to compare with
WNF_AAD_DEVICE_REGISTRATION_STATUS_CHANGE id1 A3BC0875 id2 41820F2C
This event is signalled when device changes status of registration in Azure Active Directory. WNF_ACC_EC_ENABLED id1 A3BC0835 id2 41850D2C
This event is bool signaled to indicate the EC accessibility feature enabled state WNF_ACT_DATA_UPDATED id1 A3BC0835 id2 41920D2C
Indicates Activity Data has been updated WNF_AFD_IGNORE_ORDERLY_RELEASE_CHANGE id1 A3BC0875 id2 4182082C
A system entity has requested a change in AFD's orderly release behavior. WNF_AOW_BOOT_PROGRESS id1 A3BC0875 id2 4191012C
This state is incremented when a discrete part of the AoW boot sequence has completed. Security: WNF_STATE_SUBSCRIBE (1) by everyone (WD) and app containers (S-1-15-2-1); WNF_STATE_SUBSCRIBE | WNF_STATE_PUBLISH (3) by Local System (SY) and the Interactive User account (IU). WNF_BCST_APP_BROADCAST_STREAM_STATE id1 A3BC0875 id2 15950D2F
Contains the current stream state information for the app broadcast service. WNF_AI_USERTILE id1 A3BC0875 id2 41C6072C
AppInstallation state name to receive RAW notifications WNF_AI_PACKAGEINSTALL id1 A3BC1075 id2 41C6072C
This event is signalled when a package install operation completes WNF_AI_PACKAGEUPDATE id1 A3BC1875 id2 41C6072C
This event is signalled when a package update operation completes WNF_AI_PACKAGEUNINSTALL id1 A3BC2075 id2 41C6072C
This event is signalled when a package uninstall operation completes WNF_A2A_APPURIHANDLER_INSTALLED id1 A3BC0875 id2 41877C2C
An app implementing windows.AppUriHandler contract has been installed WNF_APXI_CRITICAL_PACKAGES_INSTALLED id1 A3BC0875 id2 89E1E2C
This event is fired when all critical packages (those that need to be installed before the shell is displayed) have installed. WNF_AA_LOCKDOWN_CHANGED id1 A3BC0875 id2 41C60F2C
Mobile lockdown configuration has been changed WNF_AA_CURATED_TILE_COLLECTION_STATUS id1 A3BC1075 id2 41C60F2C
Curate tile collection for all allowed apps for current AssignedAccess account has been created WNF_AA_MDM_STATUS_EVENT_LOGGED id1 A3BC1875 id2 41C60F2C
Events are logged to the assigned access status trace logging. WNF_AUDC_CPUSET_ID id1 A3BC08B5 id2 2821B2C
This state holds the CPU Set ID for audio threads. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_AUDC_PHONECALL_ACTIVE id1 A3BC1075 id2 2821B2C
This state indicates an active phone call, which can be from a cellular call or active Communications category audio streams WNF_AUDC_TUNER_DEVICE_AVAILABILITY id1 A3BC1875 id2 2821B2C
This notification indicates whether or not the tuner endpoint is available. WNF_AUDC_HEALTH_PROBLEM id1 A3BC2075 id2 2821B2C
State for problems detected in the audio core. WNF_AUDC_CPUSET_ID_SYSTEM id1 A3BC2875 id2 2821B2C
This state keeps other system services apprised of the audio-reserved CPU set ID. WNF_AUDC_RENDER id1 A3BC3075 id2 2821B2C
Reports the number of, and all endpoints currently rendering audio. Returns a WNF_STREAM_EVENT_HEADER data structure WNF_AUDC_VOLUME_CONTEXT id1 A3BC3875 id2 2821B2C
This notification is raised when contextual volume for endpoints have changed. WNF_AUDC_CAPTURE id1 A3BC4075 id2 2821B2C
Reports the number of, and process ids of all applications currently capturing audio. Returns a WNF_CAPTURE_STREAM_EVENT_HEADER data structure WNF_AUDC_RINGERVIBRATE_STATE_CHANGED id1 A3BC4875 id2 2821B2C
Reports the changes to the Ringervibrate state of the device WNF_AUDC_SPATIAL_STATUS id1 A3BC5075 id2 2821B2C
Reports for each spatial audio endpoint if spatial audio is currently being rendered. Returns a WNF_SPATIAL_STATUS_HEADER data structure WNF_AUDC_DEFAULT_RENDER_ENDPOINT_PROPERTIES id1 A3BC5875 id2 2821B2C
Reports certain properties of the default render multimedia endpoint whenever the default endpoint changes or a property of interest changes on the default render endpoint WNF_AUDC_CHAT_APP_CONTEXT id1 A3BC6075 id2 2821B2C
Publishes a list of the current chat applications on the device WNF_AVA_SOUNDDETECTOR_PATTERN_MATCH id1 A3BC0875 id2 4187182C
This notification is used to signal that a match has been detected for Voice Activation WNF_AVLC_DRIVER_REQUEST id1 A3BC0875 id2 28A182C
A driver requst permission for volume limit change. WNF_AVLC_VOLUME_WARNING_ACCEPTED id1 A3BC1075 id2 28A182C
This event propagates the user's choice from the warning dialog. WNF_AVLC_SHOW_VOLUMELIMITWARNING id1 A3BC1875 id2 28A182C
This event informs the system that we need to show reached volume limit warning message WNF_ACHK_SP_CORRUPTION_DETECTED id1 A3BC0875 id2 A8E0D2C
Event fired when we scan the System Partition and find corruption. WNF_BMP_BG_PLAYSTATE_CHANGED id1 A3BC0875 id2 4196032F
The background media player's playstate has changed. WNF_BMP_BG_PLAYBACK_REVOKED id1 A3BC1075 id2 4196032F
The following tasks aren't able to play under current policy WNF_OS_IP_OVER_USB_AVAILABLE id1 A3BC8075 id2 41C61D22
IP Over USB Availability. SDDL comes from ID_CAP_EVERYONE and IpOverUsb in %SDXROOT%\src\baseos\prod\packages\MfgIpOverUsb\MfgIpOverUsb.pkg.xml WNF_OS_IU_PROGRESS_REPORT id1 A3BC8875 id2 41C61D22
Update progress reporting status. SDDL comes from ID_CAP_BASEOS_UPDATEAPI in %SDXROOT%\src\baseos\prod\packages\imgupd\MainOS\ImgUpd.pkg.xml WNF_FVE_DE_SUPPORT id1 A3BC0875 id2 4183182B
This event triggers when Device Encryption support status is evaluated, and receives the result of that evaluation. WNF_FVE_DE_MANAGED_VOLUMES_COUNT id1 A3BC1075 id2 4183182B
This event triggers when the BitLocker service detects a change in the count of DE-managed volumes, and includes the count of such volumes. WNF_FVE_WIM_HASH_GENERATION_TRIGGER id1 A3BC1875 id2 4183182B
This event triggers or signals to stop WIM hash generation task. WNF_FVE_WIM_HASH_GENERATION_COMPLETION id1 A3BC2075 id2 4183182B
This event signals completion of WIM hash generation. WNF_FVE_WIM_HASH_DELETION_TRIGGER id1 A3BC2875 id2 4183182B
This event triggers WIM hash deletion. WNF_FVE_BDESVC_TRIGGER_START id1 A3BC3075 id2 4183182B
This event trigger-starts BdeSvc service. WNF_FVE_STATE_CHANGE id1 A3BC3875 id2 4183182B
This event triggers on every BitLocker state change. WNF_FVE_MDM_POLICY_REFRESH id1 A3BC4075 id2 4183182B
This event triggers where RequireDeviceEncryption policy arrives under the BitLocker area. WNF_FVE_REQUIRE_SDCARD_ENCRYPTION id1 A3BC4875 id2 4183182B
This event triggers SD card encrytion policy arrival notification. WNF_FVE_SDCARD_ENCRYPTION_REQUEST id1 A3BC5075 id2 4183182B
This event triggers SecTask to enable/disable SD Card encryption. WNF_FVE_SDCARD_ENCRYPTION_STATUS id1 A3BC5875 id2 4183182B
This event indicates completion of SD Card encryption/decryption request. WNF_FVE_DETASK_TRIGGER_START id1 A3BC6075 id2 4183182B
This event trigger-starts device encryption task. WNF_FVE_BITLOCKER_ENCRYPT_ALL_DRIVES id1 A3BC6875 id2 4183182B
This event triggers BitLocker task to enable BitLocker on all volumes. WNF_BLTH_BLUETOOTH_STATUS id1 A3BC0875 id2 992022F
State name for Bluetooth overall status notification. Flags from the BLUETOOTH_GLOBAL_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTConnMgr in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml WNF_BLTH_BLUETOOTH_AUDIO_GATEWAY_STATUS id1 A3BC1075 id2 992022F
State name for Bluetooth Audio Gateway status notification. A 32-bit bitmask of BLUETOOTH_AUDIO_GATEWAY_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTAGService in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml WNF_BLTH_BLUETOOTH_MAP_STATUS id1 A3BC1875 id2 992022F
State name for Bluetooth MAP status notification. A 32-bit bitmask of BLUETOOTH_MAP_STATUS enum are returned. WNF_BLTH_BLUETOOTH_CONNECTION_STATE_CHANGE id1 A3BC2075 id2 992022F
Indicates when a Bluetooth Device gets connected and disconnected WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_REQUEST id1 A3BC2875 id2 992022F
Indicates that a legacy Gatt client request is present. The local radio and remote device BTH_ADDR are returned. WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_INVALIDATE_TOKEN id1 A3BC3075 id2 992022F
Indicates that a legacy Gatt client request was no longer present. The previously granted access token to be revoked is returned. WNF_BLTH_BLUETOOTH_QUICKPAIR_STATUS_CHANGED id1 A3BC3875 id2 992022F
Notification that the user requested a change to the status of the QuickPair engine. WNF_BLTH_BLUETOOTH_AVRCP_VOLUME_CHANGED id1 A3BC4075 id2 992022F
Notification that the user has changed the volume level using AVRCP on a Bluetooth peripheral. WNF_BLTH_BLUETOOTH_DEVICE_BATTERY_IS_LOW id1 A3BC4875 id2 992022F
Notification that a Bluetooth device's battery is low. WNF_BLTH_BLUETOOTH_LE_ADV_SCANNING_STATUS id1 A3BC5075 id2 992022F
Exposes the status of Bluetooth LE Advertisement scanning. WNF_BOOT_DIRTY_SHUTDOWN id1 A3BC0875 id2 1589012F
The state is published once the previous shutdown was not clean. WNF_BOOT_INVALID_TIME_SOURCE id1 A3BC1075 id2 1589012F
The state is published if system time is initialized with a backup time source. WNF_BOOT_MEMORY_PARTITIONS_RESTORE id1 A3BC1875 id2 1589012F
The state reflects memory partiton restoration state (nothing to restore, restore in progress, restore completed, failure) WNF_BRI_ACTIVE_WINDOW id1 A3BC0875 id2 418F1C2F
Notifies brightness classes of the active window in order to apply their brightness preferences WNF_BI_BROKER_WAKEUP_CHANNEL id1 A3BC0875 id2 41C6072F
Background work execution trigger WNF_BI_USER_LOGON_CHANNEL id1 A3BC1075 id2 41C6072F
BI user logon system state notification channel WNF_BI_USER_LOGOFF_CHANNEL id1 A3BC1875 id2 41C6072F
BI user logoff system state notification channel WNF_BI_SESSION_CONNECT_CHANNEL id1 A3BC2075 id2 41C6072F
BI session connect system state notification channel WNF_BI_SESSION_DISCONNECT_CHANNEL id1 A3BC2875 id2 41C6072F
BI session disconnect system state notification channel WNF_BI_APPLICATION_UNINSTALL_CHANNEL id1 A3BC3075 id2 41C6072F
BI application uninstall system state notification channel WNF_BI_APPLICATION_SERVICING_START_CHANNEL id1 A3BC3875 id2 41C6072F
BI application servicing start system state notification channel WNF_BI_APPLICATION_SERVICING_STOP_CHANNEL id1 A3BC4075 id2 41C6072F
BI application servicing stop system state notification channel WNF_BI_LOCK_SCREEN_UPDATE_CHANNEL id1 A3BC4875 id2 41C6072F
BI lock screen update system state notification channel WNF_BI_EVENT_DELETION id1 A3BC5075 id2 41C6072F
BI event deletion system state notification channel WNF_BI_PSM_TEST_HOOK_CHANNEL id1 A3BC5875 id2 41C6072F
PSM policy test hook WNF_BI_QUIET_MODE_UPDATE_CHANNEL id1 A3BC6075 id2 41C6072F
BI Quiet Mode update system state notification channel WNF_BI_BI_READY id1 A3BC6835 id2 41C6072F
Indicates that BI is ready and also publish channels list for each session WNF_BI_NOTIFY_NEW_SESSION id1 A3BC7075 id2 41C6072F
BI notify new session system state notification channel WNF_BI_QUERY_APP_USAGE id1 A3BC7875 id2 41C6072F
PSM notification to clients for querying application performance usage WNF_BI_NETWORK_LIMITED_CHANNEL id1 A3BC8075 id2 41C6072F
Notification that the system is entering or exiting a network limited standby WNF_CCTL_BUTTON_REQUESTS id1 A3BC08B5 id2 D920D2E
A button press has caused a request. WNF_CAM_APPDIAGNOSTICS_ACCESS_CHANGED id1 A3BC0875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_APPOINTMENTS_ACCESS_CHANGED id1 A3BC1075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_BLUETOOTH_ACCESS_CHANGED id1 A3BC1875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_CAMERA_ACCESS_CHANGED id1 A3BC2075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_CELLULARDATA_ACCESS_CHANGED id1 A3BC2875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_CHAT_ACCESS_CHANGED id1 A3BC3075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_CONTACTS_ACCESS_CHANGED id1 A3BC3875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_EMAIL_ACCESS_CHANGED id1 A3BC4075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_HID_ACCESS_CHANGED id1 A3BC4875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_LOCATION_ACCESS_CHANGED id1 A3BC5075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_MICROPHONE_ACCESS_CHANGED id1 A3BC5875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_PHONECALL_ACCESS_CHANGED id1 A3BC6075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_PHONECALLHISTORY_ACCESS_CHANGED id1 A3BC6875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_POS_ACCESS_CHANGED id1 A3BC7075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_RADIOS_ACCESS_CHANGED id1 A3BC7875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_SENSORSCUSTOM_ACCESS_CHANGED id1 A3BC8075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_SERIAL_ACCESS_CHANGED id1 A3BC8875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_USB_ACCESS_CHANGED id1 A3BC9075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_USERACCOUNTINFO_ACCESS_CHANGED id1 A3BC9875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_USERDATATASKS_ACCESS_CHANGED id1 A3BCA075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_USERNOTIFICATIONLISTENER_ACCESS_CHANGED id1 A3BCA875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_DOCUMENTSLIBRARY_ACCESS_CHANGED id1 A3BCB075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_PICTURESLIBRARY_ACCESS_CHANGED id1 A3BCB875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_VIDEOSLIBRARY_ACCESS_CHANGED id1 A3BCC075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_GAZEINPUT_ACCESS_CHANGED id1 A3BCC875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_BROADFILESYSTEMACCESS_ACCESS_CHANGED id1 A3BCD075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_ACTIVITY_ACCESS_CHANGED id1 A3BCD875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_BLUETOOTHSYNC_ACCESS_CHANGED id1 A3BCE075 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CAM_WIFIDIRECT_ACCESS_CHANGED id1 A3BCE875 id2 418B0F2E
Event fired when access to the corresponding named app capability changes WNF_CDP_CDPSVC_READY id1 A3BC0875 id2 41960A2E
Indicates CDP Service is ready WNF_CDP_CDPSVC_STOPPING id1 A3BC1075 id2 41960A2E
Indicates CDP Service is stopping WNF_CDP_CDPUSERSVC_READY id1 A3BC1835 id2 41960A2E
Indicates CDP User Service is ready WNF_CDP_CDPUSERSVC_STOPPING id1 A3BC2035 id2 41960A2E
