1E39
This event signals the state of the TPM-based DeviceID.

WNF_TPM_PROVISION_TRIGGER id1 A3BC1875 id2 418B1E39
This event triggers the TPM provisioning/status check to run.

WNF_TPM_CLEAR_PENDING id1 A3BC2075 id2 418B1E39
This event signals a TPM Clear will be attempted.

WNF_TPM_CLEAR_RESULT id1 A3BC2875 id2 418B1E39
This event signals if ownership was taken during TPM Provisioning and the result of TPM Clear on last reboot.

WNF_TPM_DISABLE_DEACTIVATE_PENDING id1 A3BC3075 id2 418B1E39
This event signals a TPM Disable or TPM Deactivate will be attempted.

WNF_TPM_ENABLE_ACTIVATE_COMPLETED id1 A3BC3875 id2 418B1E39
This event signals after the TPM is Enabled or Activated.

WNF_TPM_MAINTENANCE_TASK_STATUS id1 A3BC4075 id2 418B1E39
This event signals the TPM maintenance task status.

WNF_UBPM_POWER_SOURCE id1 A3BC0875 id2 C960C38
The machine power source state

WNF_UBPM_CONSOLE_MONITOR id1 A3BC1075 id2 C960C38
The machine console monitor on/off state

WNF_UBPM_FRMU_ALLOWED id1 A3BC1875 id2 C960C38
The user is present and machine is on batteries and the battery level is above firmware update thershold

WNF_UBPM_PRESHUTDOWN_PHASE id1 A3BC2075 id2 C960C38
The machine entered pre shutdown phase

WNF_UMDF_WUDFSVC_START id1 A3BC0875 id2 7820338
Trigger the Driver Manager service start

WNF_UMDF_DRVMGR_STATUS id1 A3BC1075 id2 7820338
State name indicating the status of the UMDF driver manager

WNF_USO_STATE_CHANGE id1 A3BC0875 id2 41891D38
Signals that a state transition occurred for an update session.

WNF_USO_STATE_ATTENTION_REQUIRED id1 A3BC1075 id2 41891D38
Signals that a state encounter a condition that requires attention.

WNF_USO_UPDATE_PROGRESS id1 A3BC1875 id2 41891D38
Signals the a change in progess of an update session.

WNF_USO_REBOOT_REQUIRED id1 A3BC2075 id2 41891D38
Signals that a reboot is required to complete the update session.

WNF_USO_ACTIVE_SESSION id1 A3BC2875 id2 41891D38
Signals that the current active session is changed.

WNF_USO_UPDATE_SUCCEEDED id1 A3BC3075 id2 41891D38
Signals that updates have installed successfully on lite servicing stack.

WNF_USO_UPTODATE_STATUS_CHANGED id1 A3BC3875 id2 41891D38
Signals that the machine's up to date status has changed.

WNF_USO_REBOOT_BLOCK_REQUESTED id1 A3BC4075 id2 41891D38
Signals that USO should not reboot the system.

WNF_USO_DOWNLOAD_STARTED id1 A3BC4875 id2 41891D38
Signals that update download has started on lite servicing stack.

WNF_USO_INSTALL_STARTED id1 A3BC5075 id2 41891D38
Signals that update install has started on lite servicing stack.

WNF_USO_INSTALL_STATE id1 A3BC5875 id2 41891D38
Signals various install states on lite servicing stack.

WNF_USO_SERVICE_STOPPING id1 A3BC6075 id2 41891D38
Signals that USO is stopping.

WNF_USO_SETTINGS_REFRESHED id1 A3BC6875 id2 41891D38
Signals that USO settings have been refreshed.

WNF_USO_ACTIVEHOURS_STARTED id1 A3BC7075 id2 41891D38
Signals that USO active hours have started.

WNF_DICT_CONTENT_CHANGED id1 A3BC0875 id2 15850729
The content of a user dictionary has changed (word either added or removed). SDDL SID's come from capability ID_CAP_INPUT_CORE (both application and service SID's), and DefAppsCapabilitiesGroup

WNF_UMGR_SIHOST_READY id1 A3BC0835 id2 13810338
Shell Infrastructure host is ready.

WNF_UMGR_USER_LOGIN id1 A3BC1075 id2 13810338
The user was logged in to the system.

WNF_UMGR_USER_LOGOUT id1 A3BC1875 id2 13810338
The user was logged out of the system.

WNF_UMGR_SYSTEM_USER_CONTEXT_CHANGED id1 A3BC2075 id2 13810338
Default system user, as defined by start view, has changed.

WNF_UMGR_SESSIONUSER_TOKEN_CHANGE id1 A3BC2875 id2 13810338
Token for the session user changed.

WNF_UMGR_SESSION_ACTIVE_SHELL_USER_CHANGE id1 A3BC3035 id2 13810338
Session active shell user changed.

WNF_UMGR_USER_TILE_CHANGED id1 A3BC3875 id2 13810338
The user tile for the specified SID was changed. The payload is the String user sid and the datasize is the byte count of MAX_PATH.

WNF_VAN_VANUI_STATUS id1 A3BC0875 id2 41880F3B
The VAN UI open close status

WNF_VTSV_CDS_SYNC id1 A3BC0875 id2 17951A3B
Notification for syncing CDS WebCredential store

WNF_VPN_CLIENT_CONNECTIVITY_STATUS id1 A3BC0875 id2 41881E3B
The VPN Client connectivity status. SDDL gives RasMan read/write permissions, rescap:networkingVpnProvider read permissions, and Authenticated User read permissions.

WNF_WAAS_QUALITY_IMPACT id1 A3BC0875 id2 12870F3A
WaaS Assessment Impact level for quality update

WNF_WAAS_FEATURE_IMPACT id1 A3BC1075 id2 12870F3A
WaaS Assessment Impact level for feature update

WNF_WCM_INTERFACE_LIST id1 A3BC0875 id2 418B0D3A
This event signals when a WCM-managed network interface has been added or removed

WNF_WCM_SERVICE_STATUS id1 A3BC1075 id2 418B0D3A
Connection Manager service restart

WNF_WCM_MAPPING_POLICY_UPDATED id1 A3BC1875 id2 418B0D3A
WNF state for refreshing WCM service mapping policies cache

WNF_WCM_PROFILE_CONFIG_UPDATED id1 A3BC2075 id2 418B0D3A
WNF state for refreshing WCM's selection multiplex table and selectable connection list

WNF_WCM_INTERFACE_CONNECTION_STATE id1 A3BC2875 id2 418B0D3A
This event signals when a WCM-managed network interface has changed its connection quality state

WNF_CNET_DPU_GLOBAL_STATE_OVER_LIMIT id1 A3BC1075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to OVER_LIMIT, otherwise it is 0

WNF_CNET_DPU_GLOBAL_STATE_OFF_TRACK id1 A3BC1875 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to OFF_TRACK, otherwise it is 0

WNF_CNET_DPU_GLOBAL_STATE_ON_TRACK id1 A3BC2075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to ON_TRACK, otherwise it is 0

WNF_CNET_DPU_GLOBAL_STATE_UNDER_TRACK id1 A3BC2875 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to UNDER_TRACK, otherwise it is 0

WNF_CNET_DPU_GLOBAL_STATE_NOT_TRACKED id1 A3BC3075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to NOT_TRACKED, otherwise it is 0

WNF_CNET_CELLULAR_CONNECTIONS_AVAILABLE id1 A3BC4875 id2 1583002E
State name for Cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_CNET_NON_CELLULAR_CONNECTED id1 A3BC6875 id2 1583002E
The state is 1 when a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_CNET_RADIO_ACTIVITY_OR_NON_CELLULAR_CONNECTED id1 A3BC7075 id2 1583002E
The state is 1 when Radio is active or a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_CNET_RADIO_ACTIVITY id1 A3BC7875 id2 1583002E
The state is 1 when Cellular data is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System

WNF_CNET_WIFI_ACTIVITY id1 A3BC8075 id2 1583002E
The state is 1 when WiFi is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System

WNF_DUSM_TASK_TOAST id1 A3BC0875 id2 C951B29
Trigger task scheduler to launch task for toast

WNF_DUSM_IS_CELLULAR_BACKGROUND_RESTRICTED id1 A3BC1075 id2 C951B29
The state is 1 when cellular internet connection is not allowed to any UWP Application running in background, the state is 0 when cellular internet connection is allowed to any applications running in foreground or background.

WNF_WDAG_SETTINGS_CHANGED_USER id1 A3BC0875 id2 6870A3A
A Settings for WDAG requiring the user context has changed.

WNF_WDAG_SETTINGS_CHANGED_SYSTEM id1 A3BC1075 id2 6870A3A
A Settings for WDAG requiring system context has changed.

WNF_WDSC_ACCOUNT_PROTECTION_REFRESH id1 A3BC0875 id2 2950A3A
This event triggers a refresh for the account pillar state

WNF_WEBA_CTAP_DEVICE_STATE id1 A3BC0875 id2 840B3A
This event signals CTAP device state changes.

WNF_WEBA_CTAP_DEVICE_CHANGE_NOTIFY id1 A3BC1075 id2 840B3A
This event signals CTAP device was inserted or tapped.

WNF_WER_SERVICE_START id1 A3BC0875 id2 41940B3A
The WER service needs to start. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187

WNF_WER_QUEUED_REPORTS id1 A3BC1075 id2 41940B3A
The number of reports queued to the machine store. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187

WNF_WER_CRASH_STATE id1 A3BC1875 id2 41940B3A
Information about applications currently crashing.

WNF_WIFI_CONNECTION_STATUS id1 A3BC0875 id2 880073A
State name for Wifi radio and connection status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_CPL_STATUS id1 A3BC1075 id2 880073A
State name for Wifi CPL status flags

WNF_WIFI_SERVICE_NOTIFICATIONS id1 A3BC2075 id2 880073A
Notifications received from the WiFi Conn Svc. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_HOTSPOT_HOST_READY id1 A3BC2875 id2 880073A
State name for Wifi Hotspot Host ready flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_AOAC_STATUS id1 A3BC4875 id2 880073A
State name for Wifi power status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_CONNECTION_SCORE id1 A3BC5875 id2 880073A
State name for Wifi connection status and connection score updates

WNF_WIFI_TILE_UPDATE id1 A3BC6075 id2 880073A
State name for Wifi network tiles updated. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_AVERAGE_TRANSMIT id1 A3BC6875 id2 880073A
Average peak transmitted traffic seen by NCSI

WNF_WIFI_MEDIA_STREAMING_MODE id1 A3BC7075 id2 880073A
Last media streaming mode state change

WNF_WIFI_TASK_TRIGGER id1 A3BC7875 id2 880073A
State name triggering WiFiNetworkManager background task. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_L3_AUTH_STATE id1 A3BC8075 id2 880073A
State for triggering browser UI when a network is hijacked. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml

WNF_WIFI_WLANSVC_NOTIFICATION id1 A3BC8875 id2 880073A
This event sends notifications from wlansvc

WNF_WIFI_HOTSPOT2_REGISTRATION_STATUS id1 A3BC9075 id2 880073A
State name for triggering hotspot2 registration status from online signup server

WNF_WIFI_PROTECTED_SCENARIO id1 A3BC9875 id2 880073A
Signals that the Wi-Fi stack is handling an important scenario which must be protected from disruptive activity such as unexpected scans, or activity on a shared radio.

WNF_WIFI_MOVEMENT_DETECTED id1 A3BCA075 id2 880073A
Event indicating that the user may have moved to a different location based on nearby AP RSSI and other signals. Value is a counter indicating how many times movement has been detected.