Indicates CDP User Service is stopping WNF_CDP_CDP_MESSAGES_QUEUED id1 A3BC2875 id2 41960A2E
Indicates CDP service queued the message(s) for designated applications WNF_CDP_CDP_ACTIVITIES_RECIEVED id1 A3BC3075 id2 41960A2E
Indicates CDP service received new activities WNF_CDP_USERAUTH_POLICY_CHANGE id1 A3BC3875 id2 41960A2E
Indicates that the user has changed the CDP policy WNF_CDP_CDP_NOTIFICATION_ACTION_FORWARD_FAILURE id1 A3BC4075 id2 41960A2E
Indicates failure either delivering or invoking a Notification Action on a remote device WNF_CDP_USER_ROME_SETTING_CHANGE id1 A3BC4835 id2 41960A2E
Indicates that the user has changed Rome SDK authorization setting WNF_CDP_USER_NEAR_SHARE_SETTING_CHANGE id1 A3BC5035 id2 41960A2E
Indicates that the user has changed Near Share authorization setting WNF_CDP_ENABLE_ACTIVITYFEED_POLICY_CHANGE id1 A3BC5875 id2 41960A2E
Indicates whether ActivityFeed is enabled. It is responsible for mirroring different activity types (as applicable) across device graph of the user. WNF_CDP_PUBLISH_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC6075 id2 41960A2E
Indicates the settings policy (enabled/disabled) for 'User Activity' publishing has changed. WNF_CDP_CDP_LOCAL_ACTIVITIES_RECIEVED id1 A3BC6875 id2 41960A2E
Indicates CDP service received local activities WNF_CDP_USER_RESOURCE_INFO_CHANGED id1 A3BC7075 id2 41960A2E
Indicates the persisted values associated with a resource has changed. WNF_CDP_UPLOAD_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC7875 id2 41960A2E
Indicates the settings policy (enabled/disabled) for 'User Activity' upload has changed. WNF_CDP_ALLOW_CLIPBOARDHISTORY_POLICY_CHANGE id1 A3BC8075 id2 41960A2E
Indicates clipboard history policy has changed. WNF_CDP_ALLOW_CROSSDEVICECLIPBOARD_POLICY_CHANGE id1 A3BC8875 id2 41960A2E
Indicates cross device clipboard policy has changed. WNF_CELL_POWER_STATE_MODEM0 id1 A3BC0875 id2 D8A0B2E
Modem power state of the first modem, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_EVERYONE, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SIGNAL_STRENGTH_BARS_CAN0 id1 A3BC1075 id2 D8A0B2E
Number of bars (0..5) of signal strength for the first cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SYSTEM_TYPE_CAN0 id1 A3BC1875 id2 D8A0B2E
System type of the first cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_STATUS_CAN0 id1 A3BC2075 id2 D8A0B2E
Current registration status of the first cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_STATUS_SLOT0 id1 A3BC2875 id2 D8A0B2E
Status of the UICC in the first slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_AIRPLANEMODE id1 A3BC3075 id2 D8A0B2E
The current state of airplanemode. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_OPERATOR_NAME_CAN0 id1 A3BC3875 id2 D8A0B2E
Current serving operator for the first cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CDMA_ACTIVATION_CAN0 id1 A3BC4075 id2 D8A0B2E
Activation, PRL, and provisioning state for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_NETWORK_TIME_CAN0 id1 A3BC4875 id2 D8A0B2E
NITZ information for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_AVAILABLE_OPERATORS_CAN0 id1 A3BC5075 id2 D8A0B2E
List of available operators for the first cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_DEVICE_INFO_CAN0 id1 A3BC5875 id2 D8A0B2E
Device info (RIL_GetDeviceInfo) for the first cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_DATA_ENABLED_BY_USER_MODEM0 id1 A3BC6475 id2 D8A0B2E
Cellular data enabled state as set by user. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PHONE_NUMBER_CAN0 id1 A3BC6875 id2 D8A0B2E
Phone number (MSISDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_VOICEMAIL_NUMBER_CAN0 id1 A3BC7075 id2 D8A0B2E
Voicemail number (MBDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_PREFERENCES_CAN0 id1 A3BC7C75 id2 D8A0B2E
Registration preferences for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CAN_STATE_CAN0 id1 A3BC8075 id2 D8A0B2E
Can state (between CellManager and CellUX) for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_USER_PREFERRED_POWER_STATE_MODEM0 id1 A3BC8C75 id2 D8A0B2E
Power state of the modem as last preferred by the user, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_AIRPLANEMODE_DETAILS id1 A3BC9075 id2 D8A0B2E
The current state of airplanemode details. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_POSSIBLE_DATA_ACTIVITY_CHANGE_MODEM0 id1 A3BC9875 id2 D8A0B2E
This is triggered if cellcore suspects that data activity may have been affected. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SYSTEM_CONFIG id1 A3BCA475 id2 D8A0B2E
Root state describing cellular system configuration (all modems and their cans). SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN0 id1 A3BCA875 id2 D8A0B2E
Detailed registration status of the first cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_EVERYONE, ID_CAP_ISV_CAMERA, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN0 id1 A3BCB075 id2 D8A0B2E
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PERSO_STATUS_CAN0 id1 A3BCB875 id2 D8A0B2E
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_HOME_OPERATOR_CAN0 id1 A3BCC075 id2 D8A0B2E
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_ISV_CAMERA and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_HOME_PRL_ID_CAN0 id1 A3BCC875 id2 D8A0B2E
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UTK_SETUP_MENU_SLOT0 id1 A3BCE875 id2 D8A0B2E
UICC toolkit setup menu notification for slot 0. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UTK_PROACTIVE_CMD id1 A3BCF075 id2 D8A0B2E
UICC toolkit proactive command notification for all slots. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CSP_WWAN_PLUS_READYNESS id1 A3BCF875 id2 D8A0B2E
CM CSPWWAN+ readyness state. SDDL comes from ID_CAP_CMCSPWWAN_PLUS in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_CELL_CALLFORWARDING_STATUS_CAN0 id1 A3BD0075 id2 D8A0B2E
Call-forwarding status for the first cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_RADIO_TYPE_MODEM0 id1 A3BD0C75 id2 D8A0B2E
Modem radio type of the first modem, values defined by RILRADIOCONFIGURATIONRADIOTYPE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SIGNAL_STRENGTH_BARS_CAN1 id1 A3BD1075 id2 D8A0B2E
Number of bars (0..5) of signal strength for the second cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SYSTEM_TYPE_CAN1 id1 A3BD1875 id2 D8A0B2E
System type of the second cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_STATUS_CAN1 id1 A3BD2075 id2 D8A0B2E
Current registration status of the second cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_STATUS_SLOT1 id1 A3BD2875 id2 D8A0B2E
Status of the UICC in the second slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_OPERATOR_NAME_CAN1 id1 A3BD4075 id2 D8A0B2E
Current serving operator for the second cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CDMA_ACTIVATION_CAN1 id1 A3BD4875 id2 D8A0B2E
Activation, PRL, and provisioning state for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_NETWORK_TIME_CAN1 id1 A3BD5075 id2 D8A0B2E
NITZ information for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_AVAILABLE_OPERATORS_CAN1 id1 A3BD5875 id2 D8A0B2E
List of available operators for the second cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_DEVICE_INFO_CAN1 id1 A3BD6075 id2 D8A0B2E
Device info (RIL_GetDeviceInfo) for the second cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PHONE_NUMBER_CAN1 id1 A3BD7075 id2 D8A0B2E
Phone number (MSISDN) for the second cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_PREFERENCES_CAN1 id1 A3BD8C75 id2 D8A0B2E
Registration preferences for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CAN_STATE_CAN1 id1 A3BD9075 id2 D8A0B2E
Can state (between CellManager and CellUX) for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN1 id1 A3BD9875 id2 D8A0B2E
Detailed registration status of the second cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CELL_WNF, ID_CAP_EVERYONE, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN1 id1 A3BDA075 id2 D8A0B2E
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_HOME_OPERATOR_CAN1 id1 A3BDA875 id2 D8A0B2E
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_HOME_PRL_ID_CAN1 id1 A3BDB075 id2 D8A0B2E
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UTK_SETUP_MENU_SLOT1 id1 A3BDD075 id2 D8A0B2E
UICC toolkit setup menu notification for slot 1. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CALLFORWARDING_STATUS_CAN1 id1 A3BDE075 id2 D8A0B2E
Call-forwarding status for the second cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PERSO_STATUS_CAN1 id1 A3BDE875 id2 D8A0B2E
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CONFIGURED_LINES_CAN0 id1 A3BDF475 id2 D8A0B2E
Configured lines for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CONFIGURED_LINES_CAN1 id1 A3BDFC75 id2 D8A0B2E
Configured lines for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_STATUS_DETAILS_SLOT0 id1 A3BE0075 id2 D8A0B2E
Status details of the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_STATUS_DETAILS_SLOT1 id1 A3BE0875 id2 D8A0B2E
Status details of the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PREFERRED_LANGUAGES_SLOT0 id1 A3BE1075 id2 D8A0B2E
Preferred languages in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PREFERRED_LANGUAGES_SLOT1 id1 A3BE1875 id2 D8A0B2E
Preferred languages in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IMSI_CAN0 id1 A3BE2075 id2 D8A0B2E
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IMSI_CAN1 id1 A3BE2875 id2 D8A0B2E
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_LEGACY_SETTINGS_MIGRATION id1 A3BE3075 id2 D8A0B2E
Migration action for legacy cellcore settings. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_ATR_SLOT0 id1 A3BE3875 id2 D8A0B2E
Answer to reset from the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_ATR_SLOT1 id1 A3BE4075 id2 D8A0B2E
Answer to reset from the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_SIMSEC_SLOT0 id1 A3BE4875 id2 D8A0B2E
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 0. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_SIMSEC_SLOT1 id1 A3BE5075 id2 D8A0B2E
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 1. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_CAN_CONFIGURATION_SET_COMPLETE_MODEM0 id1 A3BE5875 id2 D8A0B2E
Indication that all executors have been configured and that there are no outstanding configurations pending in the modem. SDDL comes from WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_REGISTRATION_CHANGED_TRIGGER_MV id1 A3BE6075 id2 D8A0B2E
This is published when cellcore needs MV to kick in. SDDL comes from ID_CAP_EVERYONE, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN0 id1 A3BE7075 id2 D8A0B2E
Signal-strength details for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN1 id1 A3BE7875 id2 D8A0B2E
Signal-strength details for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_EMERGENCY_CALLBACK_MODE_STATUS id1 A3BE6875 id2 D8A0B2E
Indication about the current emergency callback mode. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IMS_STATUS_CAN0 id1 A3BE8075 id2 D8A0B2E
Current IMS registration for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IMS_STATUS_CAN1 id1 A3BE8875 id2 D8A0B2E
Current IMS registration for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IWLAN_AVAILABILITY_CAN0 id1 A3BE9075 id2 D8A0B2E
iWLAN availability for Can 0, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_IWLAN_AVAILABILITY_CAN1 id1 A3BE9875 id2 D8A0B2E
iWLAN availability for Can 1, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PS_MEDIA_PREFERENCES_CAN0 id1 A3BEA475 id2 D8A0B2E
PS Media preferences for Can 0, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_PS_MEDIA_PREFERENCES_CAN1 id1 A3BEAC75 id2 D8A0B2E
PS Media preferences for Can 1, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_WIFI_CALL_SETTINGS_CAN0 id1 A3BEB075 id2 D8A0B2E
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_WIFI_CALL_SETTINGS_CAN1 id1 A3BEB875 id2 D8A0B2E
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml WNF_CELL_UICC_PIN_STATE_SLOT0 id1 A3BEC075 id2 D8A0B2E
Reports detailed states of PIN on slot 0. It is private for Wwansvc access only WNF_CELL_UICC_PIN_STATE_SLOT1 id1 A3BEC875 id2 D8A0B2E
Reports detailed states of PIN on slot 1. It is private for Wwansvc access only WNF_WWAN_OBJECT_LIST id1 A3BC0875 id2 F87193A
Table of all modems and executors under it. WNF_WWAN_EUICC_ARRIVAL id1 A3BC1075 id2 F87193A
This event is published by WwanSvc to indicate the arrival of an eUICC. WNF_WWAN_CELLULAR_STATE_SNAPSHOT_CHANGE id1 A3BC1875 id2 F87193A
This event is published by WwanSvc to indicate a change in cellular state snapshot. WNF_WWAN_TASK_TRIGGER id1 A3BC2075 id2 F87193A
State name triggering WiFiTask from WwanSvc. WNF_SMSR_READY id1 A3BC0875 id2 1395033E
Sms Router Broker is ready. WNF_SMSR_WWAN_READ_DONE id1 A3BC1075 id2 1395033E
Sms Router Broker is ready. WNF_SMSR_NEW_MESSAGE_RECEIVED id1 A3BC1875 id2 1395033E
Sms Router received a new incoming SMS message. WNF_IMS_PUSH_NOTIFICATION_RECEIVED id1 A3BC0875 id2 41950324
Push Notification Received from Entitlement Server WNF_CERT_FLUSH_CACHE_TRIGGER id1 A3BC0875 id2 15940B2E
This event signals flush cache in all processes where flush is enabled. WNF_CERT_FLUSH_CACHE_STATE id1 A3BC1075 id2 15940B2E
This event signals when flush cache was started and completed in each process where enabled. WNF_CAPS_CENTRAL_ACCESS_POLICIES_CHANGED id1 A3BC0875 id2 12960F2E
Central Access Policies have been updated WNF_CLIP_CONTENT_CHANGED id1 A3BC0875 id2 118F022E
This notification is triggered when contents on the clipboard change WNF_CLIP_HISTORY_CHANGED id1 A3BC1035 id2 118F022E
This notification is triggered when contents of the clipboard history change WNF_CLIP_ROAMING_CLIPBOARD_ENABLED_CHANGED id1 A3BC1835 id2 118F022E
This notification is triggered when roaming clipboard enabled/disabled setting value changes WNF_CLIP_CLIPBOARD_HISTORY_ENABLED_CHANGED id1 A3BC2035 id2 118F022E
This notification is triggered when clipboard history enabled/disabled setting value changes WNF_CXH_WEBAPP_STATUS id1 A3BC0835 id2 418E162E
Notification of web app status change. Payload is status type plus web app cxid of length 512 WNF_CXH_APP_FINISHED id1 A3BC1035 id2 418E162E
Notification when CloudExperienceHost app is finished. Payload is result plus result string of length 512 WNF_CXH_BACK_STATE id1 A3BC1835 id2 418E162E
Notification of web app back button state. Payload is a boolean for on/off WNF_CXH_BACK id1 A3BC2035 id2 418E162E
Notification when back command is issued WNF_CXH_OOBE_APP_READY id1 A3BC2875 id2 418E162E
System-wide signal that the CloudExperienceHost app launched during OOBE is ready with its first webapp visible. Payload is a boolean for true/false WNF_CI_SMODE_CHANGE id1 A3BC0875 id2 41C6072E
This event signals that change of S mode has occurred. WNF_CSHL_COMPOSER_LAUNCH_READY id1 A3BC0835 id2 D8E1D2E
Core shell has initialized, including all of its services (e.g. TLAVM), and the Product Composer can be launched. If the event has not been fired, then CoreShell is still initializing and the Composer cannot be launched. Payload is a DWORD to inidicate it has been fired. WNF_CSHL_UI_AUTOMATION id1 A3BC1035 id2 D8E1D2E
On UI Automation. WNF_CSHL_VIEWHOSTING_READY id1 A3BC2035 id2 D8E1D2E
Fired every time a Composer registers with TLAVM and inidicates that the composer is ready to host applications. If the event has not been fired, then no composer is ready to host applications. Payload is a DWORD to inidicate it has been fired. WNF_CSHL_PRODUCT_READY id1 A3BC2835 id2 D8E1D2E
Fired every time a Product Composer has finished initializing and indicates that Shell has entered normal operations (i.e. not in restricted mode or running OOBE/PostUpdateUX). If the event has not been fired, then the Product Composer is still initializing. Payload is a DWORD to inidicate it has been fired. WNF_CSHL_COMPOSER_TEARDOWN id1 A3BC3035 id2 D8E1D2E
When set to the value 1, it indicates that the current composer has finished unintializing. WNF_CSHL_COMPOSER_CONTEXT_CHANGED id1 A3BC3835 id2 D8E1D2E
Indicates the composer has changed which updates the registry (ComposerManagerBaseKey) indicating which composer can be restored after a crash WNF_CSHL_SKIP_OOBE_CXH id1 A3BC4035 id2 D8E1D2E
Fired when a test job wants to skip CXH stage of OOBE WNF_CFCL_SC_CONFIGURATIONS_CHANGED id1 A3BC0875 id2 D85082E
Triggered each time one or more flight configurations changes. WNF_CFCL_SC_CONFIGURATIONS_DELETED id1 A3BC1075 id2 D85082E
Triggered each time one or more flight configurations is deleted. WNF_CFCL_SC_CONFIGURATIONS_ADDED id1 A3BC1875 id2 D85082E
Triggered each time one or more flight configurations is added. WNF_CONT_RESTORE_FROM_SNAPSHOT_COMPLETE id1 A3BC0875 id2 1588012E
Components blocked waiting for restore from snapshot can now continue WNF_DO_MANAGER_ACTIVE id1 A3BC0875 id2 41C60129
This event triggers when the Delivery Optimization service manager is active or idle WNF_DO_POLICY_CHANGED id1 A3BC1075 id2 41C60129
Delivery Optimization system policy has been updated WNF_DBA_DEVICE_ACCESS_CHANGED id1 A3BC0875 id2 41870C29
This event triggers when the user changes device access for an applocation or the user WNF_SFA_AUTHENTICATION_STAGE_CHANGED id1 A3BC0875 id2 4187083E
This event signals when authentication stage change. WNF_DSM_DSMAPPINSTALLED id1 A3BC0C75 id2 418B1D29
Notification for when an app is installed so we can register a device background task if necessary. WNF_DSM_DSMAPPREMOVED id1 A3BC1475 id2 418B1D29
Notification for when an app is removed so we can clean up any registered device background tasks if necessary. WNF_DMF_MIGRATION_STARTED id1 A3BC0875 id2 41800329
Signals that Migration started. DWORD[1] = {started flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml WNF_DMF_MIGRATION_COMPLETE id1 A3BC1075 id2 41800329
Signals that Migration completed. DWORD[2] = {completed flag, status}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml WNF_DMF_MIGRATION_PROGRESS id1 A3BC1875 id2 41800329
Current Migration state. DWORD[4] = {Phase, Total Phases, Step, Total Steps}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml WNF_DMF_UX_COMPLETE id1 A3BC2075 id2 41800329
Signals when data migration is complete after reboot and update results need to be displayed. DWORD[1] = {completed flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml and DuPostUpdateUX in %SDXROOT%\src\devmgmt\du\packages\UX\UX.pkg.xml and WINCAP_SHELL_EXPERIENCE_COMPOSER in %SDXROOT%\shellcommon\Composable\Core\dll\microsoft-windows-coreshell.wm.xml WNF_DX_STEREO_CONFIG id1 A3BC0C75 id2 41C61629
State stores the current stereo cpl setting. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_MODE_CHANGE_NOTIFICATION id1 A3BC1035 id2 41C61629
Triggered by kernel when mode change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_OCCLUSION_CHANGE_NOTIFICATION id1 A3BC1835 id2 41C61629
Triggered by kernel when any occlusion related OS state change happens. WNF_DX_NETWORK_DISPLAY_STATE_CHANGE_NOTIFICATION id1 A3BC2035 id2 41C61629
Triggered by kernel when the state of a network display device is changed. WNF_DX_MONITOR_CHANGE_NOTIFICATION id1 A3BC2835 id2 41C61629
Triggered by kernel when monitor change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_VIDMM_TRIM_NOTIFICATION id1 A3BC30B5 id2 41C61629
Triggered by kernel when video memory has to be trimmed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_VIDMM_BUDGETCHANGE_NOTIFICATION id1 A3BC3875 id2 41C61629
Triggered by kernel when video memory budget for an application changes. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_HARDWARE_CONTENT_PROTECTION_TILT_NOTIFICATION id1 A3BC4075 id2 41C61629
Triggered by hardware content protection tilt detection. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_INTERNAL_PANEL_DIMENSIONS id1 A3BC4875 id2 41C61629
Stores information about the physical dimensions (in mm) of the integrated panel if available, and 0's if not. WNF_DX_MODERN_OUTPUTDUPLICATION id1 A3BC5035 id2 41C61629
Triggered when a lowbox application starts or stops using OutputDuplication. WNF_DX_DISPLAY_CONFIG_CHANGE_NOTIFICATION id1 A3BC5835 id2 41C61629
Triggered by kernel when a change is made to the display configuration. WNF_DX_DEVICE_REMOVAL id1 A3BC60B5 id2 41C61629
Triggered when a device has been removed for any reason, not just adapter removal. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_DX_MODERN_OUTPUTDUPLICATION_CONTEXTS id1 A3BC6835 id2 41C61629
Triggered when a lowbox application starts or stops using OutputDuplication and provides list of active lowbox contexts WNF_DX_COLOR_PROFILE_CHANGE id1 A3BC7035 id2 41C61629
Triggered when the default color profile for any attached display changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_DX_GPM_TARGET id1 A3BC7875 id2 41C61629
State is used to indicate the process that should be targeted by GPM. WNF_DX_ADAPTER_START id1 A3BC8075 id2 41C61629
Triggered by kernel when a GPU is started. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_ADAPTER_STOP id1 A3BC8875 id2 41C61629
Triggered by kernel when a GPU is stopped. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_DX_SDR_WHITE_LEVEL_CHANGED id1 A3BC9035 id2 41C61629
Triggered by kernel when SDR white level value is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_DX_COLOR_OVERRIDE_STATE_CHANGE id1 A3BC9875 id2 41C61629
Triggered when any of the color overrides are changed for any display. WNF_DX_DISPLAY_COLORIMETRY_DATA_CHANGED id1 A3BCA035 id2 41C61629
Triggered by kernel when colorimetry data is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_DISK_SCRUB_REQUIRED id1 A3BC0875 id2 A950729
This event signals when a disk that requires scrubbing is brought online WNF_DXGK_ADAPTER_TDR_NOTIFICATION id1 A3BC0875 id2 A811629
Triggered by the kernel when any adapter receives a TDR or PNP event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_DXGK_PATH_FAILED_OR_INVALIDATED id1 A3BC1075 id2 A811629
Triggered by the kernel when an active display path asynchronously transitions to either a failed or invalidated state WNF_DNS_ALL_SERVER_TIMEOUT id1 A3BC1075 id2 41950029
When all the DNS Servers Timeout, this event is notified WNF_DWM_RUNNING id1 A3BC0835 id2 418B1929
Triggered when the dwm starts/terminates WNF_DWM_HOLOGRAPHIC_COMPOSITOR_EXCLUSIVE_LOW_FRAMERATE id1 A3BC1035 id2 418B1929
Triggered when exclusive mode apps are presenting at a low framerate to the holographic compositor WNF_DWM_HOLOGRAPHIC_COMPOSITOR_HAS_PROTECTED_CONTENT id1 A3BC1835 id2 418B1929
Triggered when the compositor toggles between not having and having (any) protected content WNF_DWM_HOLOGRAPHIC_COMPOSITOR_LOW_FRAMERATE id1 A3BC2035 id2 418B1929
Triggered when 3D compositor is presenting at a low framerate WNF_DWM_COMPOSITIONCAPABILITIES id1 A3BC2835 id2 418B1929
Triggered when the dwm composition capabilities changes WNF_EAP_APPLICATION_HANDLE id1 A3BC0875 id2 41960F28
State name for holding application window handle of calling UX WNF_EOA_NARRATOR_FOCUS_CHANGE id1 A3BC08F5 id2 41870128
Narrator has moved its focused region WNF_EOA_NARRATOR_RUNNING id1 A3BC1075 id2 41870128
Represents whether Narrator is currently running. A 32-bit unsigned integer with a zero value meaning Narrator is off. WNF_EOA_UISETTINGS_CHANGED id1 A3BC1875 id2 41870128
UISettings have changed. The payload carries an identifier for the particular setting that has changed, such as TextScaleFactor. WNF_EDGE_LAST_NAVIGATED_HOST id1 A3BC08F5 id2 4810A28
This event is fired when a top level frame navigation is complete, the payload contains the host name WNF_EDGE_EXTENSION_INSTALLED id1 A3BC10F5 id2 4810A28
This event is fired when an extension is installed. The payload is the extension id WNF_EDGE_EXTENSION_AVAILABLE id1 A3BC18F5 id2 4810A28
This event is fired on edge open if any extension is installed WNF_EDGE_INPRIVATE_EXTENSION_AVAILABLE id1 A3BC20F5 id2 4810A28
This event is fired on edge open if any extension, supported in InPrivate, is installed WNF_EDP_TAGGED_APP_LAUNCHED id1 A3BC0835 id2 41960A28
The application was launched in the specified mode under the specified Enterprise context. WNF_EDP_IDENTITY_REVOKED id1 A3BC10F5 id2 41960A28
The keys associated with a data protection identity were removed. WNF_EDP_DPL_KEYS_STATE id1 A3BC1875 id2 41960A28
Current state of the Data Protection under Lock private keys WNF_EDP_CLIPBOARD_METADATA_CHANGED id1 A3BC2035 id2 41960A28
Either a copy or override operation occurred, leading to clipboard metadata changes. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201. WNF_EDP_DIALOG_CANCEL id1 A3BC2835 id2 41960A28
An EDP blocking dialog has been canceled programmatically. WNF_EDP_APP_UI_ENTERPRISE_CONTEXT_CHANGED id1 A3BC3035 id2 41960A28
Application UI EDP context has been changed for the process. WNF_EDP_AAD_REAUTH_REQUIRED id1 A3BC3875 id2 41960A28
The AAD token used by EDP has expired. WNF_EDP_ENTERPRISE_CONTEXTS_UPDATED id1 A3BC4475 id2 41960A28
The EDP enterprise contexts have been updated. WNF_EDP_PROCESS_UI_ENFORCEMENT id1 A3BC4875 id2 41960A28
EDP process UI enforcement global state WNF_EDP_PROCESS_TLS_INDEX id1 A3BC50B5 id2 41960A28
EDP thread UI enforcement. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201. WNF_EDP_DPL_KEYS_DROPPING id1 A3BC5875 id2 41960A28
Data Protection under Lock private keys will be dropped from memory shortly. WNF_EDP_MISSING_CREDENTIALS id1 A3BC6075 id2 41960A28
EDP cred service cannot access credentials required WNF_EDP_PURGE_APP_LEARNING_EVT id1 A3BC6875 id2 41960A28
Purge application learning events cache WNF_EDP_CREDENTIALS_UPDATING id1 A3BC7075 id2 41960A28
Cred service is updating user credentials. WNF_EDU_PRINTER_POLICY_CHANGED id1 A3BC0875 id2 41930A28
This event is triggered when an MDM printer policy is changed. WNF_EFS_SERVICE_START id1 A3BC0875 id2 41950828
This event trigger-starts EFS service. WNF_EFS_SOFTWARE_HIVE_AVAILABLE id1 A3BC1075 id2 41950828
EFS service needs to check GP at boot, which requires the SOFTWARE hive in HKLM. This signals its availability when EFS worker thread detects it. WNF_ENTR_DEVICELOCK_POLICY_VALUE_CHANGED id1 A3BC0875 id2 13920028
Current changed policy values represented as bits for the Device Lock policy area. SDDL comes from NgcctnrSvc in %SDXROOT%\src\baseos\prod\packages\ngc\ngc.pkg.xml and ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml, %sdxroot%\onecoreuap\admin\dm\wap\service\dmwappushservice.wm.xml WNF_ENTR_WIFI_POLICY_VALUE_CHANGED id1 A3BC1075 id2 13920028
Current changed policy values represented as bits for the Wifi policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_SYSTEM_POLICY_VALUE_CHANGED id1 A3BC1875 id2 13920028
Current changed policy values represented as bits for the System policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xmlSDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_CONNECTIVITY_POLICY_VALUE_CHANGED id1 A3BC2075 id2 13920028
Current changed policy values represented as bits for the Connectivity policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED id1 A3BC2875 id2 13920028
Current changed policy values represented as bits for the Experience policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ACCOUNTS_POLICY_VALUE_CHANGED id1 A3BC3075 id2 13920028
Current changed policy values represented as bits for the Accounts policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_SECURITY_POLICY_VALUE_CHANGED id1 A3BC3875 id2 13920028
Current changed policy values represented as bits for the Security policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_BROWSER_POLICY_VALUE_CHANGED id1 A3BC4075 id2 13920028
Current changed policy values represented as bits for the Browser policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_UPDATE_POLICY_VALUE_CHANGED id1 A3BC4875 id2 13920028
Current changed policy values represented as bits for the Update policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_CAMERA_POLICY_VALUE_CHANGED id1 A3BC5075 id2 13920028
Current changed policy values represented as bits for the Camera policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_APPLICATIONMANAGEMENT_POLICY_VALUE_CHANGED id1 A3BC5875 id2 13920028
Current changed policy values represented as bits for the ApplicationManagement policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_REQUIRE_DEVICE_ENCRYPTION_POLICY_VALUE_CHANGED id1 A3BC6075 id2 13920028