WNF_WCDS_SYNC_WLAN id1 A3BC0875 id2 12820D3A
State name for starting the WLAN scheduled task.

WNF_WFDN_WFD_DISCONNECTION_PROPERTIES id1 A3BC0875 id2 F82083A
Reports properties about a Wi-Fi Display disconnect

WNF_WFDN_MOVEMENT_DETECTED id1 A3BC1075 id2 F82083A
Event indicating that the user may have moved to a different location during the Infracast session. Value is a counter indicating how many times movement has been detected.

WNF_WFDN_STAY_CONNECTED_TRIGGER id1 A3BC1875 id2 F82083A
Event indicating the current state of the infra walk-away listener. 0: Listening, 1: User elected to stay connected, 2: Auto Disconnect was triggered, 3: Session ended without triggering movement detection.

WNF_WIL_FEATURE_STORE id1 A3BC0C75 id2 418A073A
Event indicating the Normal feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml

WNF_WIL_BOOT_FEATURE_STORE id1 A3BC1475 id2 418A073A
Event indicating the Boot feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml

WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_1 id1 A3BC1C75 id2 418A073A
Event to indicate the first use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_2 id1 A3BC2475 id2 418A073A
Event to indicate the first use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_3 id1 A3BC2C75 id2 418A073A
Event to indicate the first use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_USAGE_TRACKING_1 id1 A3BC3475 id2 418A073A
Event to indicate unique use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_USAGE_TRACKING_2 id1 A3BC3C75 id2 418A073A
Event to indicate unique use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_USAGE_TRACKING_3 id1 A3BC4475 id2 418A073A
Event to indicate unique use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_1 id1 A3BC4C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_2 id1 A3BC5475 id2 418A073A
Event to indicate uniquely observed code failures on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_3 id1 A3BC5C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_4 id1 A3BC6475 id2 418A073A
Event to indicate uniquely observed code failures on this device (4). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_5 id1 A3BC6C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (5). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_HEALTH_TRACKING_6 id1 A3BC7475 id2 418A073A
Event to indicate uniquely observed code failures on this device (6). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_MACHINE_FEATURE_STORE id1 A3BC7C75 id2 418A073A
Event indicates modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_MACHINE_FEATURE_STORE_MODIFIED id1 A3BC8075 id2 418A073A
Event fires once per boot on modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_USER_FEATURE_STORE id1 A3BC88F5 id2 418A073A
Event indicates modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_USER_FEATURE_STORE_MODIFIED id1 A3BC90F5 id2 418A073A
Event fires once per user session on modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.

WNF_WIL_FEATURE_USAGE_FOR_SRUM id1 A3BC9835 id2 418A073A
Event indicates there is unique and custom usage of a feature. This is for SRUM consumption. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582

WNF_WBIO_ENROLLMENT_FINISHED id1 A3BC0875 id2 E8F0C3A
This event is fired when an enrollment completes, either successfully, or unsuccessfully.

WNF_SRT_WINRE_CONFIGURATION_CHANGE id1 A3BC0875 id2 41921C3E
Triggered each time there is a configuration change in WinRE

WNF_STOR_CONFIGURATION_DEVICE_INFO_UPDATED id1 A3BC0875 id2 13891A3E
This WNF event fires when the OEM, MO, and Device Hardware values change in the registry.

WNF_STOR_CONFIGURATION_MO_TASK_RUNNING id1 A3BC1075 id2 13891A3E
This WNF event fires when the MO discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.

WNF_STOR_CONFIGURATION_OEM_TASK_RUNNING id1 A3BC1875 id2 13891A3E
This WNF event fires when the OEM discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.

WNF_WUA_NUM_PER_USER_UPDATES id1 A3BC08F5 id2 41871B3A
State stores the number of per-user updates for the current user

WNF_WUA_AU_SCAN_COMPLETE id1 A3BC1075 id2 41871B3A
Triggered each time an AU scan is completed

WNF_WUA_CALL_HANG id1 A3BC1875 id2 41871B3A
State stores information regarding WU call hangs

WNF_WUA_SERVICE_HANG id1 A3BC2075 id2 41871B3A
State stores information regarding WU service hangs

WNF_WUA_STAGEUPDATE_DETAILS id1 A3BC2875 id2 41871B3A
Triggered when a StageUpdate call has completed for a phone update installation.

WNF_WUA_UPDATE_EXPIRING id1 A3BC3075 id2 41871B3A
Indicates an update will expire on the next WU service scavenge task. The data type is a GUID which represents the update ID.

WNF_WHTP_WINHTTP_PROXY_DISCOVERED id1 A3BC0875 id2 1192063A
A network proxy has been discovered. WinHttpAutoProxySvc can write, NlaSvc can read.

WNF_WHTP_WINHTTP_PROXY_AUTHENTICATION_REQUIRED id1 A3BC1075 id2 1192063A
A proxy has returned a 407 status code.

WNF_WSQM_IS_OPTED_IN id1 A3BC0875 id2 C971D3A
Mirrors the state of CEIPEnable and CEIPSampledIn registry settings.

WNF_WNS_CONNECTIVITY_STATUS id1 A3BC0875 id2 4195003A
The WNS Connection Provider connectivity status

WNF_WOF_OVERLAY_CONFIGURATION_CHANGE id1 A3BC0875 id2 4180013A
Overlay configuration change

WNF_SHR_SHARING_CHANGED id1 A3BC0835 id2 4194063E
System sharing status changed

WNF_SHR_DHCP_IPv4_LEASE_LIST id1 A3BC1075 id2 4194063E
ICS DHCP IPv4 lease list changed

WNF_SHR_DHCP_IPv4_FASTIP_ADDRS id1 A3BC1875 id2 4194063E
New assigned Fast-IP Address(es)

WNF_KSV_STREAMSTATE id1 A3BC0875 id2 41901D26
This is the current stream state of a camera for a process in a given session

WNF_KSV_DEVICESTATE id1 A3BC1075 id2 41901D26
This is the current device state

WNF_KSV_FSSTREAMACTIVITY id1 A3BC1875 id2 41901D26
This is stream activity indicator

WNF_KSV_KSSTREAMACTIVITY id1 A3BC2075 id2 41901D26
This is stream activity indicator

WNF_KSV_CAMERAPRIVACY id1 A3BC2875 id2 41901D26
This is user global camera privacy state indicator when switched via physical button

WNF_TB_SYSTEM_TIME_CHANGED id1 A3BC0875 id2 41C60C39
Time Broker has finished processing a change ot time

WNF_UDM_SERVICE_INITIALIZED id1 A3BC0835 id2 418B0A38
BOOL + UserContextToken indicating whether the UserDataService service has been initialized for the specified user. On OneCore, SDDL gives read access to callers with userDataSystem/userDataSystem capablity group and all access to IU/AU/System. On phone, SDDL comes from ID_CAP_APPOINTMENTS, ID_CAP_COMMS_COMMON, ID_CAP_CONTACTS, ID_CAP_EVERYONE, ID_CAP_PLATFORM_EXTENSIBILITY, UserDataSvc and ID_CAP_SMS in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_UDA_CONTACT_SORT_CHANGED id1 A3BC2835 id2 41870A38
State name for aggregate sort and display order changes. SDDL comes from ID_CAP_COMMS_APPLICATIONS and ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml

WNF_XBOX_APPLICATION_CONTEXT_CHANGED id1 A3BC0875 id2 19890C35
The application specific context has changed in steady state. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_XBOX_APPLICATION_FOCUS_CHANGED id1 A3BC1075 id2 19890C35
The currently focused application has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_XBOX_APPLICATION_ACTIVATING id1 A3BC1875 id2 19890C35
An application is activating.

WNF_XBOX_APPLICATION_COMPONENT_FOCUS id1 A3BC2075 id2 19890C35
The currently focused application component has changed.

WNF_XBOX_SHELL_TOAST_NOTIFICATION id1 A3BC2875 id2 19890C35
A new toast notification has been delivered to the shell.

WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_LAUNCH id1 A3BC3075 id2 19890C35
A package is about to be unmounted from the System OS ready to launch it on the Title OS.

WNF_XBOX_PACKAGE_INSTALL_STATE_CHANGED id1 A3BC3875 id2 19890C35
A new application package has been added or an existing one has been removed.

WNF_XBOX_IDLE_DIMMER_CHANGED id1 A3BC4075 id2 19890C35
Idle dimmer has changed state.

WNF_XBOX_GLOBALIZATION_SETTING_CHANGED id1 A3BC4875 id2 19890C35
An application package has been removed.

WNF_XBOX_APPLICATION_NO_LONGER_RUNNING id1 A3BC5075 id2 19890C35
An application is no longer running.

WNF_XBOX_AUTOPLAY_CONTENT_DETECTED id1 A3BC5875 id2 19890C35
An optical disc or other media has been detected with content.

WNF_XBOX_APPLICATION_ERROR id1 A3BC6075 id2 19890C35
Application error handler

WNF_XBOX_STORAGE_ERROR id1 A3BC6875 id2 19890C35
Handler for achievement cache and game save storage

WNF_XBOX_LIVE_CONNECTIVITY_CHANGED id1 A3BC7075 id2 19890C35
Connectivity to the Xbox LIVE service has changed.

WNF_XBOX_SYSTEM_TITLE_AUTH_STATUS_CHANGED id1 A3BC7875 id2 19890C35
System Title Authentication status has changed.

WNF_XBOX_ACHIEVEMENTS_RAW_NOTIFICATION_RECEIVED id1 A3BC8075 id2 19890C35
A new achievements-related raw notifications was received.

WNF_XBOX_ERA_VM_STATUS_CHANGED id1 A3BC8875 id2 19890C35
ERA VM status has changed.

WNF_XBOX_APPLICATION_LAYOUT_CHANGED id1 A3BC9075 id2 19890C35
One or more application layouts changed.

WNF_XBOX_SYSTEM_IDLE_TIMEOUT_CHANGED id1 A3BC9875 id2 19890C35
System Idle Timeout has changed.

WNF_XBOX_SYSTEM_CONSTRAINED_MODE_STATUS_CHANGED id1 A3BCA075 id2 19890C35
System constrained status has changed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.

WNF_XBOX_APPLICATION_COM_RESILIENCY_STATUS_CHANGED id1 A3BCD875 id2 19890C35
Application's COM resiliency status has changed.

WNF_XBOX_SYSTEM_USER_CONTEXT_CHANGED id1 A3BCE075 id2 19890C35
Default system user, as defined by start view, has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_XBOX_HOST_STORAGE_CONFIGURATION_CHANGED id1 A3BCF075 id2 19890C35
A storage device was either plugged or unplugged.

WNF_XBOX_EXIT_SILENT_BOOT_MODE id1 A3BCF875 id2 19890C35
The system is exiting silent boot mode.

WNF_XBOX_APPLICATION_LICENSE_CHANGED id1 A3BD0075 id2 19890C35
The license used by the application has changed.

WNF_XBOX_SHELL_INITIALIZED id1 A3BD0875 id2 19890C35
The system shell is initialized and ready.

WNF_XBOX_PASS3_UPDATE_NOTIFICATION id1 A3BD1875 id2 19890C35
Pass 3 system update has progressed and is sending a notification.

WNF_XBOX_MSA_ENVIRONMENT_CONFIGURED id1 A3BD2075 id2 19890C35
The MSA and WNS environments have been configured to match the XBL environment.

WNF_XBOX_SIP_VISIBILITY_CHANGED id1 A3BD2875 id2 19890C35
The visibility of the Software Input Pane has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.