Current changed security policy RequireDeviceEncryption value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_PUSH_NOTIFICATION_RECEIVED id1 A3BC6875 id2 13920028
An MDM Push notification has been received. SDDL comes from ID_CAP_CSP_DMCLIENT in %SDXROOT%\src\devmgmt\dm\packages\dmapps\dmapps.pkg.xml WNF_ENTR_SEARCH_POLICY_VALUE_CHANGED id1 A3BC7075 id2 13920028
Current changed policy values represented as bits for the Search policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ABOVELOCK_POLICY_VALUE_CHANGED id1 A3BC7875 id2 13920028
Current changed policy values represented as bits for the AboveLock policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ALLOWAPPLICATIONS_POLICY_VALUE_CHANGED id1 A3BC8075 id2 13920028
A Dataprotection AllowApplications provider policy value has changed. WNF_ENTR_EDPENFORCEMENTLEVEL_POLICY_VALUE_CHANGED id1 A3BC8875 id2 13920028
A Dataprotection EDPEnforcementLevel provider policy value has changed. WNF_ENTR_WAP_MESSAGE_FOR_DMWAPPUSHSVC_READY id1 A3BC9075 id2 13920028
A WAP message has been received that dmwappushsvc needs to handle. WNF_ENTR_CONTEXT_STATE_CHANGE id1 A3BC9875 id2 13920028
An enterprise context has changed it's state WNF_ENTR_PUSH_RECEIVED id1 A3BCA075 id2 13920028
An enterprise WNS based push was received WNF_ENTR_ALLOWINPUTPANEL_POLICY_VALUE_CHANGED id1 A3BCA875 id2 13920028
A TextInput AllowInputPanel provider policy value has changed. WNF_ENTR_SEARCH_ALLOW_USING_DIACRITICS id1 A3BCB075 id2 13920028
Allow use of diacritics for indexing. WNF_ENTR_SEARCH_ALWAYS_USE_AUTO_LANG_DETECTION id1 A3BCB875 id2 13920028
Always use automatic language detection when indexing content and properties. WNF_ENTR_SEARCH_DISABLE_REMOVABLE_DRIVE_INDEXING id1 A3BCC075 id2 13920028
Do not allow locations on removable drives to be added to libraries. WNF_ENTR_SEARCH_PREVENT_INDEXING_LOW_DISK_SPACE_MB id1 A3BCC875 id2 13920028
Stop indexing in the event of limited hard drive space. WNF_ENTR_SEARCH_ALLOW_INDEXING_ENCRYPTED_STORES_OR_ITEMS id1 A3BCD075 id2 13920028
Allow indexing of encrypted files. WNF_ENTR_BLUETOOTH_POLICY_VALUE_CHANGED id1 A3BCD875 id2 13920028
Bluetooth policy configuration has changed. SDDL comes from ID_CAP_POLICY_MANAGER in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_EDPNETWORKING_POLICY_VALUE_CHANGED id1 A3BCE075 id2 13920028
A Dataprotection networking policy value has changed. WNF_ENTR_REQUIRE_DPL_POLICY_VALUE_CHANGED id1 A3BCE875 id2 13920028
DataProtection Require Protection Under Lock Config policy change. WNF_ENTR_WINDOWS_DEFENDER_POLICY_VALUE_CHANGED id1 A3BCF075 id2 13920028
Windows Defender policy configuration has changed. WNF_ENTR_ALLOWALLTRUSTEDAPPS_POLICY_VALUE_CHANGED id1 A3BCF875 id2 13920028
ApplicationManagement AllowAllTrustedApps provider policy value has changed. WNF_ENTR_ALLOWSHAREDUSERDATA_POLICY_VALUE_CHANGED id1 A3BD0075 id2 13920028
ApplicationManagement AllowSharedUserAppData provider policy value has changed. WNF_ENTR_RESTRICTAPPTOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD0875 id2 13920028
ApplicationManagement RestrictAppToSystemVolume provider policy value has changed. WNF_ENTR_RESTRICTAPPDATATOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD1075 id2 13920028
ApplicationManagement RestrictAppDataToSystemVolume provider policy value has changed. WNF_ENTR_ALLOWDEVELOPERUNLOCK_POLICY_VALUE_CHANGED id1 A3BD1875 id2 13920028
ApplicationManagement AllowDeveloperUnlock provider policy value has changed. WNF_ENTR_ALLOWUPDATESERVICE_POLICY_VALUE_CHANGED id1 A3BD2075 id2 13920028
Update AllowUpdateService provider policy value has changed. WNF_ENTR_UPDATESERVICEURL_POLICY_VALUE_CHANGED id1 A3BD2875 id2 13920028
Update UpdateServiceUrl provider policy value has changed. WNF_ENTR_ALLOWNONMICROSOFTSIGNEDUPDATE_POLICY_VALUE_CHANGED id1 A3BD3075 id2 13920028
Update AllowNonMicrosoftSignedUpdate provider policy value has changed. WNF_ENTR_ALLOW_WBA_EXECUTION_POLICY_VALUE_CHANGED id1 A3BD3875 id2 13920028
DisableWBA policy value has changed. WNF_ENTR_DOMAIN_NAMES_FOR_EMAIL_SYNC_POLICY_VALUE_CHANGED id1 A3BD4075 id2 13920028
The domains for which email is disabled have changed. WNF_ENTR_ALLOWCELLULARDATAROAMING_POLICY_VALUE_CHANGED id1 A3BD4875 id2 13920028
The AllowCellularDataRoaming policy value has changed. WNF_ENTR_ALLOWCELLULARDATA_POLICY_VALUE_CHANGED id1 A3BD5075 id2 13920028
The AllowCellularData policy value has changed. WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED id1 A3BD5C75 id2 13920028
EDPEnforcementLevel cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201. WNF_ENTR_PROTECTEDDOMAINNAMES_CACHED_POLICY_VALUE_CHANGED id1 A3BD6475 id2 13920028
EnterpriseProtectedDomainNames cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201. WNF_ENTR_ALLOWMESSAGESYNC_POLICY_VALUE_CHANGED id1 A3BD6875 id2 13920028
The AllowMessageSync policy value has changed. WNF_ENTR_DISABLEADVERTISINGID_POLICY_VALUE_CHANGED id1 A3BD7075 id2 13920028
Privacy DisableAdvertisingId policy value has changed. WNF_ENTR_EVALUATE_EDP_CONFIGURATION_STATE id1 A3BD7875 id2 13920028
EnterpriseDataProtection (EDP) state has changed. WNF_ENTR_APPHVSI_CACHED_POLICY_VALUE_CHANGED id1 A3BD8475 id2 13920028
AllowAppHVSI cached policy has changed. WNF_ENTR_NETWORKISOLATION_POLICY_VALUE_CHANGED id1 A3BD8875 id2 13920028
A NetworkIsolation area policy value has changed. WNF_ENTR_EVALUATE_APPHVSI_CONFIGURATION_STATE id1 A3BD9075 id2 13920028
AppHVSI (Hypervisor-based Virtualized Security Isolation) state has changed. WNF_ENTR_EDPSHOWICONS_CACHED_POLICY_VALUE_CHANGED id1 A3BD9C75 id2 13920028
EdpShowIcons policy value has changed. WNF_ENTR_ALLOWWIFI_POLICY_VALUE_CHANGED id1 A3BDB075 id2 13920028
AllowWifi policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ALLOWMANUALWIFICONFIGURATION_POLICY_VALUE_CHANGED id1 A3BDB875 id2 13920028
AllowManualWifiConfiguration policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_SEARCH_ALLOW_INDEXER id1 A3BDC075 id2 13920028
Allow windows indexer. WNF_ENTR_ALLOWWIFIDIRECT_POLICY_VALUE_CHANGED id1 A3BDC875 id2 13920028
AllowWifiDirect policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ALLOWPROJECTIONTOPC_POLICY_VALUE_CHANGED id1 A3BDD075 id2 13920028
AllowProjectionToPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_ALLOWMESSAGE_MMS_POLICY_VALUE_CHANGED id1 A3BDD875 id2 13920028
The AllowMessageMMS policy value has changed. WNF_ENTR_ALLOWMESSAGE_RCS_POLICY_VALUE_CHANGED id1 A3BDE075 id2 13920028
The AllowMessageRCS policy value has changed. WNF_ENTR_EDPSMB_POLICY_VALUE_CHANGED id1 A3BDE875 id2 13920028
SMBAutoEncryptedFileExtensions policy value has changed. WNF_ENTR_APPHVSI_POLICY_VALUE_CHANGED id1 A3BDF075 id2 13920028
Any AppHVSI policy value is changed WNF_ENTR_ALLOWSET24HOURCLOCK_POLICY_VALUE_CHANGED id1 A3BDF875 id2 13920028
The AllowSet24HourClock policy value has changed. WNF_ENTR_ALLOWPROJECTIONFROMPC_POLICY_VALUE_CHANGED id1 A3BE0075 id2 13920028
AllowProjectionFromPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml WNF_ENTR_EXPLOITGUARD_POLICY_VALUE_CHANGED id1 A3BE0875 id2 13920028
The ExploitGuard policy values have changed. WNF_ENTR_WINDOWSDEFENDERSECURITYCENTER_POLICY_VALUE_CHANGED id1 A3BE1075 id2 13920028
The WindowsDefenderSecurityCenter policy values have changed. WNF_ENTR_APPPRIVACY_POLICY_VALUE_CHANGED id1 A3BE1875 id2 13920028
Event fired when app privacy policy values have changed WNF_ENTR_ENABLETOUCHKEYBOARDAUTOINVOKE_POLICY_VALUE_CHANGED id1 A3BE2075 id2 13920028
A TextInput EnableTouchKeyboardAutoInvokeInDesktopMode policy value has changed. WNF_ENTR_FULLLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE2875 id2 13920028
A TextInput TouchKeyboardFullModeAvailability policy value has changed. WNF_ENTR_WIDELAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3075 id2 13920028
A TextInput TouchKeyboardWideModeAvailability policy value has changed. WNF_ENTR_NARROWLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3875 id2 13920028
A TextInput TouchKeyboardNarrowModeAvailability policy value has changed. WNF_ENTR_HANDWRITING_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4075 id2 13920028
A TextInput TouchKeyboardHandwritingModeAvailability policy value has changed. WNF_ENTR_SPLITLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4875 id2 13920028
A TextInput TouchKeyboardSplitModeAvailability policy value has changed. WNF_ENTR_EMOJI_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE5075 id2 13920028
A TextInput TouchKeyboardEmojiButtonAvailability policy value has changed. WNF_ENTR_FORCEDOCKED_TOUCHKEYBOARD_POLICY_VALUE_CHANGED id1 A3BE5875 id2 13920028
A TextInput ForceTouchKeyboardDockedState policy value has changed. WNF_ENTR_TOUCHKEYBOARDDICTATION_POLICY_VALUE_CHANGED id1 A3BE6075 id2 13920028
A TextInput TouchKeyboardDictationButtonAvailability policy value has changed. WNF_ENTR_BITS_POLICY_VALUE_CHANGED id1 A3BE6875 id2 13920028
BITS policy area value has changed. WNF_ETW_SUBSYSTEM_INITIALIZED id1 A3BC0875 id2 41911A28
ETW subsystem initialized WNF_EXEC_OSTASKCOMPLETION_REVOKED id1 A3BC0875 id2 2831628
This event signal when a task completion has been revoked due to memory pressure WNF_EXEC_THERMAL_LIMITER_CLOSE_APPLICATION_VIEWS id1 A3BC1875 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates all application views should be closed WNF_EXEC_THERMAL_LIMITER_TERMINATE_BACKGROUND_TASKS id1 A3BC2075 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates background tasks should be terminated WNF_EXEC_THERMAL_LIMITER_DISPLAY_WARNING id1 A3BC2875 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates a warning should be displayed to the user WNF_EXEC_THERMAL_LIMITER_STOP_MRC id1 A3BC3075 id2 2831628
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates MRC should be stopped WNF_WFS_SETTINGS id1 A3BC0875 id2 4195083A
Family Safety settings have changed in the cloud service but have not been downloaded and committed WNF_WFS_TIMEREMAININGALERTS id1 A3BC1075 id2 4195083A
Family Safety time remaining alerts to warn the user the allocated time is running out. The data is published as json blob with fileds U.SID for User SID as wide character and TR for time remaining in minutes as int value WNF_WFS_FAMILYMEMBERLOGIN id1 A3BC1875 id2 4195083A
Family member login event WNF_WFS_SETTINGSREFRESH id1 A3BC2075 id2 4195083A
Family Safety settings have changed and have downloaded and committed. Clients should refresh Family Safety settings. WNF_FDBK_QUESTION_NOTIFICATION id1 A3BC0875 id2 A840A2B
This event contains a feedback question for the user. Payload is a JSON string specifying the feedback question. WNF_WFAS_FIREWALL_NETWORK_CHANGE_READY id1 A3BC0875 id2 1287083A
Free network available or not WNF_FLYT_IDS_CHANGED id1 A3BC0875 id2 159F022B
Triggered every time there is a change in flight IDs WNF_FLTN_WNF_ARRIVED id1 A3BC0875 id2 F92022B
Triggered every time upon WNS notification or policy change WNF_FLT_RUNDOWN_WAIT id1 A3BC0875 id2 4192022B
Wait for rundown release in Filter Manager may be blocked by a suspended Modern application WNF_FOD_STATE_CHANGE id1 A3BC0875 id2 4182012B
Installation status of Features on demand WNF_FSRL_TIERED_VOLUME_DETECTED id1 A3BC0875 id2 D941D2B
This event signals when a tiered volume is mounted WNF_FSRL_OPLOCK_BREAK id1 A3BC1075 id2 D941D2B
Oplock break acknowledgement may be blocked by a suspended Modern application WNF_GC_INITIAL_PRESENT id1 A3BC0875 id2 41C60D2A
This event is signalled when the graphics driver presents the initial frame. WNF_GIP_ADAPTER_CHANGE id1 A3BC0875 id2 4196072A
This event is fired for GIP adapter state change, such as connect/disconnect WNF_LOC_DEVICE_BROKER_ACCESS_CHANGED id1 A3BC0875 id2 41850121
This event triggers when the user changes Geolocation access for an application or the user. WNF_LOC_RESERVED_WNF_EVENT id1 A3BC1075 id2 41850121
Do not use this WNF event, it is deprecated. Was WIN32_API_ACCESS_CHANGED. WNF_LOC_SHOW_SYSTRAY id1 A3BC1875 id2 41850121
This event triggers when there is an event that accesses location data -- this trigger starts LocationNotifications.exe which is a systray app. WNF_LFS_STATE id1 A3BC0875 id2 41950821
This is triggered when an app is making use of the location service. It has two possible data values associated to it: BOOL TRUE: one or more applications are using location. BOOL FALSE: no application is using location. WNF_LFS_RUNNING_STATE id1 A3BC1075 id2 41950821
This state is used to notify when the location service starts or stops running WNF_LFS_MASTERSWITCH_STATE id1 A3BC1875 id2 41950821
This state is used to notify when the phone location master switch status changes with BOOL as payload. TRUE indicating master switch is ON and FALSE indicating master switch is OFF WNF_LFS_GEOFENCETRACKING_STATE id1 A3BC2075 id2 41950821
This state is used to notify Geofence tracking state for the geofences added by the applications. TRUE if atleast one geofence is actively being tracked and FALSE if there are no geofences being tracked. WNF_LFS_RESERVED_WNF_EVENT_2 id1 A3BC2875 id2 41950821
Do not use this WNF event, it is deprecated. Was WNF_LFS_BACKGROUND_PERMISSIONCHANGE_STATE WNF_LFS_POSITION_AVAILABLE id1 A3BC3075 id2 41950821
This state is used to notify when a new freely available position can be queried from the location framework. WNF_LFS_CLIENT_RECALCULATE_PERMISSIONS id1 A3BC3875 id2 41950821
This state is published whenever the permissions of an active client have changed. Every client on the system receives it, and should run domain-specific logic to see what the impact is (e.g., reconnect location session when permission re-allowed). WNF_LFS_PERMISSION_TO_SHOW_ICON_CHANGED id1 A3BC4075 id2 41950821
This event notifies when the permission regarding the ability to show the location notification icon has changed. The current state needs to be queried for as it is different for each user. WNF_LFS_ACTION_DIALOG_AVAILABLE id1 A3BC4875 id2 41950821
This event notifies when a new action dialog is available WNF_LFS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5075 id2 41950821
This event notifies when there's a significant change in the location of the device. WNF_LFS_VISITS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5875 id2 41950821
This event notifies when there's a visit or a significant change in the location of the device. WNF_LFS_LOCATION_MDM_AREA_POLICY_CHANGED id1 A3BC6075 id2 41950821
This event is fired when an MDM Location policy change occurs. WNF_LFS_LOCATION_MDM_POLICY_ENABLELOCATION_CHANGED id1 A3BC6875 id2 41950821
This event is fired when an MDM EnableLocation policy change occurs. WNF_NLS_ACP_CHANGED id1 A3BC0875 id2 41950223
This state is notified when the ANSI codepage changes - The data value is a UINT that indicates the new ANSI codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_OEMCP_CHANGED id1 A3BC1075 id2 41950223
This state is notified when the OEM codepage changes - The data value is a UINT that indicates the new OEM codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_USER_DEFAULT_LOCALE_CHANGED id1 A3BC1835 id2 41950223
This state is notified when the user default locale changes - The data value is an LCID that indicates the new locale. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_USER_UILANG_CHANGED id1 A3BC2035 id2 41950223
This state is notified when the user default UI language changes - The data value is a LANGID that indicates the new UI language. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_LOCALE_INFO_CHANGED id1 A3BC2835 id2 41950223
This state is notified when the locale info changes by means of calling SetLocaleInfo - The data value is a DWORD that indicates the LCTYPE that changed. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_GEOID_CHANGED id1 A3BC3035 id2 41950223
This state is notified when the user Geo ID changes by means of calling SetUserGeoID - The data value is a DWORD that indicates the new GeoID. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_LANG_UPDATE_LAUNCH id1 A3BC3875 id2 41950223
Notification indicating lang update launcher needs to be started. SDDL comes from ID_CAP_EVERYONE, ID_CAP_NTSERVICES and ID_CAP_INPUT_LOCALES in %SDXROOT%\src\uxplat\Input\Packages\InputServer\InputServer.pkg.xml WNF_NLS_SETTINGS_REPLICATOR_LAUNCH id1 A3BC4075 id2 41950223
Notification indicating NLS/MUI user settings replicator needs to be started. - The data value is the replication cookie GUID (binary). SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_NLS_SETTINGS_REPLICATION_COMPLETE id1 A3BC4875 id2 41950223
Notification indicating NLS/MUI user settings replication has completed. - The data value is an HRESULT. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_GLOB_USERPROFILE_LANGLIST_CHANGED id1 A3BC0875 id2 389022A
This state is notified when the globalization user profile has changed via SetUserProfileLanguagesWP. There is nothing in the payload - call GetUserProfileLanguagesWP to get the updated user profile language list. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_GPOL_SYSTEM_CHANGES id1 A3BC0875 id2 D891E2A
System policy has been updated WNF_GPOL_USER_CHANGES id1 A3BC10F5 id2 D891E2A
User policy has been updated WNF_HAS_VERIFY_HEALTH_CERT id1 A3BC0875 id2 41950F25
This event signals a request to get (if needed) and verify Health Certificate with HAS WNF_HOLO_USER_DISPLAY_CONTEXT id1 A3BC0835 id2 E8A0125
Event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext WNF_HOLO_USER_INPUT_CONTEXT id1 A3BC1035 id2 E8A0125
Event raised when the input context changes (ex. from 3D input to 2D Desktop input). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext WNF_HOLO_SHELL_STATE id1 A3BC1835 id2 E8A0125
Event raised when the Holographic Shell running state changes (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState WNF_HOLO_INPUT_FOCUS_CHANGE id1 A3BC2075 id2 E8A0125
This event signals when input focus changes to a different window. Data is a MPCInputFocusChange struct. WNF_HOLO_FORCE_ROOM_BOUNDARY id1 A3BC2835 id2 E8A0125
If payload is non-zero, room boundary is forced to be visible. WNF_HOLO_STREAMING_STATE id1 A3BC3035 id2 E8A0125
This event signals whether streaming is active. Data contains a bool indicating if streaming is active. WNF_HOLO_ROOM_BOUNDARY_DATA_CHANGED id1 A3BC3835 id2 E8A0125
This event signals that the persisted room boundary data has changed. WNF_HOLO_ROOM_BOUNDARY_VISIBILITY id1 A3BC4035 id2 E8A0125
A non-zero payload indicates the room boundary is visible to the user. Writable by DWM and System. WNF_HOLO_SHELL_INPUT_3DSWITCH_DISABLE id1 A3BC4835 id2 E8A0125
This event signals when various input types should be disabled from natively working in the Windows Holographic shell, useful for apps that simulate GGV via mouse and/or gamepad. Data contains a DWORD of bitflags from Windows::Internal::Shell::Holographic::ShellInput3DSwitchDisableFlags. WNF_HOLO_ENVIRONMENT_AUDIO_ASSET id1 A3BC5075 id2 E8A0125
This event contains the file path for the environment app's audio asset, which is used by Triton WNF_HOLO_UNINSTALL_PREPARE id1 A3BC5875 id2 E8A0125
This event signals that it's time for uninstall preparations, which includes shutting down Oasis apps. WNF_HOLO_UNINSTALL_COMPLETE id1 A3BC6075 id2 E8A0125
This event signals that uninstall has finished. Data contains a HRESULT representing uninstall success. WNF_HOLO_SET_SHELL_SPAWN_POINT id1 A3BC6835 id2 E8A0125
This event signals that the shell spawn point should be moved. Data is a DWORD indicating the id of the point that should be set. WNF_HOLO_RETAIL_DEMO_TIMER id1 A3BC7035 id2 E8A0125
Event raised when the Windows Mixed Reality retail demo timer state changes. Data contains a DWORD equivalent to MixedRealityPortal::RetailDemoTimerState. WNF_HOLO_DISPLAY_QUALITY_LEVEL id1 A3BC7835 id2 E8A0125
Event raised when the benchmarked quality level changes. Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:DisplayQualityState WNF_HOLO_UNINSTALL_PREPARE_COMPLETE id1 A3BC8075 id2 E8A0125
This event signals that a HoloCoordinator completed uninstall preparation. WNF_HOLO_SYSTEM_DISPLAY_CONTEXT_CHANGE id1 A3BC8875 id2 E8A0125
System scoped event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext WNF_HOLO_REQUEST_HMD_USE_STATE id1 A3BC9035 id2 E8A0125
This event signals the desire to change the HMD use state (the overrideable internal setting, not the physical presence state reported by the HMD). Meant to be used by non-shell inbox applications to trigger the equivalent of the input switch hotkey. Data contains a DWORD equivalent to a bool; true = HmdUseState::InUse, false = HmdUseState::Idle. WNF_HOLO_REQUEST_HOLOGRAPHIC_ACTIVATION_REALM id1 A3BC9835 id2 E8A0125
This event signals the desire to change the current input foreground to go to the last active 3D window. Meant to be used by non-shell inbox applications to return focus to 3D realm. WNF_HOLO_RESET_IDLE_TIMER id1 A3BCA035 id2 E8A0125
This event signals a reset of the holographic idle timer. Writable by DWM and System. WNF_HOLO_SHELL_STATE_INTERACTIVE_USER id1 A3BCA875 id2 E8A0125
Event raised when the Holographic Shell running state changes on the interactive users session (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState WNF_HOLO_SHARING_SESSION_CONTEXT id1 A3BCB035 id2 E8A0125
This event signals whether sharing session is active. Data contains a name of the data provider. WNF_HOLO_PROJECTION_REQUEST id1 A3BCB835 id2 E8A0125
This event signals a miracast projection to establish. WNF_HOLO_CAPTURE_STATE id1 A3BCC035 id2 E8A0125
This event signals whether recording is active. Data contains a bool indicating if recording is active. WNF_HVL_CPU_MGMT_PARTITION id1 A3BC0875 id2 418A1825
This state signals NTOS has CPU management privileges in the current partition. WNF_HYPV_HOST_WMI_OBJECT_PROVIDER_STATE id1 A3BC0875 id2 17961725
The state of Hyper-V's host-only WMI object provider. WNF_HYPV_HOST_WMI_EVENT_PROVIDER_STATE id1 A3BC1075 id2 17961725
The state of Hyper-V's host-only WMI event provider. WNF_IMSN_MONITORMODECHANGED id1 A3BC0835 id2 F950324
A monitor has changed immersive modes WNF_IMSN_LAUNCHERVISIBILITY id1 A3BC1035 id2 F950324
The immersive launcher's visibility has changed WNF_IMSN_IMMERSIVEMONITORCHANGED id1 A3BC1835 id2 F950324
The monitor the immersive environment is running on has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_IMSN_KILL_LOGICAL_FOCUS id1 A3BC3035 id2 F950324
User-perceived focus has left an edit box. WNF_IMSN_PROJECTIONDISPLAYAVAILABLE id1 A3BC3835 id2 F950324
Projection display availability has changed WNF_IMSN_TRANSPARENCYPOLICY id1 A3BC4035 id2 F950324
The user experience transparency policy stores the global system transparency policy as a DWORD which contains 0 for disabled and 1 for enabled. WNF_IMSN_GLOBALLIGHTSINVALIDATED id1 A3BC4835 id2 F950324
The global/shared lights have changed. WNF_IUIS_SCALE_CHANGED id1 A3BC0835 id2 128F1B24
The immersive UI scale has changed for the current session. WNF_ISM_LAST_USER_ACTIVITY id1 A3BC0835 id2 418B1D24
Last recorded user activity WNF_ISM_INPUT_UPDATE_AFTER_TRACK_INTERVAL id1 A3BC1035 id2 418B1D24
Fires if there is new input after track interval. WNF_ISM_CURSOR_MANAGER_READY id1 A3BC1835 id2 418B1D24
Cursor Manager is initialized. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_ISM_GAMECONTROLLER_ZEPHYRUS_FAULT id1 A3BC2075 id2 418B1D24
This event signals when the Zephyrus controller has encountered a fault that requires a shell notification. WNF_IOT_EMBEDDED_MODE_POLICY_VALUE_CHANGED id1 A3BC0875 id2 41920124
Embedded mode policy value has changed. WNF_IOT_STARTUP_SETTINGS_CHANGED id1 A3BC1075 id2 41920124
settings for the foreground app and/or iot startup type background tasks have changed WNF_LANG_FOD_INSTALLATION_STARTED id1 A3BC0875 id2 6880F21
Installation of language features on demand was started (either through Settings or through installation task). WNF_LED_SETTINGSCHANGED id1 A3BC0875 id2 41820B21
LedAlert settings has changed WNF_LM_PACKAGE_SUSPEND_REQUIRED id1 A3BC0875 id2 41C60321
A running package's license is now invalid and the package must be suspended or terminated. WNF_LM_CONTENT_LICENSE_CHANGED id1 A3BC1075 id2 41C60321
A content license's state has been modified. WNF_LM_ROOT_LICENSE_CHANGED id1 A3BC1875 id2 41C60321
A root license's state has been modified. WNF_LM_OPTIONAL_PACKAGE_SUSPEND_REQUIRED id1 A3BC2075 id2 41C60321
A running optional package's license is lost. WNF_LM_APP_LICENSE_EVENT id1 A3BC2875 id2 41C60321
Multi-purpose event for app license notifications. WNF_LM_OFFLINE_PC_CHANGED id1 A3BC3075 id2 41C60321
A offline pc state has been changed. WNF_LM_LICENSE_REFRESHED id1 A3BC3875 id2 41C60321
Licenses have been refreshed. WNF_LIC_NO_APPLICABLE_LICENSES_FOUND id1 A3BC0875 id2 41850721
Failed to launch the modern app because no valid licenses and leases were found WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_OUT_OF_TOLERANCE id1 A3BC1075 id2 41850721
The device license hardware ID is out of tolerance with the device's hardware ID WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_IN_TOLERANCE id1 A3BC1875 id2 41850721
The hardware ID has changed but is still with in tolerance with the device's hardware ID WNF_LIC_DEVICE_LICENSE_UPDATED id1 A3BC2075 id2 41850721
A new device license with a different device ID was installed WNF_LIC_DEVICE_LICENSE_REMOVED id1 A3BC2875 id2 41850721
The device license was uninstalled WNF_LIC_DEVICE_LICENSE_MISSING id1 A3BC3075 id2 41850721
The required device license was nout found WNF_LIC_INT_DEVICE_LICENSE_EXPIRED id1 A3BC3875 id2 41850721
The integration device license has expired and can no longer be used to verify or decrypt modern app licenses. WNF_LIC_LOCAL_MIGRATED_LICENSES_FOUND id1 A3BC4075 id2 41850721
Found a local migrated license which needs to be refereshed with a store signed license. WNF_LIC_MANAGE_DEVICE_REGISTRATION_AND_REACTIVATION id1 A3BC4875 id2 41850721
The MDM Licensing Device Registration Policy has been refreshed. WNF_OLIC_OS_EDITION_CHANGE id1 A3BC5075 id2 28F0222
OS Edition has changed. WNF_OLIC_OS_LICENSE_POLICY_CHANGE id1 A3BC5875 id2 28F0222
OS Policy has changed. WNF_OLIC_OS_LICENSE_TERMS_ACCEPTED id1 A3BC6075 id2 28F0222
The License Terms can be considered as accepted on this device. WNF_OLIC_OS_LICENSE_NON_GENUINE id1 A3BC6875 id2 28F0222
OS will soon notify user of non-genuine state. WNF_LOGN_EOA_FLYOUT_POSITION id1 A3BC0835 id2 F810121
Indicates where the ease of access flyout should appear in LogonUI and User Oobe, the data type is RECT. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts WNF_LOGN_SLIDE_TO_SHUTDOWN id1 A3BC1035 id2 F810121
Indicates that a shutdown has been triggered via Slide-to-shutdown. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts WNF_LOGN_RETURN_TO_LOCK id1 A3BC1835 id2 F810121
Indicates that user intends to interact with the lock screen (e.g. for Projection or Cortana) and LogonUI should return to the lock screen. WNF_LOGN_PINPAD_VISIBLE id1 A3BC2035 id2 F810121
Indicates that the mobile pinpad is visible. WNF_LOGN_LOCAL_SIGNON id1 A3BC2875 id2 F810121
Indicates logon from local console happened, the data type is a GUID which represents the logged-on credential provider CLSID. The sddl string grants subscribe and publish permission to System WNF_LOGN_CREDENTIAL_TILE_SELECTION_CHANGED id1 A3BC3075 id2 F810121
This event signals when a credential tile has been selected or deselected. WNF_LOGN_SUPPRESS_FINGERPRINT_WAKE id1 A3BC3835 id2 F810121
Indicates that device wake via fingerprint sensor should be disabled. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts, and to App Containers with the userSignInSupport Capability WNF_MAPS_MAPLOADER_PROGRESS id1 A3BC1075 id2 12960F20
Current progress of the MapLoader background engine. WNF_MAPS_MAPLOADER_STATUS_CHANGE id1 A3BC1875 id2 12960F20
The new status of ODML. WNF_MAPS_MAPLOADER_PACKAGE_CHANGE id1 A3BC2075 id2 12960F20
A map package has been added or removed or repositioned in the list. WNF_SYNC_REQUEST_PROBE id1 A3BC0875 id2 288173E
Sync sets this value to request a wifi probe due to SSL error. SDDL comes from ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml WNF_MUR_MEDIA_UI_REQUEST_WLAN id1 A3BC0875 id2 41941B20
Interface to Media-UI-request-State mapping for WLAN (802.1x) interfaces WNF_MUR_MEDIA_UI_REQUEST_LAN id1 A3BC1075 id2 41941B20