WNF_XBOX_SYSTEM_GAME_STREAMING_STATE_CHANGED id1 A3BD3075 id2 19890C35
Game streaming state has changed.

WNF_XBOX_SIP_FOCUS_TRANSFER_NOTIFICATION id1 A3BD3875 id2 19890C35
It is possible to transfer focus away from the Software Input Pane.

WNF_XBOX_XAM_SMB_SHARES_INIT_ALLOW_SYSTEM_READY id1 A3BD4075 id2 19890C35
SMB shares have been launched.

WNF_XBOX_XBBLACKBOX_SNAP_NOTIFICATION id1 A3BD4875 id2 19890C35
A snap of XBBlackbox has occurred

WNF_XBOX_SYSTEM_LOW_POWER_MAINTENANCE_WORK_ALLOWED id1 A3BD5075 id2 19890C35
Maintenance work is allowed in low power mode

WNF_XBOX_ERA_TITLE_LAUNCH_NOTIFICATION id1 A3BD5875 id2 19890C35
ERA launch notification with XBL title info

WNF_XBOX_STORAGE_STATUS id1 A3BD6075 id2 19890C35
Status of attached storage devices

WNF_XBOX_STORAGE_CHANGED id1 A3BD6875 id2 19890C35
A storage device, or its contents, have changed

WNF_XBOX_PACKAGE_STREAMING_STATE id1 A3BD7075 id2 19890C35
Current state of the streaming package

WNF_XBOX_STREAMING_QUEUE_CHANGED id1 A3BD7875 id2 19890C35
The install streaming queue contents have changed

WNF_XBOX_QUERY_UPDATE_NOTIFICATION id1 A3BD8075 id2 19890C35
An update is available for installing content.

WNF_XBOX_REPOSITORY_CHANGED id1 A3BD8875 id2 19890C35
A change has been made to the pre-indexed state repository.

WNF_XBOX_LIVETV_TUNER_COUNT_CHANGED id1 A3BD9075 id2 19890C35
The number of LiveTV tuners connected to the system has changed

WNF_XBOX_PACKAGECACHE_CHANGED id1 A3BD9875 id2 19890C35
A change has been made to the package cache.

WNF_XBOX_WPN_PLATFORM_HOST_INITIALIZED id1 A3BDA075 id2 19890C35
The WPN platform host is initialized and ready.

WNF_XBOX_NARRATOR_RECT_CHANGED id1 A3BDA875 id2 19890C35
The rectangle visual of the Narrator has changed.

WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_UNINSTALL id1 A3BDB075 id2 19890C35
A package is about to be unmounted from the System OS for uninstall.

WNF_XBOX_SEND_LTV_COMMAND_REQUESTED id1 A3BDB875 id2 19890C35
A module requested for an ltv command to be issued.

WNF_XBOX_SHELL_DATACACHE_ENTITY_CHANGED id1 A3BDC075 id2 19890C35
An entity has changed in the shell data cache.

WNF_XBOX_CORTANAOVERLAY_VISIBILITY_CHANGED id1 A3BDC875 id2 19890C35
The visibility of the Cortana Overlay view has changed.

WNF_XBOX_NOTIFICATION_UNREAD_COUNT id1 A3BDD075 id2 19890C35
Number of unread notifications for the current system user.

WNF_XBOX_EXTENDED_RESOURCE_MODE_CHANGED id1 A3BDD875 id2 19890C35
Extended resource mode has been toggled

WNF_XBOX_AUTO_SIGNIN_IN_PROGRESS id1 A3BDE075 id2 19890C35
Indicates whether the shell is in the process of auto-signin. Payload is UINT32 with a 1 or 0.

WNF_XBOX_REMOTE_SIGNOUT id1 A3BDE875 id2 19890C35
A local user has signed out remotely via SPOP.

WNF_XBOX_ACCESSIBILITY_NARRATOR_ENABLED id1 A3BDF075 id2 19890C35
Indicates whether the Narrator is enabled. Payload is UINt32 with 1 (enabled) or 0 (disabled).

WNF_XBOX_GLOBAL_SPEECH_INPUT_NOTIFICATION id1 A3BDF875 id2 19890C35
A global speech command was recognized that translates to a controller button press.

WNF_XBOX_APPLICATION_CURRENT_USER_CHANGED id1 A3BE0075 id2 19890C35
The current user of the application has changed.

WNF_XBOX_ERA_VM_INSTANCE_CHANGED id1 A3BE0875 id2 19890C35
ERA VM Instance has come up or gone down

WNF_XBOX_RESET_IDLE_TIMER id1 A3BE1075 id2 19890C35
Idle monitor timer should be reset due to user activity.

WNF_XBOX_CORTANA_TV_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE1875 id2 19890C35
Notification for when TV grammars for cortana needs rebuilding

WNF_XBOX_CORTANA_SIGNEDIN_USERS_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE2075 id2 19890C35
Notification for when signed in users change results in rebuilding grammars for cortana

WNF_XBOX_KINECT_IS_REQUIRED id1 A3BE2875 id2 19890C35
An application that requires Kinect has connected to the NuiService.

WNF_XBOX_ADJUST_SNAP_CPU_AFFINITY id1 A3BE3075 id2 19890C35
Adjust an app's CPU affinity if in constrained mode

WNF_XBOX_VIDEOPLAYER_ACTIVEPLAYER id1 A3BE3875 id2 19890C35
The active shared video player host has changed.

WNF_XBOX_VIDEOPLAYER_PLAYERSTATE id1 A3BE4075 id2 19890C35
The video player app has changed internal state.

WNF_XBOX_VIDEOPLAYER_PLAYBACKPROGRESS id1 A3BE4875 id2 19890C35
The video player app has changed playback progress.

WNF_XBOX_SAFEAREA_SETTING_CHANGED id1 A3BE5075 id2 19890C35
Indicates whether the safe area setting is enabled. Payload is UINT32 with a 1 or 0.

WNF_XBOX_ACTIVE_BACKGROUNDAUDIO_APPLICATION_CHANGED id1 A3BE5875 id2 19890C35
The application providing audio from the background has changed.

WNF_XBOX_KEYBOARD_LOCALE_CHANGED id1 A3BE6075 id2 19890C35
Indicates that the desired keyboard locale has changed.

WNF_XBOX_GAMER_ACCOUNT_CHANGED id1 A3BE6875 id2 19890C35
The local gamer account has signed in or out. Payload is uint32 representing sessionid

WNF_XBOX_ERA_VM_IOPRIORITY_CHANGED id1 A3BE7075 id2 19890C35
ERA VM IO priority has been changed

WNF_XBOX_SPEECH_INPUT_DEVICE id1 A3BE7875 id2 19890C35
Input device changed for OneCore speech

WNF_XBOX_CORTANA_USER_CHANGED_UPDATE_NOTIFICATION id1 A3BE8875 id2 19890C35
Notification for when the active user of Cortana changes from signing in/out/switching user

WNF_XBOX_ACCESSIBILITY_EXCLUSIVE_INPUT_MODE_CHANGED id1 A3BE9075 id2 19890C35
The exclusive input modality for an accessibility component changed

WNF_XBOX_PROACTIVE_NOTIFICATION_TRIGGERED id1 A3BE9875 id2 19890C35
Proactive notification service is triggered

WNF_XBOX_ACHIEVEMENT_TRACKER_STATE_CHANGED id1 A3BEA075 id2 19890C35
Notification for when the Achievement Tracker's state should change

WNF_XBOX_GUIDE_DIRECT_ACTIVATION id1 A3BEA875 id2 19890C35
Event to trigger direct activation of xbox guide when nexus is pressed

WNF_XBOX_TITLE_SPOP_VETO_RECEIVED id1 A3BEB075 id2 19890C35
A title SPOP veto has been received.

WNF_XBOX_LIBRARY_RAW_NOTIFICATION_RECEIVED id1 A3BEB875 id2 19890C35
A new library-related raw notifications was received.

WNF_XBOX_MESSAGING_RAW_NOTIFICATION_RECEIVED id1 A3BEC075 id2 19890C35
A new messaging-related raw notifications was received.

WNF_XBOX_PEOPLE_RAW_NOTIFICATION_RECEIVED id1 A3BEC875 id2 19890C35
A new people-related raw notifications was received.

WNF_XBOX_MULTIPLAYER_RAW_NOTIFICATION_RECEIVED id1 A3BED075 id2 19890C35
A new multiplayer-related raw notifications was received.

WNF_XBOX_LIVETV_RAW_NOTIFICATION_RECEIVED id1 A3BED875 id2 19890C35
A new live tv-related raw notifications was received.

WNF_XBOX_SYSTEMUI_RAW_NOTIFICATION_RECEIVED id1 A3BEE075 id2 19890C35
A new SystemUI-related raw notifications was received.

WNF_XBOX_CLUB_RAW_NOTIFICATION_RECEIVED id1 A3BEE875 id2 19890C35
A new club-related raw notifications was received.

WNF_XBOX_CLUBCHAT_RAW_NOTIFICATION_RECEIVED id1 A3BEF075 id2 19890C35
A new club chat-related raw notifications was received.

WNF_XBOX_SETTINGS_RAW_NOTIFICATION_RECEIVED id1 A3BEF875 id2 19890C35
A new settings-related raw notifications was received.

WNF_XBOX_MEDIA_IS_PLAYING_CHANGED id1 A3BF0075 id2 19890C35
Notification of whether any media is playing.

WNF_XBOX_EXPANDED_RESOURCES_INACTIVE id1 A3BF0875 id2 19890C35
An expandedResources app has gone inactive.

WNF_XBOX_PARENTAL_RESTRICTIONS_CHANGED id1 A3BF1075 id2 19890C35
The maximum age rating currently permissable has changed.

WNF_XBOX_PARTY_OVERLAY_STATE_CHANGED id1 A3BF1875 id2 19890C35
Notification for when the Party Overlay's state should change

WNF_XBOX_CLOUD_SETTINGS_UPDATED id1 A3BF2075 id2 19890C35
A cloud settings collection was updated

WNF_XBOX_ERA_FAST_ITERATION_STATUS_CHANGED id1 A3BF2875 id2 19890C35
ERA Fast Iteration Mode has changed.

WNF_XBOX_NTM_CONSTRAINED_MODE_CHANGED id1 A3BF3075 id2 19890C35
The Network Transfer Manager's constrained mode changed.

WNF_XBOX_NARRATOR_INPUT_LEARNING_MODE_CHANGED id1 A3BF3875 id2 19890C35
Narrator input learning mode changed.

WNF_XBOX_SUSPEND_SKELETAL_TRACKING_INITIALIZATION id1 A3BF4075 id2 19890C35
Initialization of the skeletal tracking pipeline should be suspended / resumed.

WNF_XBOX_NEON_SETTING_CHANGED id1 A3BF4875 id2 19890C35
Immersive background or connected animation setting changed.

WNF_XBOX_COPYONLAN_UPLOAD_STATE_CHANGED id1 A3BF5075 id2 19890C35
Copy on LAN upload state has changed.

WNF_XBOX_DASHBOARD_DIRECT_ACTIVATION id1 A3BF5875 id2 19890C35
Event to trigger direct activation of xbox dashboard.

WNF_XBOX_COMMANDSERVICE_RAW_NOTIFICATION_RECEIVED id1 A3BF6075 id2 19890C35
A new Command Service raw notification was received.

WNF_XBOX_NOTIFICATION_SETTING_CHANGED id1 A3BF6875 id2 19890C35
A notification settings was updated

WNF_UTS_USERS_ENROLLED id1 A3BC0C75 id2 41951A38
Indicates whether there are any enrolled users.