Interface to Media-UI-request-State mapping for LAN (802.3) interfaces WNF_MSA_ACCOUNTSTATECHANGE id1 A3BC0835 id2 41871D20
Notification for alerting client apps that the connected account ticketing state has changed WNF_MSA_TPM_AVAILABLE id1 A3BC1475 id2 41871D20
Notification for alerting client apps that the server has reported TPM claims are available in new tickets. Payload is DWORD (enum TpmKeyStateServer) and permanent since it represents device capability needed across reboot. WNF_MSA_TPM_SERVER_CLIENT_KEY_STATE_UPDATED id1 A3BC1875 id2 41871D20
Notification for alerting client apps about the current client and server TPM state for logging and retry logic. Payload is a struct of two DWORDs (enum TpmKeyStateServer, enum TpmKeyStateClient). WNF_MM_BAD_MEMORY_PENDING_REMOVAL id1 A3BC0875 id2 41C60320
This notification is raised when the memory manager is unable to automatically offline a bad memory page WNF_MON_THERMAL_CAP_CHANGED id1 A3BC0875 id2 41880120
Triggered by a monitor device when the thermal limit on brightness is changed. Payload is a MONITOR_THERMAL_BRIGHTNESS_LIMIT_LIST. WNF_MRT_QUALIFIER_CONTRAST_CHANGED id1 A3BC0875 id2 41921C20
This state is notified when the constrast qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml WNF_MRT_QUALIFIER_THEME_CHANGED id1 A3BC1075 id2 41921C20
This state is notified when the theme qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml WNF_MRT_PERSISTENT_QUALIFIER_CHANGED id1 A3BC1C75 id2 41921C20
This state is notified when some persistent qualifier changed its value. Payload is qualifier@package_name with a max length of 512 bytes (256 WCHARs including null terminator). Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers WNF_MRT_MERGE_SYSTEM_PRI_FILES id1 A3BC2075 id2 41921C20
This state is notified when system PRI files are merged. Payload has a max length of 128 bytes (64 WCHARs including null terminator) and consists of 'start [starting timestamp]' or 'done [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers WNF_MRT_SYSTEM_PRI_MERGE id1 A3BC2875 id2 41921C20
This state is notified when a system PRI file is merged. Payload has a max length of 512 bytes (256 WCHARs including null terminator) and consists of either 'start [path] [starting timestamp]' or '{done,skipped} [path] [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_NASV_USER_PRESENT id1 A3BC0835 id2 17950F23
NaAuth User Presence Status WNF_NASV_SERVICE_RUNNING id1 A3BC1075 id2 17950F23
NaAuth Service Running WNF_NASV_USER_AUTHENTICATION id1 A3BC1835 id2 17950F23
NaAuth User Authentication Status WNF_NASV_DYNAMIC_LOCK_BLUETOOTH_STATUS id1 A3BC2075 id2 17950F23
NaAuth Extended Dynamic Lock Status for Bluetooth plugin WNF_NCB_APP_AVAILABLE id1 A3BC0875 id2 41840D23
NCB indication of CCT or Socket Broker Based App availability. WNF_NDIS_ADAPTER_ARRIVAL id1 A3BC0875 id2 128F0A23
NDIS finds a network adapter that needs to be configured by NetSetupSvc. WNF_NDIS_CORRUPTED_STORE id1 A3BC1075 id2 128F0A23
NDIS detects corruption in the binding store. WNF_NLM_VPN_RECONNECT_CHANGE id1 A3BC0875 id2 418B0223
This event is signalled by rasman about reconnect VPN state change and is used by NLM WNF_NLM_INTERNET_PRESENT id1 A3BC1075 id2 418B0223
This event is signalled by NLM when the aggregated network conditions indicate that a connection to the internet is present WNF_NFC_SE_CARD_EMULATION_STATE_CHANGED id1 A3BC0875 id2 41850823
This state is used to notify that the NFC CE policy changed. WNF_PAY_CANMAKEPAYMENT_BROKER_READY id1 A3BC0875 id2 419F0F3D
This state is used to notify that the CanMakePayment background broker is initialized and ready. WNF_NGC_PREGEN_TRIGGER id1 A3BC0875 id2 41850923
This event signals when an caller wants to trigger KeyPregenTask. WNF_NGC_AIKCERT_TRIGGER id1 A3BC1075 id2 41850923
This event signals when an caller wants to trigger AikCertEnrollTask. WNF_NGC_PRO_CSP_POLICY_CHANGED id1 A3BC1875 id2 41850923
This event is fired when a policy change occurs in the NGC Pro CSP. WNF_NGC_PREGEN_DELAY_TRIGGER id1 A3BC2075 id2 41850923
This event signals when an caller wants to trigger KeyPregenTask with some delay. WNF_NGC_GESTURE_AUTHENTICATED id1 A3BC2875 id2 41850923
This event signals when NGC container service (ngcctnrsvc) authenticates a gesture. WNF_NGC_CRYPTO_MDM_POLICY_CHANGED id1 A3BC3075 id2 41850923
This event is fired when an MDM cryptographic policy change occurs. WNF_NGC_CREDENTIAL_REFRESH_REQUIRED id1 A3BC3875 id2 41850923
This event is fired when an activity occurs that requires the NGC PIN cred prov to refresh its credential state. WNF_NGC_PIN_RESET_SCENARIO_STATE_CHANGE id1 A3BC4035 id2 41850923
This event is fired when the state has changed during the PIN reset scenario. WNF_NGC_LAUNCH_PIN_RESET_SCENARIO id1 A3BC4875 id2 41850923
This event is fired from the NGC PIN cred prov to signal that the PIN reset scenario should be launched. WNF_NGC_CREDENTIAL_RESET_EXPERIENCE_ACTIVE id1 A3BC5075 id2 41850923
Boolean state representing whether or not the Credential Reset User Experience is active. WNF_NGC_CONTAINER_CREATED_OR_DELETED id1 A3BC5875 id2 41850923
This event is fired from NGC container service (ngcctnrsvc) when containers are created or deleted. WNF_NGC_LAUNCH_NTH_USER_SCENARIO id1 A3BC6075 id2 41850923
This event is fired from the NGC PIN cred prov to signal that an Nth user scenario should be launched. WNF_NGC_PREGEN_NGCISOCTNR_TRIGGER id1 A3BC6875 id2 41850923
This event triggers the NgcIsoCtnr key pre-gen pool to start generating a key. WNF_NLA_CAPABILITY_CHANGE id1 A3BC0875 id2 41870223
This event is notified when NCSI detects a capability change WNF_NLA_TASK_TRIGGER id1 A3BC1875 id2 41870223
State name triggering WiFiTask from NlaSvc WNF_WPN_USER_PLATFORM_READY id1 A3BC08F5 id2 41881E3A
This WNF state indicates to users of WPN endpoints (except AppEndpoint) that platform is ready to use. This state can also be used to know if WPN platform restarted. WNF_WPN_PLATFORM_INITIALIZED id1 A3BC10F5 id2 41881E3A
This WNF state can be used by first party Apps / Services to determine when WPN platform is ready to handle app related requests like posting toast / tile and getting channel uri. WNF_WPN_SYSTEM_PLATFORM_READY id1 A3BC1875 id2 41881E3A
State indicating that system notification platform has been registered and ready to user. WNF_WPN_USER_IN_SESSION_PLATFORM_READY id1 A3BC2035 id2 41881E3A
This WNF state indicates that USER_PLATFORM_READY was fired for a user in the current session. This is intended to provide a workaround for the inability to use RtlSubscribeWnfStateChangeNotification for a user other than the current process token. A process can register for this WNF and then poll the per-user WNF states under impersonation. WNF_NPSM_SERVICE_STARTED id1 A3BC0875 id2 C951E23
This notification is to indicate that the NPSM service has started up. WNF_NSI_SERVICE_STATUS id1 A3BC0875 id2 418F1D23
NSI service status. The SDDL grants subscribe access to all who have access to NSI RPC interface and subcribe + publish access to NSI service. WNF_CSC_SERVICE_START id1 A3BC0875 id2 41851D2E
CSC Service start trigger WNF_WOSC_ML_MODELS_CHANGED id1 A3BC0875 id2 295013A
Triggered every time there is a change in the OneSettings configuration for machine learning model configurations WNF_WOSC_FEATURE_CONFIGURATION_CHANGED id1 A3BC1075 id2 295013A
Triggered every time there is a change in the OneSettings configuration for Velocity feature configurations WNF_OOBE_SHL_MAGNIFIER_QUERY id1 A3BC0835 id2 4840122
Notification from ISM to OOBE to query the user whether to activate the always-on Magnifier in OOBE WNF_OOBE_SHL_MAGNIFIER_CONFIRM id1 A3BC1035 id2 4840122
Notification from OOBE to ISM whether the user confirms to activate the always-on Magnifier in OOBE WNF_OOBE_SHL_MONITOR_STATE id1 A3BC1875 id2 4840122
Notification to User OOBE monitor on where the progress is WNF_OOBE_SHL_SPEECH_CONTROLLER id1 A3BC2035 id2 4840122
Notification of speech controller state change. Payload is state type plus string of length 512 WNF_OVRD_OVERRIDESCALEUPDATED id1 A3BC0875 id2 5941822
The window's override scale has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_PFG_PEN_FIRST_TAP id1 A3BC0875 id2 4181083D
First Pen Tap Gesture WNF_PFG_PEN_FIRST_DRAG id1 A3BC1075 id2 4181083D
First Pen Drag Gesture WNF_PO_SCENARIO_CHANGE id1 A3BC0875 id2 41C6013D
Sent when the WDI session corresponding to a power scenario changes WNF_PO_COMPOSITE_BATTERY id1 A3BC1075 id2 41C6013D
Sent when the composite battery is updated WNF_PO_POWER_STATE_CHANGE id1 A3BC1875 id2 41C6013D
Sent after WNF_PO_COMPOSITE_BATTERY when batteries are added or removed and when one or more batteries' AC, charging, or discharging states changes WNF_PO_ENERGY_SAVER_STATE id1 A3BC2075 id2 41C6013D
Triggered when Energy Saver state changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_PO_ENERGY_SAVER_SETTING id1 A3BC2875 id2 41C6013D
Triggered when Energy Saver setting changes WNF_PO_ENERGY_SAVER_OVERRIDE id1 A3BC3075 id2 41C6013D
Triggered to indicate Energy Saver override settings WNF_PO_THERMAL_STANDBY id1 A3BC3875 id2 41C6013D
Triggered to indicate CR3 condition WNF_PO_THERMAL_SHUTDOWN_OCCURRED id1 A3BC4075 id2 41C6013D
Sent when the previous shutdown was due to a thermal trip WNF_PO_THERMAL_HIBERNATE_OCCURRED id1 A3BC4875 id2 41C6013D
Sent when the previous hibernate was due to a thermal trip WNF_PO_DISCHARGE_ESTIMATE id1 A3BC5075 id2 41C6013D
Estimated time until full discharge in seconds WNF_PO_DISCHARGE_START_FILETIME id1 A3BC5C75 id2 41C6013D
Filetime of last known start of discharge WNF_PO_CHARGE_ESTIMATE id1 A3BC6075 id2 41C6013D
Estimated time until full charge in seconds WNF_PO_THERMAL_OVERTHROTTLE id1 A3BC6875 id2 41C6013D
Triggered to indicate excessive thermal throttling WNF_PO_USER_AWAY_PREDICTION id1 A3BC7075 id2 41C6013D
Sent to indicate whenever user-away prediction is updated. WNF_PO_DISPLAY_REQUEST_ACTIVE id1 A3BC7835 id2 41C6013D
Sent to indicate whether a display request is active in the current session. WNF_PO_BATTERY_CHARGE_LEVEL id1 A3BC8075 id2 41C6013D
Triggered when battery charge crosses well-known charge level boundaries. WNF_PO_SLEEP_STUDY_USER_PRESENCE_CHANGED id1 A3BC8875 id2 41C6013D
Sent when the global user presence changes. WNF_PO_BACKGROUND_ACTIVITY_POLICY id1 A3BC9075 id2 41C6013D
Sent when the background activity policy changes. WNF_PO_BATTERY_DISCHARGING id1 A3BC9875 id2 41C6013D
Triggered when battery is being discharged, irrespective of AC/DC state of the system. WNF_PO_PRIMARY_DISPLAY_VISIBLE_STATE id1 A3BCA075 id2 41C6013D
Visible state of the primary display as MONITOR_DISPLAY_STATE WNF_PO_PRIMARY_DISPLAY_LOGICAL_STATE id1 A3BCA875 id2 41C6013D
Logical state of the primary display as MONITOR_LOGICAL_DISPLAY_STATE WNF_PO_PREVIOUS_SHUTDOWN_STATE id1 A3BCB075 id2 41C6013D
Sent on every boot to notify previous shutdown state WNF_PO_MODERN_STANDBY_EXIT_INITIATED id1 A3BCB875 id2 41C6013D
Triggered at the start of a transition to exit modern standby WNF_PO_SW_HW_DRIPS_DIVERGENCE id1 A3BCC075 id2 41C6013D
Sent when SW DRIPS is more than HW DRIPS by a specific threshold WNF_PO_DRIPS_DEVICE_CONSTRAINTS_REGISTERED id1 A3BCC875 id2 41C6013D
Sent once platform idle states and associated device constraints have been registered WNF_PO_BASIC_BRIGHTNESS_ENGINE_DISABLED id1 A3BCD075 id2 41C6013D
One time system-wide transition to switch from the basic brightness engine to the high-precision brightness engine. WNF_PO_BRIGHTNESS_ALS_OFFSET id1 A3BCD875 id2 41C6013D
ALS brightness offset consumed by the basic brightness engine. WNF_PO_VIDEO_INITIALIALIZED id1 A3BCE075 id2 41C6013D
Set to TRUE when the video system is initialized. WNF_PO_OVERLAY_POWER_SCHEME_UPDATE id1 A3BCE875 id2 41C6013D
Notification for power-setting overlay scheme change. WNF_PO_CAD_STICKY_DISABLE_CHARGING id1 A3BCF075 id2 41C6013D
Set when an you want IOCTL_CAD_DISABLE_CHARGING to behave in a sticky manner WNF_PO_POWER_BUTTON_STATE id1 A3BCF875 id2 41C6013D
Describes the current state of the power button. WNF_PO_SYSTEM_TIME_CHANGED id1 A3BD0075 id2 41C6013D
Supplies the notification about system time changed. Payload has 2 ULONGLONG for new time and old time. WNF_PO_WEAK_CHARGER id1 A3BD0875 id2 41C6013D
Triggered when a weak charger is detected. Note that there may be several minute delay between when charger is plugged in and when the notification is produced. WNF_PO_PRESLEEP_NOTIFICATION id1 A3BD1075 id2 41C6013D
Triggered several minutes prior to idling to sleep. WNF_PO_INPUT_SUPPRESS_NOTIFICATION id1 A3BD1875 id2 41C6013D
Triggered when device is sourced from battery(DC) with lid closed and no external monitor connected. WNF_PO_WAKE_ON_VOICE_STATE id1 A3BD2075 id2 41C6013D
Sent when wake on voice state changes. WNF_PO_OPPORTUNISTIC_CS id1 A3BD2875 id2 41C6013D
Sent to indicate period of opportunistic connectivity in standby. WNF_PO_INPUT_SUPPRESS_NOTIFICATION_EX id1 A3BD3075 id2 41C6013D
Describes the input suppression state for modern standby system based on power source, lid state, monitor state, external monitor state and system opted-in policy. WNF_PO_BATTERY_CHARGE_LIMITING_MODE id1 A3BD3875 id2 41C6013D
Set to TRUE when one of the battery is in charge limiting mode and FALSE when none of the battery is in charge limiting mode. WNF_PNPA_DEVNODES_CHANGED id1 A3BC0875 id2 96003D
This corresponds to a DBT_DEVNODES_CHANGED message WNF_PNPA_DEVNODES_CHANGED_SESSION id1 A3BC1035 id2 96003D
This corresponds to a DBT_DEVNODES_CHANGED message WNF_PNPA_VOLUMES_CHANGED id1 A3BC1875 id2 96003D
This corresponds to a drive letter arrival/removal message WNF_PNPA_VOLUMES_CHANGED_SESSION id1 A3BC2035 id2 96003D
This corresponds to a drive letter arrival/removal message WNF_PNPA_HARDWAREPROFILES_CHANGED id1 A3BC2875 id2 96003D
This corresponds to a hardware profiles changed message WNF_PNPA_HARDWAREPROFILES_CHANGED_SESSION id1 A3BC3035 id2 96003D
This corresponds to a hardware profiles changed message WNF_PNPA_PORTS_CHANGED id1 A3BC3875 id2 96003D
This corresponds to a ports changes message WNF_PNPA_PORTS_CHANGED_SESSION id1 A3BC4035 id2 96003D
This corresponds to a ports changes message WNF_PNPB_AWAITING_RESPONSE id1 A3BC0875 id2 396003D
This corresponds to kernel PNP waiting synchronously for user-mode clients WNF_PNPC_REBOOT_REQUIRED id1 A3BC0875 id2 296003D
This corresponds to a reboot of the system needs to be performed due to a device installation WNF_PNPC_DEVICE_INSTALL_REQUESTED id1 A3BC1075 id2 296003D
Device installation is requested. WNF_PNPC_CONTAINER_CONFIG_REQUESTED id1 A3BC1875 id2 296003D
A change that requires a device container to be updated has occured. WNF_PROV_TURN_COMPLETE id1 A3BC0875 id2 17891C3D
Fired when a full set of packages are processed. WNF_PROV_TPM_ATTEST_COMPLETE id1 A3BC1075 id2 17891C3D
Fired when TPM, NGC, and MSA all report ready for new tickets to contain the TPM claim. Event contains the HRESULT for the operation. WNF_PROV_AUTOPILOT_PROFILE_AVAILABLE id1 A3BC1875 id2 17891C3D
Fired when an AutoPilot profile is available locally and is non-empty. Event contains the HRESULT for the operation. WNF_PROV_AUTOPILOT_ASYNC_COMPLETE id1 A3BC2075 id2 17891C3D
Fired when the AutoPilot profile manager completes and is ready to unload. WNF_PROV_AUTOPILOT_TPM_MSA_TRIGGER id1 A3BC2875 id2 17891C3D
Fired when the AutoPilot profile manager determines that the MSA client may need to update TPM state WNF_PROV_DEVICE_BOOTSTRAP_COMPLETE id1 A3BC3075 id2 17891C3D
Fired when the Server provisioning in the blocking Device Bootstrap page of commercial OOBE is complete. Data passed in is a DWORD. 0x1, if Bootstrap is complete. WNF_DEVM_PROVISIONING_COMPLETE id1 A3BC0875 id2 C900B29
State of boot provisioning tasks. Set to 1 when provisioning is complete. SDDL comes from ID_CAP_PHONEPROVISIONER_EVENTS and PhoneProvisioner in %SDXROOT%\src\devmgmt\dm\packages\provisioning\provisioning.pkg.xml and MvProvisionHost in %SDXROOT%\src\devmgmt\dm\packages\multivariant\multivariant.pkg.xml WNF_DEVM_DMWAPPUSHSVC_READY id1 A3BC1875 id2 C900B29
Multivariant is ready to deliver SMS messages to RILAdaptation (or any registered recipient) WNF_DEVM_MULTIVARIANT_PROVISIONING_SESSIONS id1 A3BC3075 id2 C900B29
Multivariant provisioning session status (per slot). Everyone (WD) can subscribe, but just Local System and Admin can publish (SY, BA). WNF_PS_WAKE_CHARGE_RESOURCE_POLICY id1 A3BC0875 id2 41C61D3D
This corresponds to an application that has eclipsed job wake charge resource policy WNF_PTI_WNS_RECEIVED id1 A3BC0875 id2 418F1A3D
A WNS notification has been received and the Push To Install service should process it. WNF_SRC_SYSTEM_RADIO_CHANGED id1 A3BC0875 id2 41851C3E
This event signals when system radio is changed WNF_RDR_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC0875 id2 41940A3F
This event signals when the client didn't discover SMB1 usage for a specific period WNF_RM_MEMORY_MONITOR_USAGE_LEVEL id1 A3BC0875 id2 41C6033F
Supplies the current RM memory monitor memory usage level. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_RM_GAME_MODE_ACTIVE id1 A3BC1075 id2 41C6033F
Supplies the process ID of the current game mode recipient, or 0 if no recipient is active WNF_RM_QUIET_MODE id1 A3BC1875 id2 41C6033F
Supplies the current quiet mode state as recorded by central resource manager WNF_HAM_SYSTEM_STATE_CHANGED id1 A3BC0875 id2 418B0F25
Supplies the current state of the system as recorded by the system state tracker WNF_RPCF_FWMAN_RUNNING id1 A3BC0875 id2 7851E3F
This event signals when the RPC firewall manager is initialized WNF_RTDS_RPC_INTERFACE_TRIGGER_CHANGED id1 A3BC0875 id2 12821A3F
An RPC service trigger has been added or removed WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED id1 A3BC1875 id2 12821A3F
A named pipe service trigger has been added or removed WNF_SCM_AUTOSTART_STATE id1 A3BC0875 id2 418B0D3E
This event triggers to indicate SCM autostart state WNF_SBS_UPDATE_AVAILABLE id1 A3BC0875 id2 41950C3E
This event signals that there is an update available to the Secure Boot variables. WNF_WSC_SECURITY_CENTER_USER_NOTIFICATION id1 A3BC0875 id2 41851D3A
A notification dialog should be shown to the user. WNF_SDO_ORIENTATION_CHANGE id1 A3BC0875 id2 41890A3E
This event triggers when there is a simple device orientation change. It's data value is one of the SimpleDeviceOrientation enum values. Rights: SensorService can publish, Everyone can subscribe. WNF_DEP_OOBE_COMPLETE id1 A3BC0C75 id2 41960B29
This event triggers when the system has completed OOBE (Windows Welcome) WNF_DEP_UNINSTALL_DISABLED id1 A3BC1475 id2 41960B29
This event triggers when the Uninstall of the system has been disabled WNF_SHEL_IMMERSIVE_SHELL_RUNNING id1 A3BC0875 id2 D83063E
This event signals when the Immersive Shell is started WNF_SHEL_NOTIFICATIONS id1 A3BC1035 id2 D83063E
Set to 0 or more to indicate whether there are any unseen notifications in the notification center. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable the notification on OneCore WNF_SHEL_LOGON_COMPLETE id1 A3BC1875 id2 D83063E
This system-scope event is signaled each time a user's desktop becomes ready. Consider using WNF_SHEL_SESSION_LOGON_COMPLETE for a session-scoped version. WNF_SHEL_OOBE_USER_LOGON_COMPLETE id1 A3BC2475 id2 D83063E
This event signals when logon of the first user after OOBE is complete. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed access. WNF_SHEL_VEEVENT_DISPATCHER_CLIENT_PIPE_CLOSED id1 A3BC2875 id2 D83063E
TDL dispatcher pipe has been closed WNF_SHEL_TILECHANGE id1 A3BC3075 id2 D83063E
This event is signalled when there is a tile change to a background task WNF_SHEL_NOTIFICATION_SETTINGS_CHANGED id1 A3BC3835 id2 D83063E
Event signals when toast notification settings have changed. WNF_SHEL_SOFTLANDING_RULE_TRIGGERED id1 A3BC4075 id2 D83063E
This event signals when a SoftLanding rule is triggered WNF_SHEL_START_LAYOUT_READY id1 A3BC4875 id2 D83063E
This event signals when Start Experience Host completes loading the Start menu layout WNF_SHEL_APPRESOLVER_SCAN id1 A3BC5075 id2 D83063E
Event signals a full app resolver scan has been invoked. WNF_SHEL_LOCKSCREEN_ACTIVE id1 A3BC5835 id2 D83063E
Set to 0 or 1 to indicate whether the lock screen is active. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and system can write. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write. WNF_SHEL_START_APPLIFECYCLE_INSTALL_FINISHED id1 A3BC6075 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_INSTALL_FINISHED event from TDL WNF_SHEL_START_APPLIFECYCLE_DOWNLOAD_STARTED id1 A3BC6875 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_DOWNLOAD_STARTED event from TDL WNF_SHEL_APPLICATION_STATE_UPDATE id1 A3BC7075 id2 D83063E
Event is for the shell to notify when app layout state is changed. Payload is ShellApplicationStateWnf struct. WNF_SHEL_FOCUS_CHANGE id1 A3BC7875 id2 D83063E
This event signals when focus changes to a different process, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile. WNF_SHEL_GAMECONTROLLER_LISTENER_INFO id1 A3BC8075 id2 D83063E
This event signals to toggle exclusive gamepad listening on and off, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile. WNF_SHEL_GAMECONTROLLER_FOCUS_INFO id1 A3BC8875 id2 D83063E
This event signals to toggle exclusive gamepad input on and off WNF_SHEL_ENTERPRISE_START_LAYOUT_POLICY_VALUE_CHANGED id1 A3BC9475 id2 D83063E
This even signals when Start layout MDM policy has been applied WNF_SHEL_CORTANA_APPINDEX_UPDATED id1 A3BC9875 id2 D83063E
Event signals when the apps have been pushed to the indexer has completed WNF_SHEL_SOFTLANDING_RULES_UPDATED id1 A3BCA075 id2 D83063E
This event signals when SoftLanding rules folder is updated WNF_SHEL_NOTIFICATIONS_CRITICAL id1 A3BCA835 id2 D83063E
This event signals that a critical notification such as an incoming call was posted. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable notification on OneCore WNF_SHEL_START_VISIBILITY_CHANGED id1 A3BCB035 id2 D83063E
This event signals when Start visibility changes WNF_SHEL_TRAY_SEARCHBOX_VISIBILITY_CHANGED id1 A3BCB875 id2 D83063E
Set to 0 or 1 to indicate whether the searchbox is visibile in the tray. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write. WNF_SHEL_DEVICE_UNLOCKED id1 A3BCC075 id2 D83063E
This event signals that the device is unlocked in the current session WNF_SHEL_PLACES_CHANGED id1 A3BCC875 id2 D83063E
This event signals the changes in places' database (clientgraph) WNF_SHEL_SUSPEND_APP_BACKGROUND_ACTIVITY id1 A3BCD075 id2 D83063E
Event is for the shell to notify when app background activity should be suspended. Payload is DWORD set to 1 or 0. WNF_SHEL_CREATIVE_EVENT_TRIGGERED id1 A3BCD875 id2 D83063E
This event signals a creative event has been triggered WNF_SHEL_JUMPLIST_CHANGED id1 A3BCE075 id2 D83063E
Event signals that the jumplist for an app has changed. Payload is a struct containing the current sessionId as well as a string representing the aumid of the app whose jumplist was updated. WNF_SHEL_START_APPLIFECYCLE_UNINSTALL_FINISHED id1 A3BCE875 id2 D83063E
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_UNINSTALL_FINISHED event from TDL WNF_SHEL_GAMECONTROLLER_NEXUS_INFO id1 A3BCF075 id2 D83063E
This event signals whenever the nexus button policy changes. WNF_SHEL_SETTINGS_CHANGED id1 A3BCF875 id2 D83063E
This event signals when a settings toggle has changed WNF_SHEL_TOAST_PUBLISHED id1 A3BD0035 id2 D83063E
This event signals when a new toast is published WNF_SHEL_SOFTLANDING_PUBLISHED id1 A3BD0835 id2 D83063E
This event signals when a new soft landing tip is published WNF_SHEL_REQUEST_CORTANA_SETTINGSCONSTRAINTINDEX_BUILD id1 A3BD1075 id2 D83063E
Event signals when an app requests cortana to build the settings constraint index WNF_SHEL_DICTATION_RUNNING id1 A3BD1835 id2 D83063E
This is the state of dictation. SDDL comes from dwm.exe in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml and WPNarrator in %SDXROOT%\src\media\apps\packages\Apps\WPNarrator.pkg.xml. And Phone DefApps group is required too. WNF_SHEL_DDC_COMMAND_AVAILABLE id1 A3BD2075 id2 D83063E
This event signals when a parsed command is ready for processing WNF_SHEL_DDC_WNS_COMMAND id1 A3BD2875 id2 D83063E
This event signals when a command has been delivered via WNS WNF_SHEL_DDC_SMS_COMMAND id1 A3BD3075 id2 D83063E
This event signals when a command has been delivered via SMS WNF_SHEL_DEVICE_LOCKED id1 A3BD3875 id2 D83063E
This event signals that the device is locked in the current session WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_ACTIVATED id1 A3BD4075 id2 D83063E
This event signals a subscription has been activated. WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_UPDATED id1 A3BD4875 id2 D83063E
This event signals the content of one or more subscriptions has been updated. WNF_SHEL_LOCKSCREEN_IMAGE_CHANGED id1 A3BD5075 id2 D83063E
This event signals that lock screen image had changed. It contains the user sid whose image was changed WNF_SHEL_SCREEN_COVERED id1 A3BD5875 id2 D83063E
Set to 0 (uncovered or unknown) or 1 (covered). WNF_SHEL_DDC_CONNECTED_ACCOUNTS_CHANGED id1 A3BD6075 id2 D83063E
This event signals when connected accounts have changed and register device should be called WNF_SHEL_OOBE_ENABLE_PROVISIONING id1 A3BD6835 id2 D83063E
This event signals when OOBE in a Shell should enable its provisioning flow WNF_SHEL_LOCK_APP_SHOWN id1 A3BD7035 id2 D83063E
This event signals that the Lock application has been presented to the user. It contains an instance cookie as specified from LogonUI. WNF_SHEL_LOCK_APP_REQUESTING_UNLOCK id1 A3BD7835 id2 D83063E
This event signals that the Lock application is requesting to unlock so the user can enter credentials. WNF_SHEL_TILEINSTALL id1 A3BD8075 id2 D83063E
This event is signalled when there is a tile install to a background task WNF_SHEL_TILEUPDATE id1 A3BD8875 id2 D83063E
This event is signalled when there is a tile update to a background task WNF_SHEL_TILEUNINSTALL id1 A3BD9075 id2 D83063E
This event is signalled when there is a tile uninstall to a background task WNF_SHEL_ABOVE_LOCK_APP_ACTIVE id1 A3BD9835 id2 D83063E
This event is signalled when there is an app launched (1) or terminated (0) above lock. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed full access, while all other app containers have read access. WNF_SHEL_RADIALCONTROLLER_EXPERIENCE_RESTART id1 A3BDA035 id2 D83063E
This event is signalled when the RadialController Experience has restarted to allow registered API component to re-establish connection and repopulate state WNF_SHEL_ABOVE_LOCK_BIO_ACTIVE id1 A3BDA835 id2 D83063E
This event is signalled when there is bio feedback active (1) or inactive (0) above lock WNF_SHEL_CORTANA_SPEECH_CANCELHANDSFREE_REQUESTED id1 A3BDB035 id2 D83063E
This event can be signalled when a handsfree device needs to request Cortana to cancel speech activity. WNF_SHEL_CALM_DISPLAY_ACTIVE id1 A3BDB875 id2 D83063E
Set to 0 (inactive) or 1 (active). WNF_SHEL_INSTALL_PLACEHOLDER_TILES id1 A3BDC075 id2 D83063E
This event signals a start layout change to a background task so that assets can be retrieved if necessary. Payload is PlaceholderTileWnf. WNF_SHEL_PEOPLE_PINNED_LIST_CHANGED id1 A3BDC835 id2 D83063E
This event is signalled when there is a change to the Pinned People list WNF_SHEL_LOCKSTATE id1 A3BDD075 id2 D83063E
Current lock state of the device. Payload is DEVICE_LOCKSTATE. On multisession SKUs, everyone can read while only SYSTEM can write. On single session SKUs, everyone can read while only DefaultAccount can write. On single session SKUs, also include allow list from the SDDL for DEVICE_LOCK_STATE. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write. WNF_SHEL_APPLICATION_SPATIAL_INFO_UPDATE id1 A3BDD875 id2 D83063E
Event is for the shell to notify when app spatial information has changed. Payload is ApplicationSpatialInformationWnf struct. WNF_SHEL_CORTANA_AUDIO_ACTIVE id1 A3BDE075 id2 D83063E
Indicates the state of Cortana speech input and output. WNF_SHEL_LOCKSCREEN_INFO_UPDATED id1 A3BDE835 id2 D83063E
This event signals that the LockScreen info is updated. WNF_SHEL_CDM_FEATURE_CONFIG_FIRST_USAGE id1 A3BDF875 id2 D83063E
This event notifies the CDM when a new feature configuration is first used. The SDDL is scoped to AuthenticatedUsers, AppContainers and LPACs (CAPABILITY_SID_LpacAppExperience) WNF_SHEL_APPLICATION_STARTED id1 A3BE0075 id2 D83063E