WNF_UTS_LOCKSCREEN_DISMISSAL_TRIGGERED id1 A3BC1475 id2 41951A38
Triggered when the lock screen is dismissed to kick-off trusted signals.

WNF_USB_TYPE_C_PARTNER_STATE id1 A3BC0875 id2 41841D38
This event indicates the state of a USB Type-C connector's partner device.

WNF_USB_BILLBOARD_CHANGE id1 A3BC1075 id2 41841D38
This event indicates that the number of Billboard devices in the system has changed.

WNF_USB_PEER_DEVICE_STATE id1 A3BC1875 id2 41841D38
This is the state of a peer device.

WNF_USB_CHARGING_STATE id1 A3BC2075 id2 41841D38
This event indicates the USB charging state for this Windows device.

WNF_USB_FUNCTION_CONTROLLER_STATE id1 A3BC2875 id2 41841D38
This event indicates the state of a USB function controller, such as detached, or attached, and successfully enumerated with host PC.

WNF_USB_ERROR_NOTIFICATION id1 A3BC3075 id2 41841D38
This event indicates that a USB error notification needs to be published.

WNF_USB_POLICY_MANAGER_HUB_COLLECTION_STATE id1 A3BC3875 id2 41841D38
This indicates that the hub collection in USB Policy Manager has changed.

WNF_USB_XHCI_AUDIO_OFFLOAD_STATE id1 A3BC4075 id2 41841D38
This event indicates the state of a USB XHCI controller's audio offload state.

↧

bug in wtsapi32!WTSFreeMemoryExA

August 8, 2018, 9:06 am

≫ Next: apisetschema.dll from windows 10 build 1774

≪ Previous: WNF IDs from perf_nt_c.dll (adk version 17692)

prototype

BOOL WTSFreeMemoryExA(
  WTS_TYPE_CLASS WTSTypeClass,
  PVOID          pMemory,
  ULONG          NumberOfEntries
);

WTS_TYPE_CLASS declared in WtsApi32.h as

enum _WTS_TYPE_CLASS {
  WTSTypeProcessInfoLevel0 = 0x0,
  WTSTypeProcessInfoLevel1 = 0x1,
  WTSTypeSessionInfoLevel1 = 0x2,
};

ok, check in disasm what happens:
WTSFreeMemoryExA proc near

 push    rbx
  sub     rsp, 20h
  xor     ebx, ebx
  cmp     ecx, ebx
  jl      short loc_7FF70582EC2
cmp     ecx, 1 ; whut ?
  jg      short loc_7FF70582EC2
  call    WTSFreeMemoryExW
  mov     ebx, eax
  jmp     short loc_7FF70582ECD

loc_7FF70582EC2:

 mov     ecx, 87         ; dwErrCode - ERROR_INVALID_PARAMETER
  call    cs:__imp_SetLastError

as you can see you cannot pass WTSTypeSessionInfoLevel1 to function WTSFreeMemoryExA - it gives error ERROR_INVALID_PARAMETER. As dirty workaround you can use WTSFreeMemoryExW - it has correct checking of WTSTypeClass. btw this lead to memory leaks and known at least since 2013

↧

apisetschema.dll from windows 10 build 1774

September 7, 2018, 7:43 am

≫ Next: WNF IDs from w10 build 18312

≪ Previous: bug in wtsapi32!WTSFreeMemoryExA

new modules was added since 15025

win-containers-cmclient
win-core-backgroundtask
win-core-com-private
win-core-file-fromapp
win-core-pcw
win-core-state-helpers
win-gaming-deviceinformation
win-security-isolationapi
win-security-isolationpolicy
win-shcore-taskpool
win-wsl-api
win-appcompat-aeinv
win-hostactivitymanager-hostidstore
win-hyperv-hgs
win-hyperv-hvemulation
win-hyperv-hvplatform
win-hyperv-compute
win-networking-teredo
win-rtcore-ntuser-controllernavigation
win-security-authz-helper
win-security-catalog-database
ms-win-security-cfl
win-security-ngc-local
win-security-vaultcds
win-session-candidateaccountmgr

api-ms-onecoreuap-print-render-l1-1-0	printrenderapihost.dll
api-ms-onecoreuap-settingsync-status-l1-1-0	settingsynccore.dll
api-ms-win-appmodel-identity-l1-2-0	kernel.appcore.dll
api-ms-win-appmodel-runtime-internal-l1-1-5	kernel.appcore.dll
api-ms-win-appmodel-runtime-l1-1-2	kernel.appcore.dll
api-ms-win-appmodel-state-l1-1-2	kernel.appcore.dll
api-ms-win-appmodel-state-l1-2-0	kernel.appcore.dll
api-ms-win-appmodel-unlock-l1-1-0	kernel.appcore.dll
api-ms-win-base-bootconfig-l1-1-0	advapi32.dll
api-ms-win-base-util-l1-1-0	advapi32.dll
api-ms-win-composition-redirection-l1-1-0	dwmredir.dll
api-ms-win-composition-windowmanager-l1-1-0	udwm.dll
api-ms-win-containers-cmclient-l1-1-0	cmclient.dll
api-ms-win-core-apiquery-l1-1-1	ntdll.dll
api-ms-win-core-apiquery-l2-1-0	kernelbase.dll
api-ms-win-core-appcompat-l1-1-1	kernelbase.dll
api-ms-win-core-appinit-l1-1-0	kernel32.dll	kernelbase.dll
api-ms-win-core-atoms-l1-1-0	kernel32.dll
api-ms-win-core-backgroundtask-l1-1-0	kernelbase.dll
api-ms-win-core-bicltapi-l1-1-5	bi.dll
api-ms-win-core-biplmapi-l1-1-5	twinapi.appcore.dll
api-ms-win-core-biptcltapi-l1-1-7	twinapi.appcore.dll
api-ms-win-core-calendar-l1-1-0	kernel32.dll
api-ms-win-core-com-l1-1-2	combase.dll
api-ms-win-core-com-l2-1-1	coml2.dll
api-ms-win-core-com-midlproxystub-l1-1-0	combase.dll
api-ms-win-core-com-private-l1-1-1	combase.dll
api-ms-win-core-com-private-l1-2-0	combase.dll
api-ms-win-core-comm-l1-1-2	kernelbase.dll
api-ms-win-core-console-ansi-l2-1-0	kernel32.dll
api-ms-win-core-console-l1-1-0	kernelbase.dll
api-ms-win-core-console-l1-2-1	kernelbase.dll
api-ms-win-core-console-l2-1-0	kernelbase.dll
api-ms-win-core-console-l2-2-0	kernelbase.dll
api-ms-win-core-console-l3-1-0	kernelbase.dll
api-ms-win-core-console-l3-2-0	kernelbase.dll
api-ms-win-core-crt-l1-1-0	ntdll.dll
api-ms-win-core-crt-l2-1-0	kernelbase.dll
api-ms-win-core-datetime-l1-1-2	kernelbase.dll
api-ms-win-core-debug-l1-1-2	kernelbase.dll
api-ms-win-core-debug-minidump-l1-1-0	dbgcore.dll
api-ms-win-core-delayload-l1-1-1	kernelbase.dll
api-ms-win-core-enclave-l1-1-1	kernelbase.dll
api-ms-win-core-errorhandling-l1-1-3	kernelbase.dll
api-ms-win-core-featurestaging-l1-1-1	shcore.dll
api-ms-win-core-fibers-l1-1-1	kernelbase.dll
api-ms-win-core-fibers-l2-1-1	kernelbase.dll
api-ms-win-core-file-ansi-l1-1-0	kernel32.dll
api-ms-win-core-file-ansi-l2-1-0	kernel32.dll
api-ms-win-core-file-fromapp-l1-1-0	windows.storage.onecore.dll
api-ms-win-core-file-l1-1-1	kernelbase.dll
api-ms-win-core-file-l1-2-3	kernelbase.dll
api-ms-win-core-file-l2-1-3	kernelbase.dll
api-ms-win-core-firmware-l1-1-0	kernel32.dll
api-ms-win-core-guard-l1-1-0	kernelbase.dll
api-ms-win-core-handle-l1-1-0	kernelbase.dll
api-ms-win-core-heap-l1-1-0	kernelbase.dll
api-ms-win-core-heap-l1-2-0	kernelbase.dll
api-ms-win-core-heap-l2-1-0	kernelbase.dll
api-ms-win-core-heap-obsolete-l1-1-0	kernel32.dll
api-ms-win-core-interlocked-l1-1-1	kernelbase.dll
api-ms-win-core-interlocked-l1-2-0	kernelbase.dll
api-ms-win-core-io-l1-1-1	kernel32.dll	kernelbase.dll
api-ms-win-core-job-l1-1-0	kernelbase.dll
api-ms-win-core-job-l2-1-1	kernel32.dll
api-ms-win-core-kernel32-legacy-ansi-l1-1-0	kernel32.dll
api-ms-win-core-kernel32-legacy-l1-1-6	kernel32.dll
api-ms-win-core-kernel32-private-l1-1-2	kernel32.dll
api-ms-win-core-largeinteger-l1-1-0	kernelbase.dll
api-ms-win-core-libraryloader-l1-1-1	kernelbase.dll
api-ms-win-core-libraryloader-l1-2-2	kernelbase.dll
api-ms-win-core-libraryloader-l2-1-0	kernelbase.dll
api-ms-win-core-libraryloader-private-l1-1-0	kernelbase.dll
api-ms-win-core-localization-ansi-l1-1-0	kernel32.dll
api-ms-win-core-localization-l1-1-0	kernelbase.dll
api-ms-win-core-localization-l1-2-3	kernelbase.dll
api-ms-win-core-localization-l2-1-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-2-0	kernelbase.dll
api-ms-win-core-localization-obsolete-l1-3-0	kernelbase.dll
api-ms-win-core-localization-private-l1-1-0	kernelbase.dll
api-ms-win-core-localregistry-l1-1-0	kernelbase.dll
api-ms-win-core-marshal-l1-1-0	combase.dll
api-ms-win-core-memory-l1-1-7	kernelbase.dll
api-ms-win-core-misc-l1-1-0	kernelbase.dll
api-ms-win-core-multipleproviderrouter-l1-1-0	mpr.dll
api-ms-win-core-namedpipe-ansi-l1-1-1	kernel32.dll
api-ms-win-core-namedpipe-l1-1-0	kernelbase.dll
api-ms-win-core-namedpipe-l1-2-2	kernelbase.dll
api-ms-win-core-namespace-ansi-l1-1-0	kernel32.dll
api-ms-win-core-namespace-l1-1-0	kernelbase.dll
api-ms-win-core-normalization-l1-1-0	kernelbase.dll
api-ms-win-core-path-l1-1-0	kernelbase.dll
api-ms-win-core-pcw-l1-1-0	kernelbase.dll
api-ms-win-core-perfcounters-l1-1-0	kernelbase.dll
api-ms-win-core-perfcounters-l1-2-0	kernelbase.dll
api-ms-win-core-perfstm-l1-1-0	kernelbase.dll
api-ms-win-core-privateprofile-l1-1-1	kernel32.dll
api-ms-win-core-processenvironment-ansi-l1-1-0	kernel32.dll
api-ms-win-core-processenvironment-l1-1-1	kernelbase.dll
api-ms-win-core-processenvironment-l1-2-0	kernelbase.dll
api-ms-win-core-processsecurity-l1-1-0	kernel32.dll	kernelbase.dll
api-ms-win-core-processsnapshot-l1-1-0	kernelbase.dll
api-ms-win-core-processthreads-l1-1-3	kernel32.dll	kernelbase.dll
api-ms-win-core-processtopology-l1-1-0	kernelbase.dll
api-ms-win-core-processtopology-l1-2-0	kernelbase.dll
api-ms-win-core-processtopology-obsolete-l1-1-1	kernel32.dll
api-ms-win-core-processtopology-private-l1-1-0	kernelbase.dll
api-ms-win-core-profile-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-ansi-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-l1-1-0	kernelbase.dll
api-ms-win-core-psapi-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-psapiansi-l1-1-0	kernelbase.dll
api-ms-win-core-psm-app-l1-1-0	twinapi.appcore.dll
api-ms-win-core-psm-appnotify-l1-1-0	twinapi.appcore.dll
api-ms-win-core-psm-info-l1-1-1	appsruprov.dll
api-ms-win-core-psm-key-l1-1-2	kernelbase.dll
api-ms-win-core-psm-plm-l1-1-3	twinapi.appcore.dll
api-ms-win-core-psm-plm-l1-2-0	twinapi.appcore.dll
api-ms-win-core-psm-plm-l1-3-0	twinapi.appcore.dll
api-ms-win-core-psm-rtimer-l1-1-1	twinapi.appcore.dll
api-ms-win-core-psm-tc-l1-1-1	twinapi.appcore.dll
api-ms-win-core-quirks-l1-1-1	kernelbase.dll
api-ms-win-core-realtime-l1-1-2	kernelbase.dll
api-ms-win-core-registry-fromapp-l1-1-0	reguwpapi.dll
api-ms-win-core-registry-l1-1-2	kernelbase.dll
api-ms-win-core-registry-l2-1-0	advapi32.dll
api-ms-win-core-registry-l2-2-0	advapi32.dll
api-ms-win-core-registry-l2-3-0	advapi32.dll
api-ms-win-core-registry-private-l1-1-0	advapi32.dll
api-ms-win-core-registryuserspecific-l1-1-0	kernelbase.dll
api-ms-win-core-rtlsupport-l1-1-1	ntdll.dll
api-ms-win-core-rtlsupport-l1-2-0	ntdll.dll
api-ms-win-core-shlwapi-legacy-l1-1-0	kernelbase.dll
api-ms-win-core-shlwapi-obsolete-l1-1-0	kernelbase.dll
api-ms-win-core-shlwapi-obsolete-l1-2-0	kernelbase.dll
api-ms-win-core-shutdown-ansi-l1-1-0	advapi32.dll
api-ms-win-core-shutdown-l1-1-1	advapi32.dll
api-ms-win-core-sidebyside-ansi-l1-1-0	kernel32.dll
api-ms-win-core-sidebyside-l1-1-0	kernelbase.dll
api-ms-win-core-slapi-l1-1-0	clipc.dll
api-ms-win-core-state-helpers-l1-1-0	kernelbase.dll
api-ms-win-core-string-l1-1-0	kernelbase.dll
api-ms-win-core-string-l2-1-1	kernelbase.dll
api-ms-win-core-string-obsolete-l1-1-1	kernel32.dll
api-ms-win-core-stringansi-l1-1-0	kernelbase.dll
api-ms-win-core-stringloader-l1-1-1	kernelbase.dll
api-ms-win-core-synch-ansi-l1-1-0	kernel32.dll
api-ms-win-core-synch-l1-1-1	kernelbase.dll
api-ms-win-core-synch-l1-2-1	kernelbase.dll
api-ms-win-core-sysinfo-l1-1-1	kernelbase.dll
api-ms-win-core-sysinfo-l1-2-4	kernelbase.dll
api-ms-win-core-sysinfo-l2-1-0	advapi32.dll
api-ms-win-core-systemtopology-l1-1-1	kernelbase.dll
api-ms-win-core-textinput-client-l1-1-0	textinputframework.dll
api-ms-win-core-threadpool-l1-1-0	kernelbase.dll
api-ms-win-core-threadpool-l1-2-0	kernelbase.dll
api-ms-win-core-threadpool-legacy-l1-1-0	kernelbase.dll
api-ms-win-core-threadpool-private-l1-1-0	kernelbase.dll
api-ms-win-core-timezone-l1-1-1	kernelbase.dll
api-ms-win-core-timezone-private-l1-1-0	kernelbase.dll
api-ms-win-core-toolhelp-l1-1-1	kernel32.dll
api-ms-win-core-ums-l1-1-0	kernel32.dll
api-ms-win-core-url-l1-1-0	kernelbase.dll
api-ms-win-core-util-l1-1-1	kernel32.dll	kernelbase.dll
api-ms-win-core-version-l1-1-1	kernelbase.dll
api-ms-win-core-version-private-l1-1-0	kernelbase.dll
api-ms-win-core-versionansi-l1-1-1	kernelbase.dll
api-ms-win-core-windowsceip-l1-1-0	kernelbase.dll
api-ms-win-core-windowserrorreporting-l1-1-2	kernelbase.dll
api-ms-win-core-winrt-error-l1-1-1	combase.dll
api-ms-win-core-winrt-errorprivate-l1-1-1	combase.dll
api-ms-win-core-winrt-l1-1-0	combase.dll
api-ms-win-core-winrt-propertysetprivate-l1-1-1	wintypes.dll
api-ms-win-core-winrt-registration-l1-1-0	combase.dll
api-ms-win-core-winrt-robuffer-l1-1-0	wintypes.dll
api-ms-win-core-winrt-roparameterizediid-l1-1-0	combase.dll
api-ms-win-core-winrt-string-l1-1-1	combase.dll
api-ms-win-core-wow64-l1-1-2	kernelbase.dll
api-ms-win-core-xstate-l1-1-3	ntdll.dll
api-ms-win-core-xstate-l2-1-1	kernelbase.dll
api-ms-win-crt-conio-l1-1-0	ucrtbase.dll
api-ms-win-crt-convert-l1-1-0	ucrtbase.dll
api-ms-win-crt-environment-l1-1-0	ucrtbase.dll
api-ms-win-crt-filesystem-l1-1-0	ucrtbase.dll
api-ms-win-crt-heap-l1-1-0	ucrtbase.dll
api-ms-win-crt-locale-l1-1-0	ucrtbase.dll
api-ms-win-crt-math-l1-1-0	ucrtbase.dll
api-ms-win-crt-multibyte-l1-1-0	ucrtbase.dll
api-ms-win-crt-private-l1-1-0	ucrtbase.dll
api-ms-win-crt-process-l1-1-0	ucrtbase.dll
api-ms-win-crt-runtime-l1-1-0	ucrtbase.dll
api-ms-win-crt-stdio-l1-1-0	ucrtbase.dll
api-ms-win-crt-string-l1-1-0	ucrtbase.dll
api-ms-win-crt-time-l1-1-0	ucrtbase.dll
api-ms-win-crt-utility-l1-1-0	ucrtbase.dll
api-ms-win-deprecated-apis-obsolete-l1-1-0	kernelbase.dll
api-ms-win-devices-config-l1-1-2	cfgmgr32.dll
api-ms-win-devices-query-l1-1-1	cfgmgr32.dll
api-ms-win-devices-swdevice-l1-1-1	cfgmgr32.dll
api-ms-win-downlevel-advapi32-l1-1-1	kernelbase.dll
api-ms-win-downlevel-advapi32-l2-1-1	sechost.dll
api-ms-win-downlevel-advapi32-l3-1-0	ntmarta.dll
api-ms-win-downlevel-advapi32-l4-1-0	advapi32.dll
api-ms-win-downlevel-kernel32-l1-1-0	kernelbase.dll
api-ms-win-downlevel-kernel32-l2-1-0	kernel32.dll
api-ms-win-downlevel-normaliz-l1-1-0	kernelbase.dll
api-ms-win-downlevel-ole32-l1-1-1	combase.dll
api-ms-win-downlevel-shell32-l1-1-0	shcore.dll
api-ms-win-downlevel-shlwapi-l1-1-1	kernelbase.dll
api-ms-win-downlevel-shlwapi-l2-1-1	shcore.dll
api-ms-win-downlevel-user32-l1-1-1	kernelbase.dll
api-ms-win-downlevel-version-l1-1-0	kernelbase.dll
api-ms-win-dwmapi-l1-1-0	dwmapi.dll
api-ms-win-dx-d3dkmt-l1-1-4	gdi32.dll
api-ms-win-eventing-classicprovider-l1-1-0	kernelbase.dll
api-ms-win-eventing-consumer-l1-1-1	sechost.dll
api-ms-win-eventing-controller-l1-1-0	sechost.dll
api-ms-win-eventing-legacy-l1-1-0	advapi32.dll
api-ms-win-eventing-obsolete-l1-1-0	sechost.dll
api-ms-win-eventing-provider-l1-1-0	kernelbase.dll
api-ms-win-eventing-tdh-l1-1-0	tdh.dll	mintdh.dll
api-ms-win-eventlog-legacy-l1-1-0	advapi32.dll
api-ms-win-eventlog-private-l1-1-0	advapi32.dll
api-ms-win-gaming-deviceinformation-l1-1-0	kernelbase.dll
api-ms-win-gaming-expandedresources-l1-1-0	gamemode.dll
api-ms-win-gaming-tcui-l1-1-4	gamingtcui.dll
api-ms-win-gdi-dpiinfo-l1-1-0	gdi32.dll
api-ms-win-gdi-internal-uap-l1-1-0	gdi32full.dll
api-ms-win-http-time-l1-1-0	kernelbase.dll
api-ms-win-legacy-shlwapi-l1-1-0	kernelbase.dll
api-ms-win-mm-joystick-l1-1-0	winmmbase.dll
api-ms-win-mm-mci-l1-1-0	winmm.dll
api-ms-win-mm-misc-l1-1-1	winmmbase.dll
api-ms-win-mm-misc-l2-1-0	winmm.dll
api-ms-win-mm-mme-l1-1-0	winmmbase.dll
api-ms-win-mm-playsound-l1-1-0	winmm.dll
api-ms-win-mm-time-l1-1-0	kernel32.dll
api-ms-win-net-isolation-l1-1-1	firewallapi.dll
api-ms-win-networking-interfacecontexts-l1-1-0	ondemandconnroutehelper.dll
api-ms-win-ngc-serialization-l1-1-1	ngckeyenum.dll
api-ms-win-ntuser-ie-message-l1-1-0	user32.dll
api-ms-win-ntuser-ie-window-l1-1-0	user32.dll
api-ms-win-ntuser-ie-wmpointer-l1-1-0	user32.dll
api-ms-win-ntuser-rectangle-l1-1-0	user32.dll
api-ms-win-ntuser-sysparams-l1-1-0	user32.dll
api-ms-win-obsolete-localization-l1-1-0	kernelbase.dll
api-ms-win-obsolete-psapi-l1-1-0	kernelbase.dll
api-ms-win-obsolete-shlwapi-l1-1-0	kernelbase.dll
api-ms-win-ole32-ie-l1-1-0	ole32.dll
api-ms-win-oobe-notification-l1-1-0	kernel32.dll
api-ms-win-perf-legacy-l1-1-0	advapi32.dll
api-ms-win-power-base-l1-1-0	powrprof.dll
api-ms-win-power-limitsmanagement-l1-1-0	powrprof.dll
api-ms-win-power-setting-l1-1-1	powrprof.dll
api-ms-win-ro-typeresolution-l1-1-1	wintypes.dll
api-ms-win-rtcore-ntuser-clipboard-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-draw-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-powermanagement-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-private-l1-1-8	user32.dll
api-ms-win-rtcore-ntuser-shell-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-synch-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-window-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-winevent-l1-1-0	user32.dll
api-ms-win-rtcore-ntuser-wmpointer-l1-1-3	user32.dll
api-ms-win-rtcore-ole32-clipboard-l1-1-1	ole32.dll
api-ms-win-security-accesshlpr-l1-1-0	sechost.dll
api-ms-win-security-activedirectoryclient-l1-1-1	kernelbase.dll
api-ms-win-security-appcontainer-l1-1-0	kernelbase.dll
api-ms-win-security-audit-l1-1-1	sechost.dll
api-ms-win-security-base-ansi-l1-1-0	advapi32.dll
api-ms-win-security-base-l1-1-1	kernelbase.dll
api-ms-win-security-base-l1-2-2	kernelbase.dll
api-ms-win-security-base-private-l1-1-1	kernelbase.dll
api-ms-win-security-capability-l1-1-1	sechost.dll
api-ms-win-security-cpwl-l1-1-0	advapi32.dll
api-ms-win-security-credentials-l1-1-0	sechost.dll
api-ms-win-security-credentials-l2-1-1	sechost.dll
api-ms-win-security-cryptoapi-l1-1-0	cryptsp.dll
api-ms-win-security-grouppolicy-l1-1-0	kernelbase.dll
api-ms-win-security-isolatedcontainer-l1-1-0	shcore.dll
api-ms-win-security-isolationapi-l1-1-0	sechost.dll
api-ms-win-security-isolationpolicy-l1-1-0	sechost.dll
api-ms-win-security-logon-l1-1-1	advapi32.dll
api-ms-win-security-lsalookup-ansi-l2-1-0	advapi32.dll
api-ms-win-security-lsalookup-l1-1-2	sechost.dll
api-ms-win-security-lsalookup-l2-1-1	advapi32.dll
api-ms-win-security-lsapolicy-l1-1-1	sechost.dll
api-ms-win-security-provider-ansi-l1-1-0	advapi32.dll
api-ms-win-security-provider-l1-1-0	ntmarta.dll
api-ms-win-security-sddl-ansi-l1-1-0	advapi32.dll
api-ms-win-security-sddl-l1-1-0	sechost.dll
api-ms-win-security-sddl-private-l1-1-0	sechost.dll
api-ms-win-security-sddlparsecond-l1-1-0	sechost.dll
api-ms-win-security-systemfunctions-l1-1-0	advapi32.dll
api-ms-win-security-trustee-l1-1-2	advapi32.dll
api-ms-win-service-core-ansi-l1-1-1	advapi32.dll
api-ms-win-service-core-l1-1-4	sechost.dll
api-ms-win-service-management-l1-1-0	sechost.dll
api-ms-win-service-management-l2-1-0	sechost.dll
api-ms-win-service-private-l1-1-5	sechost.dll
api-ms-win-service-private-l1-2-0	sechost.dll
api-ms-win-service-winsvc-l1-1-0	sechost.dll
api-ms-win-service-winsvc-l1-2-0	sechost.dll
api-ms-win-shcore-comhelpers-l1-1-0	shcore.dll
api-ms-win-shcore-obsolete-l1-1-0	shcore.dll
api-ms-win-shcore-path-l1-1-0	shcore.dll
api-ms-win-shcore-registry-l1-1-1	shcore.dll
api-ms-win-shcore-scaling-l1-1-2	shcore.dll
api-ms-win-shcore-stream-l1-1-0	shcore.dll
api-ms-win-shcore-stream-winrt-l1-1-0	shcore.dll
api-ms-win-shcore-sysinfo-l1-1-0	shcore.dll
api-ms-win-shcore-taskpool-l1-1-0	shcore.dll
api-ms-win-shcore-thread-l1-1-0	shcore.dll
api-ms-win-shcore-unicodeansi-l1-1-0	shcore.dll
api-ms-win-shell-associations-l1-1-1	windows.storage.dll
api-ms-win-shell-changenotify-l1-1-0	windows.storage.dll
api-ms-win-shell-dataobject-l1-1-0	windows.storage.dll
api-ms-win-shell-namespace-l1-1-0	windows.storage.dll
api-ms-win-shell-shdirectory-l1-1-0	shcore.dll
api-ms-win-shell-shellcom-l1-1-0	kernelbase.dll
api-ms-win-shell-shellfolders-l1-1-0	windows.storage.dll
api-ms-win-shlwapi-ie-l1-1-0	shlwapi.dll
api-ms-win-shlwapi-winrt-storage-l1-1-1	shlwapi.dll
api-ms-win-stateseparation-helpers-l1-1-0	kernelbase.dll
api-ms-win-storage-exports-external-l1-1-0	windows.storage.dll
api-ms-win-storage-exports-internal-l1-1-0	windows.storage.dll
api-ms-win-winrt-search-folder-l1-1-0	windows.storage.search.dll
api-ms-win-wsl-api-l1-1-0	wslapi.dll
ext-ms-net-eap-sim-l1-1-0	eapsimextdesktop.dll
ext-ms-net-vpn-soh-l1-1-0	vpnsohdesktop.dll
ext-ms-onecore-appdefaults-l1-1-0	windows.storage.dll
ext-ms-onecore-appmodel-plm-l1-1-1	execmodelclient.dll
ext-ms-onecore-appmodel-staterepository-cache-l1-1-1	windows.staterepositorycore.dll
ext-ms-onecore-appmodel-staterepository-internal-l1-1-2	windows.staterepositoryclient.dll
ext-ms-onecore-appmodel-tdlmigration-l1-1-1	tdlmigration.dll
ext-ms-onecore-dcomp-l1-1-0	dcomp.dll
ext-ms-onecore-hcap-svf-l1-1-0	svf.dll
ext-ms-onecore-hlink-l1-1-0	hlink.dll
ext-ms-onecore-hnetcfg-l1-1-0	hnetcfgclient.dll
ext-ms-onecore-ipnathlp-l1-1-0	ipnathlpclient.dll
ext-ms-onecore-mpc-input-l1-1-0	hologramcompositor.dll
ext-ms-onecore-service-devicedirectory-antitheft-l1-1-0	ddcantitheftapi.dll
ext-ms-onecore-service-devicedirectory-claims-l1-1-0	ddcclaimsapi.dll
ext-ms-onecore-shlwapi-l1-1-0	shlwapi.dll
ext-ms-onecore-spectrumsyncclient-l1-1-0	spectrumsyncclient.dll
ext-ms-win-adsi-activeds-l1-1-0	activeds.dll
ext-ms-win-advapi32-auth-l1-1-0	advapi32.dll
ext-ms-win-advapi32-encryptedfile-l1-1-1	advapi32.dll
ext-ms-win-advapi32-eventlog-ansi-l1-1-0	advapi32.dll
ext-ms-win-advapi32-eventlog-l1-1-1	advapi32.dll
ext-ms-win-advapi32-hwprof-l1-1-0	advapi32.dll
ext-ms-win-advapi32-idletask-l1-1-0	advapi32.dll
ext-ms-win-advapi32-lsa-l1-1-2	advapi32.dll
ext-ms-win-advapi32-msi-l1-1-0	advapi32.dll
ext-ms-win-advapi32-npusername-l1-1-0	advapi32.dll
ext-ms-win-advapi32-ntmarta-l1-1-0	advapi32.dll
ext-ms-win-advapi32-psm-app-l1-1-0	twinapi.appcore.dll
ext-ms-win-advapi32-registry-l1-1-1	advapi32.dll
ext-ms-win-advapi32-safer-l1-1-0	advapi32.dll
ext-ms-win-advapi32-shutdown-l1-1-0	advapi32.dll
ext-ms-win-appcompat-aeinv-l1-1-0	aeinv.dll
ext-ms-win-appcompat-aepic-l1-1-0	aepic.dll
ext-ms-win-appcompat-apphelp-l1-1-1	apphelp.dll
ext-ms-win-appcompat-pcacli-l1-1-0	pcacli.dll
ext-ms-win-appmodel-activation-l1-1-0	activationmanager.dll
ext-ms-win-appmodel-appexecutionalias-l1-1-1	apisethost.appexecutionalias.dll
ext-ms-win-appmodel-daxcore-l1-1-3	daxexec.dll
ext-ms-win-appmodel-opc-l1-1-0	opcservices.dll
ext-ms-win-appmodel-restrictedappcontainer-internal-l1-1-0	kernel.appcore.dll
ext-ms-win-appmodel-state-ext-l1-2-0	kernel.appcore.dll
ext-ms-win-appxdeploymentclient-appxdeploy-l1-1-1	appxdeploymentclient.dll
ext-ms-win-appxdeploymentclient-appxdeployonecore-l1-1-0	appxdeploymentclient.dll
ext-ms-win-audiocore-coreaudiopolicymanager-l1-1-0	coreaudiopolicymanagerext.dll
ext-ms-win-authz-claimpolicies-l1-1-0	authz.dll
ext-ms-win-authz-context-l1-1-0	authz.dll
ext-ms-win-authz-remote-l1-1-0	logoncli.dll
ext-ms-win-base-psapi-l1-1-0	psapi.dll
ext-ms-win-base-rstrtmgr-l1-1-0	rstrtmgr.dll
ext-ms-win-biometrics-winbio-core-l1-1-3	winbio.dll
ext-ms-win-biometrics-winbio-l1-1-0	winbio.dll
ext-ms-win-biometrics-winbio-l1-2-0	winbioext.dll
ext-ms-win-biometrics-winbio-l1-3-0	winbioext.dll
ext-ms-win-bluetooth-apis-l1-1-0	bluetoothapis.dll
ext-ms-win-bluetooth-apis-private-l1-1-0	bluetoothapis.dll
ext-ms-win-branding-winbrand-l1-1-2	winbrand.dll
ext-ms-win-branding-winbrand-l1-2-0	winbrand.dll
ext-ms-win-casting-lockscreen-l1-1-0	castingshellext.dll
ext-ms-win-casting-shell-l1-1-0	castingshellext.dll
ext-ms-win-cluster-clusapi-l1-1-3	clusapi.dll
ext-ms-win-cluster-resutils-l1-1-1	resutils.dll
ext-ms-win-cmd-util-l1-1-0	cmdext.dll
ext-ms-win-cng-rng-l1-1-1	bcryptprimitives.dll
ext-ms-win-com-clbcatq-l1-1-0	clbcatq.dll
ext-ms-win-com-coml2-l1-1-1	coml2.dll
ext-ms-win-com-ole32-l1-1-5	ole32.dll
ext-ms-win-com-psmregister-l1-1-0	kernel.appcore.dll
ext-ms-win-com-psmregister-l1-2-2	kernel.appcore.dll
ext-ms-win-com-psmregister-l1-3-0	kernel.appcore.dll
ext-ms-win-composition-ghost-l1-1-0	dwmghost.dll
ext-ms-win-composition-holographic-l1-1-0	hologramcompositor.dll
ext-ms-win-composition-init-l1-1-0	dwminit.dll
ext-ms-win-compositor-hosting-l1-1-1	ism.dll
ext-ms-win-compositor-hosting-l1-2-0	ism.dll
ext-ms-win-core-iuri-l1-1-0	urlmon.dll
ext-ms-win-core-pkeyhelper-l1-1-0	pkeyhelper.dll
ext-ms-win-core-psm-bi-l1-1-0	bisrv.dll
ext-ms-win-core-psm-service-l1-1-4	psmserviceexthost.dll
ext-ms-win-core-resourcemanager-l1-1-0	rmclient.dll
ext-ms-win-core-resourcemanager-l1-2-1	rmclient.dll
ext-ms-win-core-resourcepolicy-l1-1-2	resourcepolicyclient.dll
ext-ms-win-core-resourcepolicyserver-l1-1-1	resourcepolicyserver.dll
ext-ms-win-core-storelicensing-l1-1-0	licensemanagerapi.dll
ext-ms-win-core-storelicensing-l1-2-0	licensemanagerapi.dll
ext-ms-win-core-winsrv-l1-1-0	winsrvext.dll
ext-ms-win-coreui-navshutdown-l1-1-0	navshutdown.dll
ext-ms-win-deployment-productenumerator-l1-1-0	productenumerator.dll
ext-ms-win-desktopappx-l1-1-4	daxexec.dll
ext-ms-win-devmgmt-dm-l1-1-1	dmapisetextimpldesktop.dll
ext-ms-win-devmgmt-policy-l1-1-2	policymanager.dll
ext-ms-win-direct2d-desktop-l1-1-0	direct2ddesktop.dll
ext-ms-win-domainjoin-netjoin-l1-1-0	netjoin.dll
ext-ms-win-dot3-grouppolicy-l1-1-0	dot3gpclnt.dll
ext-ms-win-dwmapi-ext-l1-1-2	dwmapi.dll
ext-ms-win-dwmapidxgi-ext-l1-1-0	dwmapi.dll
ext-ms-win-dx-d3d9-l1-1-0	d3d9.dll
ext-ms-win-dx-ddraw-l1-1-0	ddraw.dll
ext-ms-win-dx-dinput8-l1-1-0	dinput8.dll
ext-ms-win-edputil-policy-l1-1-1	edputil.dll
ext-ms-win-els-elscore-l1-1-0	elscore.dll
ext-ms-win-eventing-pdh-l1-1-0	pdh.dll
ext-ms-win-eventing-rundown-l1-1-0	etwrundown.dll
ext-ms-win-eventing-tdh-ext-l1-1-0	tdh.dll
ext-ms-win-familysafety-childaccount-l1-1-0	familysafetyext.dll
ext-ms-win-feclient-encryptedfile-l1-1-2	feclient.dll
ext-ms-win-firewallapi-webproxy-l1-1-1	firewallapi.dll
ext-ms-win-font-fontgroups-l1-1-0	fontgroupsoverride.dll
ext-ms-win-fs-clfs-l1-1-0	clfs.sys
ext-ms-win-fs-cscapi-l1-1-0	cscapi.dll
ext-ms-win-fs-vssapi-l1-1-0	vssapi.dll
ext-ms-win-fsutilext-ifsutil-l1-1-0	fsutilext.dll
ext-ms-win-fsutilext-ulib-l1-1-0	fsutilext.dll
ext-ms-win-fveapi-query-l1-1-0	fveapi.dll
ext-ms-win-gaming-gamechatoverlay-l1-1-0	gamechatoverlayext.dll
ext-ms-win-gaming-xblgamesave-l1-1-0	xblgamesaveext.dll
ext-ms-win-gaming-xinput-l1-1-0	xinputuap.dll
ext-ms-win-gdi-clipping-l1-1-0	gdi32full.dll
ext-ms-win-gdi-dc-create-l1-1-2	gdi32full.dll
ext-ms-win-gdi-dc-l1-2-1	gdi32full.dll
ext-ms-win-gdi-devcaps-l1-1-0	gdi32full.dll
ext-ms-win-gdi-draw-l1-1-3	gdi32full.dll
ext-ms-win-gdi-font-l1-1-3	gdi32full.dll
ext-ms-win-gdi-gdiplus-l1-1-0	gdiplus.dll
ext-ms-win-gdi-internal-desktop-l1-1-2	gdi32full.dll
ext-ms-win-gdi-metafile-l1-1-2	gdi32full.dll
ext-ms-win-gdi-path-l1-1-0	gdi32full.dll
ext-ms-win-gdi-print-l1-1-0	gdi32full.dll
ext-ms-win-gdi-private-l1-1-0	gdi32full.dll
ext-ms-win-gdi-render-l1-1-0	gdi32.dll
ext-ms-win-gdi-rgn-l1-1-0	gdi32full.dll
ext-ms-win-gdi-wcs-l1-1-0	gdi32full.dll
ext-ms-win-globalization-collation-l1-1-0	globcollationhost.dll
ext-ms-win-globalization-input-l1-1-2	globinputhost.dll
ext-ms-win-gpapi-grouppolicy-l1-1-0	gpapi.dll
ext-ms-win-gpsvc-grouppolicy-l1-1-0	gpsvc.dll
ext-ms-win-gui-dui70-l1-1-0	dui70.dll
ext-ms-win-gui-ieui-l1-1-0	ieui.dll
ext-ms-win-gui-uxinit-l1-1-0	uxinit.dll
ext-ms-win-hostactivitymanager-hostidstore-l1-1-0	rmclient.dll
ext-ms-win-hyperv-hgs-l1-1-0	vmhgs.dll
ext-ms-win-hyperv-hvemulation-l1-1-0	winhvemulation.dll
ext-ms-win-hyperv-hvplatform-l1-1-1	winhvplatform.dll
ext-ms-win-imm-l1-1-1	imm32.dll
ext-ms-win-kernel32-appcompat-l1-1-0	kernel32.dll
ext-ms-win-kernel32-datetime-l1-1-0	kernel32.dll
ext-ms-win-kernel32-elevation-l1-1-0	kernel32.dll
ext-ms-win-kernel32-errorhandling-l1-1-0	kernel32.dll	faultrep.dll
ext-ms-win-kernel32-file-l1-1-0	kernel32.dll
ext-ms-win-kernel32-localization-l1-1-0	kernel32.dll
ext-ms-win-kernel32-package-current-l1-1-0	kernel.appcore.dll
ext-ms-win-kernel32-package-l1-1-2	kernel.appcore.dll
ext-ms-win-kernel32-process-l1-1-0	kernel32.dll
ext-ms-win-kernel32-quirks-l1-1-1	kernel32.dll
ext-ms-win-kernel32-registry-l1-1-0	kernel32.dll
ext-ms-win-kernel32-sidebyside-l1-1-0	kernel32.dll
ext-ms-win-kernel32-transacted-l1-1-0	kernel32.dll
ext-ms-win-kernel32-windowserrorreporting-l1-1-1	kernel32.dll
ext-ms-win-kernelbase-processthread-l1-1-0	kernel32.dll
ext-ms-win-mapi-mapi32-l1-1-0	mapistub.dll
ext-ms-win-media-avi-l1-1-0	avifil32.dll
ext-ms-win-mf-vfw-l1-1-0	mfvfw.dll
ext-ms-win-mininput-cursorhost-l1-1-0	inputhost.dll
ext-ms-win-mininput-inputhost-l1-1-1	inputhost.dll
ext-ms-win-mininput-inputhost-l1-2-0	inputhost.dll
ext-ms-win-mininput-systeminputhost-l1-1-0	ism.dll
ext-ms-win-mm-msacm-l1-1-0	msacm32.dll
ext-ms-win-mm-pehelper-l1-1-0	mf.dll
ext-ms-win-mm-wmvcore-l1-1-0	wmvcore.dll
ext-ms-win-moderncore-win32k-base-ntgdi-l1-1-0	win32kfull.sys
ext-ms-win-moderncore-win32k-base-ntuser-l1-1-0	win32kfull.sys
ext-ms-win-moderncore-win32k-base-sysentry-l1-1-0	win32k.sys
ext-ms-win-mpr-multipleproviderrouter-l1-1-0	mprext.dll
ext-ms-win-mrmcorer-resmanager-l1-1-0	mrmcorer.dll
ext-ms-win-msa-ui-l1-1-0	msauserext.dll
ext-ms-win-msa-user-l1-1-1	msauserext.dll
ext-ms-win-msi-misc-l1-1-0	msi.dll
ext-ms-win-msiltcfg-msi-l1-1-0	msiltcfg.dll
ext-ms-win-msimg-draw-l1-1-0	msimg32.dll
ext-ms-win-net-cmvpn-l1-1-0	cmintegrator.dll
ext-ms-win-net-httpproxyext-l1-1-0	httpprxc.dll
ext-ms-win-net-isoext-l1-1-0	firewallapi.dll
ext-ms-win-net-netbios-l1-1-0	netbios.dll
ext-ms-win-net-netshell-l1-1-0	netshell.dll
ext-ms-win-net-nfdapi-l1-1-0	ndfapi.dll
ext-ms-win-netprovision-netprovfw-l1-1-0	netprovfw.dll
ext-ms-win-networking-nlaapi-l1-1-0	nlaapi.dll
ext-ms-win-networking-radiomonitor-l1-1-0	windows.devices.radios.dll
ext-ms-win-networking-teredo-l1-1-0	windows.networking.connectivity.dll
ext-ms-win-networking-wcmapi-l1-1-1	wcmapi.dll
ext-ms-win-networking-winipsec-l1-1-0	winipsec.dll
ext-ms-win-networking-wlanapi-l1-1-0	wlanapi.dll
ext-ms-win-newdev-config-l1-1-3	newdev.dll
ext-ms-win-nfc-semgr-l1-1-0	semgrsvc.dll
ext-ms-win-ntdsa-activedirectoryserver-l1-1-0	ntdsa.dll
ext-ms-win-ntdsapi-activedirectoryclient-l1-1-1	ntdsapi.dll
ext-ms-win-ntos-clipsp-l1-1-0	clipsp.sys
ext-ms-win-ntos-kcminitcfg-l1-1-0	cmimcext.sys
ext-ms-win-ntos-tm-l1-1-0	tm.sys
ext-ms-win-ntos-ucode-l1-1-0	ntosext.sys
ext-ms-win-ntos-werkernel-l1-1-1	werkernel.sys
ext-ms-win-ntuser-caret-l1-1-0	user32.dll
ext-ms-win-ntuser-chartranslation-l1-1-0	user32.dll
ext-ms-win-ntuser-dc-access-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-dialogbox-l1-1-3	user32.dll
ext-ms-win-ntuser-draw-l1-1-2	user32.dll
ext-ms-win-ntuser-gui-l1-1-1	user32.dll
ext-ms-win-ntuser-gui-l1-2-0	user32.dll
ext-ms-win-ntuser-gui-l1-3-1	user32.dll
ext-ms-win-ntuser-keyboard-l1-1-1	user32.dll
ext-ms-win-ntuser-keyboard-l1-2-0	user32.dll
ext-ms-win-ntuser-keyboard-l1-3-0	user32.dll
ext-ms-win-ntuser-menu-l1-1-3	user32.dll
ext-ms-win-ntuser-message-l1-1-3	user32.dll
ext-ms-win-ntuser-misc-l1-1-0	user32.dll
ext-ms-win-ntuser-misc-l1-2-0	user32.dll
ext-ms-win-ntuser-misc-l1-3-0	user32.dll
ext-ms-win-ntuser-misc-l1-5-1	user32.dll
ext-ms-win-ntuser-mit-l1-1-0	user32.dll
ext-ms-win-ntuser-mouse-l1-1-1	user32.dll
ext-ms-win-ntuser-powermanagement-l1-1-0	user32.dll
ext-ms-win-ntuser-private-l1-1-1	user32.dll
ext-ms-win-ntuser-private-l1-2-0	user32.dll
ext-ms-win-ntuser-private-l1-3-3	user32.dll
ext-ms-win-ntuser-rawinput-l1-1-0	user32.dll
ext-ms-win-ntuser-rectangle-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-rim-l1-1-1	user32.dll
ext-ms-win-ntuser-rotationmanager-l1-1-2	user32.dll
ext-ms-win-ntuser-server-l1-1-1	user32.dll
ext-ms-win-ntuser-string-l1-1-0	user32.dll
ext-ms-win-ntuser-synch-l1-1-0	user32.dll
ext-ms-win-ntuser-sysparams-ext-l1-1-1	user32.dll
ext-ms-win-ntuser-touch-hittest-l1-1-0	user32.dll
ext-ms-win-ntuser-uicontext-ext-l1-1-0	user32.dll
ext-ms-win-ntuser-window-l1-1-4	user32.dll
ext-ms-win-ntuser-windowclass-l1-1-2	user32.dll
ext-ms-win-ntuser-windowstation-ansi-l1-1-1	user32.dll
ext-ms-win-ntuser-windowstation-l1-1-2	user32.dll
ext-ms-win-odbc-odbc32-l1-1-0	odbc32.dll
ext-ms-win-ole32-bindctx-l1-1-0	ole32.dll
ext-ms-win-ole32-ie-ext-l1-1-0	ole32.dll
ext-ms-win-ole32-oleautomation-l1-1-0	ole32.dll
ext-ms-win-oleacc-l1-1-2	oleacc.dll
ext-ms-win-onecore-shutdown-l1-1-0	twinapi.appcore.dll
ext-ms-win-parentalcontrols-setup-l1-1-0	wpcapi.dll
ext-ms-win-pinenrollment-enrollment-l1-1-2	pinenrollmenthelper.dll
ext-ms-win-printer-prntvpt-l1-1-1	prntvpt.dll
ext-ms-win-printer-winspool-l1-1-4	winspool.drv
ext-ms-win-profile-extender-l1-1-0	userenv.dll
ext-ms-win-profile-profsvc-l1-1-0	profsvcext.dll
ext-ms-win-profile-userenv-l1-1-1	profext.dll
ext-ms-win-provisioning-platform-l1-1-2	provplatformdesktop.dll
ext-ms-win-ras-rasapi32-l1-1-2	rasapi32.dll
ext-ms-win-ras-rasdlg-l1-1-0	rasdlg.dll
ext-ms-win-ras-rasman-l1-1-0	rasman.dll
ext-ms-win-ras-tapi32-l1-1-1	tapi32.dll
ext-ms-win-raschapext-eap-l1-1-0	raschapext.dll
ext-ms-win-rastlsext-eap-l1-1-0	rastlsext.dll
ext-ms-win-rdr-davhlpr-l1-1-0	davhlpr.dll
ext-ms-win-reinfo-query-l1-1-0	reinfo.dll
ext-ms-win-resourcemanager-crm-l1-1-0	rmclient.dll
ext-ms-win-resourcemanager-crm-l1-2-0	rmclient.dll
ext-ms-win-resourcemanager-gamemode-l1-1-0	rmclient.dll
ext-ms-win-resourcemanager-gamemode-l1-2-1	rmclient.dll
ext-ms-win-resources-deployment-l1-1-0	mrmdeploy.dll
ext-ms-win-resources-languageoverlay-l1-1-1	languageoverlayutil.dll
ext-ms-win-ro-typeresolution-l1-1-1	wintypes.dll
ext-ms-win-rometadata-dispenser-l1-1-0	rometadata.dll
ext-ms-win-rpc-firewallportuse-l1-1-0	rpcrtremote.dll
ext-ms-win-rpc-ssl-l1-1-0	rpcrtremote.dll
ext-ms-win-rtcore-gdi-devcaps-l1-1-1	gdi32.dll
ext-ms-win-rtcore-gdi-object-l1-1-0	gdi32.dll
ext-ms-win-rtcore-gdi-rgn-l1-1-1	gdi32.dll
ext-ms-win-rtcore-ntuser-controllernavigation-l1-1-1	inputhost.dll
ext-ms-win-rtcore-ntuser-cursor-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-dc-access-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-dpi-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-dpi-l1-2-1	user32.dll
ext-ms-win-rtcore-ntuser-iam-l1-1-1	user32.dll
ext-ms-win-rtcore-ntuser-inputintercept-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-integration-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-rawinput-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-synch-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-syscolors-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-sysparams-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-window-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-winevent-ext-l1-1-0	user32.dll
ext-ms-win-rtcore-ntuser-wmpointer-l1-1-0	user32.dll
ext-ms-win-samsrv-accountstore-l1-1-0	samsrv.dll
ext-ms-win-scesrv-server-l1-1-0	scesrv.dll
ext-ms-win-search-folder-l1-1-0	searchfolder.dll
ext-ms-win-secur32-translatename-l1-1-0	secur32.dll
ext-ms-win-security-appinfoext-l1-1-0	appinfoext.dll
ext-ms-win-security-authbrokerui-l1-1-0	authbrokerui.dll
ext-ms-win-security-authz-helper-l1-1-0	authentication.dll
ext-ms-win-security-capauthz-l1-1-1	capauthz.dll
ext-ms-win-security-catalog-database-l1-1-0	cryptcatsvc.dll
ext-ms-win-security-certpoleng-l1-1-0	certpoleng.dll
ext-ms-win-security-cfl-l1-1-0	cflapi.dll
ext-ms-win-security-credui-internal-l1-1-0	wincredui.dll
ext-ms-win-security-credui-l1-1-1	credui.dll
ext-ms-win-security-cryptui-l1-1-1	cryptui.dll
ext-ms-win-security-efs-l1-1-1	efsext.dll
ext-ms-win-security-efswrt-l1-1-2	efswrt.dll
ext-ms-win-security-kerberos-l1-1-0	kerberos.dll
ext-ms-win-security-ngc-local-l1-1-0	ngclocal.dll
ext-ms-win-security-shutdownext-l1-1-0	shutdownext.dll
ext-ms-win-security-slc-l1-1-0	slc.dll
ext-ms-win-security-srp-l1-1-1	srpapi.dll
ext-ms-win-security-tokenbrokerui-l1-1-0	tokenbrokerui.dll
ext-ms-win-security-vaultcds-l1-1-0	vaultcds.dll
ext-ms-win-security-vaultcli-l1-1-1	vaultcli.dll
ext-ms-win-security-winscard-l1-1-1	winscard.dll
ext-ms-win-sensors-core-private-l1-1-4	sensorsnativeapi.dll
ext-ms-win-sensors-utilities-private-l1-1-3	sensorsutilsv2.dll
ext-ms-win-session-candidateaccountmgr-l1-1-0	usermgrcli.dll
ext-ms-win-session-userinit-l1-1-0	userinitext.dll
ext-ms-win-session-usermgr-l1-1-0	usermgrcli.dll
ext-ms-win-session-usermgr-l1-2-0	usermgrcli.dll
ext-ms-win-session-usertoken-l1-1-0	wtsapi32.dll
ext-ms-win-session-wininit-l1-1-0	wininitext.dll
ext-ms-win-session-winlogon-l1-1-1	winlogonext.dll
ext-ms-win-session-winsta-l1-1-3	winsta.dll
ext-ms-win-session-wtsapi32-l1-1-0	wtsapi32.dll
ext-ms-win-setupapi-classinstallers-l1-1-2	setupapi.dll
ext-ms-win-setupapi-inf-l1-1-1	setupapi.dll
ext-ms-win-setupapi-logging-l1-1-0	setupapi.dll
ext-ms-win-shell-aclui-l1-1-0	aclui.dll
ext-ms-win-shell-comctl32-da-l1-1-0	comctl32.dll
ext-ms-win-shell-comctl32-init-l1-1-1	comctl32.dll
ext-ms-win-shell-comctl32-l1-1-0	comctl32.dll
ext-ms-win-shell-comctl32-window-l1-1-0	comctl32.dll
ext-ms-win-shell-comdlg32-l1-1-1	comdlg32.dll
ext-ms-win-shell-directory-l1-1-0	windows.storage.dll
ext-ms-win-shell-efsadu-l1-1-0	efsadu.dll
ext-ms-win-shell-embeddedmode-l1-1-0	embeddedmodesvcapi.dll
ext-ms-win-shell-exports-internal-l1-1-0	shell32.dll
ext-ms-win-shell-ntshrui-l1-1-0	ntshrui.dll
ext-ms-win-shell-propsys-l1-1-0	propsys.dll
ext-ms-win-shell-settingsync-l1-1-3	settingsyncpolicy.dll
ext-ms-win-shell-shdocvw-l1-1-0	shdocvw.dll
ext-ms-win-shell-shell32-l1-2-2	shell32.dll
ext-ms-win-shell-shlwapi-l1-1-2	shlwapi.dll
ext-ms-win-shell-shlwapi-l1-2-0	shlwapi.dll
ext-ms-win-shell-tabbedtitlebar-l1-1-0	twinapi.appcore.dll
ext-ms-win-shell32-shellcom-l1-1-0	windows.storage.dll
ext-ms-win-shell32-shellfolders-l1-1-1	windows.storage.dll
ext-ms-win-shell32-shellfolders-l1-2-0	windows.storage.dll
ext-ms-win-smbshare-browser-l1-1-0	browser.dll
ext-ms-win-smbshare-browserclient-l1-1-0	browcli.dll
ext-ms-win-smbshare-sscore-l1-1-0	sscoreext.dll
ext-ms-win-spinf-inf-l1-1-0	spinf.dll
ext-ms-win-storage-hbaapi-l1-1-0	hbaapi.dll
ext-ms-win-storage-iscsidsc-l1-1-0	iscsidsc.dll
ext-ms-win-storage-sense-l1-1-0	storageusage.dll
ext-ms-win-storage-sense-l1-2-0	storageusage.dll
ext-ms-win-sxs-oleautomation-l1-1-0	sxs.dll
ext-ms-win-tsf-inputsetting-l1-1-0	input.dll
ext-ms-win-tsf-msctf-l1-1-2	msctf.dll
ext-ms-win-ttlsext-eap-l1-1-0	ttlsext.dll
ext-ms-win-uiacore-l1-1-3	uiautomationcore.dll
ext-ms-win-umpoext-umpo-l1-1-0	umpoext.dll
ext-ms-win-usp10-l1-1-0	gdi32full.dll
ext-ms-win-uwf-servicing-apis-l1-1-1	uwfservicingapi.dll
ext-ms-win-uxtheme-themes-l1-1-1	uxtheme.dll
ext-ms-win-wer-reporting-l1-1-3	wer.dll
ext-ms-win-wer-ui-l1-1-0	werui.dll
ext-ms-win-wer-wct-l1-1-0	wer.dll
ext-ms-win-wevtapi-eventlog-l1-1-3	wevtapi.dll
ext-ms-win-winrt-device-access-l1-1-0	deviceaccess.dll
ext-ms-win-winrt-storage-l1-1-0	windows.storage.dll
ext-ms-win-winrt-storage-l1-2-2	windows.storage.dll
ext-ms-win-wlan-grouppolicy-l1-1-0	wlgpclnt.dll
ext-ms-win-wlan-onexui-l1-1-0	onexui.dll
ext-ms-win-wlan-scard-l1-1-0	winscard.dll
ext-ms-win-wnv-l1-1-0	wnv.sys
ext-ms-win-wrp-sfc-l1-1-0	sfc.dll
ext-ms-win-wsclient-devlicense-l1-1-1	wsclient.dll
ext-ms-win-wwaext-misc-l1-1-0	wwaext.dll
ext-ms-win-wwaext-module-l1-1-0	wwaext.dll
ext-ms-win-wwan-wwapi-l1-1-3	wwapi.dll
ext-ms-win-xaml-controls-l1-1-0	windows.ui.xaml.phone.dll

↧

WNF IDs from w10 build 18312

January 14, 2019, 5:59 am

≫ Next: simple way to find PsKernelRangeList

≪ Previous: apisetschema.dll from windows 10 build 1774

ripped from ContentDeliveryManager.Utilities.dll