This event is signals when an application launches. The Payload is the appID. WNF_SHEL_APPLICATION_TERMINATED id1 A3BE0875 id2 D83063E
This event is signals when an application is terminated. The Payload is the appID. WNF_SHEL_WINDOWSTIP_CONTENT_PUBLISHED id1 A3BE10F5 id2 D83063E
This event is signals when a request is made to show a Windows Tip bubble. The Payload is the content id(String). WNF_SHEL_USER_IDLE id1 A3BE1875 id2 D83063E
This event signals when the first time a user is idle after logon. The payload is the time the user has been idled for WNF_SHEL_PEOPLE_PANE_VIEW_CHANGED id1 A3BE2035 id2 D83063E
This event is signalled when there is a change to the People Pane Views WNF_SHEL_LOCK_APP_RELOCK id1 A3BE2835 id2 D83063E
This event signals that the lock screen should be reset due to a re-lock request. WNF_SHEL_LOCK_APP_READY id1 A3BE3035 id2 D83063E
This event signals that the lock screen is ready after a reset was requested. WNF_SHEL_SESSION_LOGON_COMPLETE id1 A3BE3835 id2 D83063E
This event is scoped to the user session and signaled when the desktop is ready after a logon WNF_SHEL_HEALTH_STATE_CHANGED id1 A3BE4075 id2 D83063E
This event signals when the health state of the device changes WNF_SHEL_CONTENT_DELIVERY_MANAGER_NEEDS_REMEDIATION id1 A3BE4875 id2 D83063E
This event signals that Content Delivery Manager content needs remediation WNF_SHEL_DESKTOP_APPLICATION_STARTED id1 A3BE5075 id2 D83063E
This event is signals when a desktop application launches. The Payload is the executable name. WNF_SHEL_DESKTOP_APPLICATION_TERMINATED id1 A3BE5875 id2 D83063E
This event is signals when a desktop application is terminated. The Payload is the executable name. WNF_SHEL_SUGGESTED_APP_READY id1 A3BE60F5 id2 D83063E
This event signals that the app launched by sign in suggestions is ready. WNF_SHEL_CDM_REGISTRATION_COMPLETE id1 A3BE6835 id2 D83063E
This event is scoped to the user session and signaled when the CDM registration is complete WNF_SHEL_CONTENT_DELIVERY_MANAGER_MONITORING id1 A3BE70F5 id2 D83063E
This event signals that Content Delivery Manager Cache Monitoring is Enabled or not. WNF_SHEL_SIGNAL_LOGONUI id1 A3BE7835 id2 D83063E
Used to signal logon controller across the desktop boundary. Only local system or the composer can read and write. Currently payload is present but ignored. WNF_SHEL_ENTERPRISE_HIDE_PEOPLE_BAR_POLICY_VALUE_CHANGED id1 A3BE8075 id2 D83063E
This event signals when the HidePeopleBar MDM policy has been updated WNF_SHEL_CORTANA_MIC_TRAINING_COMPLETE id1 A3BE88F5 id2 D83063E
This event signals when cortana speech training for 'Respond only to me' is complete WNF_SHEL_CDM_FEATURE_USAGE id1 A3BE9075 id2 D83063E
This event notifies the CDM when a feature configuration is used WNF_SHEL_OOBE_PROVISIONING_COMPLETE id1 A3BE9C75 id2 D83063E
This event signals when OOBE in a Shell has completed its provisioning flow. It is permanent since provisioning is only supported during first user OOBE. WNF_SHEL_SIGNAL_MANAGER_SIGNAL_TRIGGERED id1 A3BEA075 id2 D83063E
This event signals when the signal manager fires a signal WNF_SHEL_CLOUD_FILE_INDEXED_CHANGE id1 A3BEA875 id2 D83063E
Notification is incremented / signaled when a cloudfile state change is detected by the indexer service. Payload is count of changes. User can subscribe, but only service (indexer) can publish WNF_SHEL_CLOUD_FILE_PROGRESS_CHANGE id1 A3BEB075 id2 D83063E
Notification when a sync client or shell session updates in-memory progress within the indexer service. Payload is the tick count when the last change occurred. User can subscribe, but only service (indexer) can publish WNF_SHEL_START_LAYOUT_MIGRATED id1 A3BEB8F5 id2 D83063E
This event signals when Start Experience Host completes a layout migration WNF_SHEL_ENTERPRISE_START_PLACES_POLICY_VALUE_CHANGED id1 A3BEC075 id2 D83063E
This event signals when a Start place MDM policy (AllowPinnedFolder*) has been applied WNF_SHEL_SIGNAL_MANAGER_FEATURE_TRIGGERED id1 A3BEC875 id2 D83063E
This event is used by the Signal Manager for WIL Feature Usage subscriptions required by registered signal triggers. WNF_SHEL_ACTIONCENTER_VIEWSTATE_CHANGED id1 A3BED035 id2 D83063E
This event signals the current view state of action center. WNF_SHEL_CACHED_CLOUD_NETWORK_STATE id1 A3BED875 id2 D83063E
State of the network as reflected by shell32 listeners. Subscribed to, and published from, explorer.exe, a user process. WNF_SHEL_SIGNAL_MANAGER_TESTING id1 A3BEE075 id2 D83063E
This wnf is used for testing purposes. WNF_SHEL_APPLIFECYCLE_INSTALL_STATE id1 A3BEE875 id2 D83063E
This event signals for different app install state from the Store. The Payload is the aumId and app state. WNF_SHEL_RESTORE_PAYLOAD_COMPLETE id1 A3BEF075 id2 D83063E
CDS restore payload data is downloaded during OOBE WNF_SHEL_LATEST_CONNECTED_AUTOPLAY_DEVICE id1 A3BEF875 id2 D83063E
This wnf is signaled everytime the user connects an autoplay device. The payload is the device id (VID and PID). WNF_SHEL_CORTANA_QUIET_MOMENT_AT_HOME id1 A3BF0475 id2 D83063E
This wnf is signaled when Cortana's QuietMoment @Home inferred that the user has arrived of left home . WNF_SHEL_CORTANA_BEACON_STATE_CHANGED id1 A3BF1075 id2 D83063E
This wnf is signaled everytime the Action Center/Cortana beacon state changes. Payload is an int mapping to an enum representing the new state. WNF_SHEL_QUIETHOURS_ACTIVE_PROFILE_CHANGED id1 A3BF1C75 id2 D83063E
This wnf is signaled whenever active quiet hours profile/mode changes. The value is the restrictive level of an active profile and the restrictive level is unique per profile WNF_SHEL_LOCK_ON_LOGON id1 A3BF2035 id2 D83063E
This wnf is signaled when WinLogon detects an automatic lock on logon sequence to optimize displaying the user lock screen when the shell is ready. WNF_SHEL_DEVICE_OPEN id1 A3BF2875 id2 D83063E
This wnf indicates for some types of devices if a lid, cover or enclosure around it is closed (zero value) or open (non-zero value). WNF_SHEL_CREATIVE_EVENT_BATTERY_SAVER_OVERRIDE_TRIGGERED id1 A3BF3075 id2 D83063E
This event signals a creative event has been triggered that will allow to run during battery saver WNF_SHEL_START_PROCESS_SUSPENDED_INTERNAL id1 A3BF3835 id2 D83063E
This event allows user-mode services such as Windows Notification Platform to determine when Start is suspended WNF_SHEL_SYSTEMDIALOG_PUBLISHED id1 A3BF4035 id2 D83063E
This event signals when a new System Dialog toast is published WNF_SHEL_SETTINGS_ENVIRONMENT_CHANGED id1 A3BF4875 id2 D83063E
This wnf indicates that a variable in the settings environment has changed. The payload is the current sessionId. WNF_SHEL_QUIET_MOMENT_GAME_MODE_CHANGED id1 A3BF5075 id2 D83063E
This event signals when Quiet Hours game mode state changes WNF_SHEL_NEXT_NOTIFICATION_SINK_SESSION_ID id1 A3BF5875 id2 D83063E
A system-wide unique rolling id for notification controller sink sessions WNF_SHEL_TAB_SHELL_INIT_COMPLETE id1 A3BF6035 id2 D83063E
Event signals Tab Shell component initialization is complete, potentially after an explorer crash. Payload is an incrementing DWORD that can be used to poll if the current objects are new. WNF_SHEL_LOCKAPPHOST_ACTIVE id1 A3BF6835 id2 D83063E
Set to 0 or 1 to indicate whether lockapphost is currently active. Anyone (including apps) can read, system has write access (but on multi-session skus authenticated users also have write access). Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write. WNF_SHEL_CORTANA_CAPABILTIES_CHANGED id1 A3BF7035 id2 D83063E
This wnf indicates that a cortana capabilties have changed. The payload will be the changed capabilties. The below sids are the cortana app and test app sids WNF_SHEL_TASKBAR_PINS_UPDATED id1 A3BF7875 id2 D83063E
This event indicates taskbar pins were updated. The SDDL is scoped to AuthenticatedUsers. WNF_SHEL_WCOS_SESSION_ID id1 A3BF8075 id2 D83063E
This system-scope event is signaled each time the shell attempts to start a local session on WCOS-based SKUs. It carries the latest session ID. Everyone can read from it. Authenticated users can write to it. Apps in general can read from it. Apps with WINCAP_SHELL_EXPERIENCE_COMPOSER can write to it. WNF_SHEL_ASSISTANT_STATE_CHANGE id1 A3BF8875 id2 D83063E
This wnf indicates that the assistant state has changed, e.g Talking, idle, thinking, notification pending etc WNF_SIO_PIN_ENROLLED id1 A3BC0875 id2 4189073E
Used to notify the PIN list that a PIN has been enrolled and that it should refresh. WNF_SIO_BIO_ENROLLED id1 A3BC1075 id2 4189073E
Used to notify the Delay Lock settings that Biometric enrollment has been modified. WNF_SKYD_FILE_SYNC id1 A3BC0875 id2 59F053E
A file has changed on storage and a request is received to sync. WNF_SKYD_QUOTA_CHANGE id1 A3BC1075 id2 59F053E
A user's quota has changed. WNF_SMS_CHECK_ACCESS id1 A3BC0875 id2 4195033E
This event triggers when the user revokes SMS access. WNF_SMSS_MEMORY_COOLING_COMPATIBLE id1 A3BC0875 id2 1295033E
This event triggers when the system has multiple memory channels and memory cooling can be started WNF_SPAC_SPACEPORT_PROPERTY_CHANGED id1 A3BC0875 id2 2871E3E
This notification is issued when a property of an object changes WNF_SPAC_SPACEPORT_WORK_REQUESTED id1 A3BC1075 id2 2871E3E
This notification is issued to request work in user-mode WNF_SPCH_INPUT_STATE_UPDATE id1 A3BC0835 id2 9851E3E
Indicates the state of the shared recognizer. WNF_SPCH_REMOTE_SESSION_REQUEST id1 A3BC1075 id2 9851E3E
Indicates the data pertaining to a remote request to start/stop a speech recognition session. Published by BTAGService and HidSrv WNF_SPCH_DISABLE_KWS_REQUEST id1 A3BC1875 id2 9851E3E
Indicates the KWS request from a remote device. Certain peripherals that support in-built KWS may request the system to disable the KWS runnning on Windows. Published by BTAGService WNF_SRUM_SCREENONSTUDY_SESSION id1 A3BC0875 id2 C931C3E
Sent when a screen on study session starts or ends WNF_SRV_SRV2_STATE_CHANGE id1 A3BC0875 id2 41901C3E
This event signals when the server (SRV2) start/stop WNF_SRV_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC1075 id2 41901C3E
This event signals when the server didn't discover SMB1 usage for a specific period WNF_OSWN_STORAGE_PRESENCE_CHANGE id1 A3BC6075 id2 F911D22
This event indicates a change in the mount state of an SD card. WNF_OSWN_STORAGE_VOLUME_STATUS_CHANGE id1 A3BC6875 id2 F911D22
This event indicates a change in the volume status of an SD card. WNF_OSWN_STORAGE_FREE_SPACE_CHANGE id1 A3BC7075 id2 F911D22
This event indicates a change in the free space state of storage. WNF_OSWN_STORAGE_TEMP_CLEANUP_CHANGE id1 A3BC7875 id2 F911D22
This event indicates a change in the temp file cleanup state of storage. WNF_OSWN_STORAGE_FINISHED_USAGE_CATEGORY_UPDATE id1 A3BCB875 id2 F911D22
This event indicates completion of an update of storage usage categories. WNF_OSWN_SYSTEM_CLOCK_CHANGED id1 A3BC5875 id2 F911D22
This event informs the system tray that the date-time has changed WNF_OSWN_STORAGE_SHELLHWD_EVENT id1 A3BCC075 id2 F911D22
This event informs StorSvc that SHSVCS received a device handle event. WNF_OSWN_STORAGE_APP_PAIRING_CHANGE id1 A3BC8075 id2 F911D22
This event indicates a change in the app pairing state of an SD card. WNF_SUPP_ENABLE_ERROR_DETAILS_CACHE id1 A3BC0875 id2 11961B3E
Enable the Error Details Cache WNF_SYS_SHUTDOWN_IN_PROGRESS id1 A3BC0875 id2 4195173E
The state is published when the system has begun the shutdown or reboot process. WNF_SEB_INTERNET_PRESENT id1 A3BC0875 id2 41840B3E
Internet available or not WNF_SEB_FREE_NETWORK_PRESENT id1 A3BC1075 id2 41840B3E
Free network available or not WNF_SEB_SMS_RECEIVED id1 A3BC1875 id2 41840B3E
SMS has been received WNF_SEB_NETWORK_STATE_CHANGES id1 A3BC2075 id2 41840B3E
Network state has changed WNF_SEB_MBAE_NOTIFICATION_RECEIVED id1 A3BC2875 id2 41840B3E
Radio Operator Message received WNF_SEB_NETWORK_CONTROL_CHANNEL_TRIGGER_RESET id1 A3BC3075 id2 41840B3E
Network control channel triggers have been reset WNF_SEB_TIME_ZONE_CHANGE id1 A3BC3875 id2 41840B3E
Time zone change WNF_SEB_ONLINE_ID_CONNECTED_STATE_CHANGE id1 A3BC4075 id2 41840B3E
Online ID connected state changed. SDDL comes from ID_CAP_EVERYONE in %SDXROOT%\src\baseos\prod\packages\WLId\WLId.pkg.xml WNF_SEB_SYSTEM_IDLE id1 A3BC4875 id2 41840B3E
system is idle or not WNF_SEB_BATTERY_LEVEL id1 A3BC5075 id2 41840B3E
System is idle or not WNF_SEB_DOMAIN_JOINED id1 A3BC5875 id2 41840B3E
System is domain joined or not WNF_SEB_BOOT id1 A3BC6075 id2 41840B3E
System has booted WNF_SEB_USER_PRESENT id1 A3BC6875 id2 41840B3E
System has at least 1 user present WNF_SEB_SYSTEM_AC id1 A3BC7075 id2 41840B3E
System is AC or DC WNF_SEB_MONITOR_ON id1 A3BC7875 id2 41840B3E
Monitor is ON or OFF WNF_SEB_IP_ADDRESS_AVAILABLE id1 A3BC8075 id2 41840B3E
IP address is available or not WNF_SEB_BACKGROUND_WORK_COST_CHANGE id1 A3BC8875 id2 41840B3E
Indicate a change in the background work cost WNF_SEB_BACKGROUND_WORK_COST_HIGH id1 A3BC9075 id2 41840B3E
Background work cost is high or not WNF_SEB_SYSTEM_LPE id1 A3BC9875 id2 41840B3E
System is in Low Power Epoch or not WNF_SEB_SMART_CARD_TRANSACTION_NOTIFICATION id1 A3BCA075 id2 41840B3E
Smart card transaction notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml WNF_SEB_SYSTEM_MAINTENANCE id1 A3BCA875 id2 41840B3E
System is in good state for maintenance WNF_SEB_GEOLOCATION id1 A3BCB075 id2 41840B3E
Geolocation service should be started WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCB875 id2 41840B3E
OEM custom notification received WNF_SEB_MOB_OPERATOR_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCC075 id2 41840B3E
MO custom notification received WNF_SEB_CACHED_FILE_UPDATED id1 A3BCC875 id2 41840B3E
Cached file has updated WNF_SEB_SMART_CARD_FIELD_INFO_NOTIFICATION id1 A3BCD075 id2 41840B3E
Smart card field entry/exit notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml WNF_SEB_SMART_CARD_HCE_APPLICATION_ACTIVATION_NOTIFICATION id1 A3BCD875 id2 41840B3E
Smart card HCE application activation notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml WNF_SEB_DEPRECATED7 id1 A3BCE075 id2 41840B3E
Unused notification WNF_SEB_DEPRECATED8 id1 A3BCE875 id2 41840B3E
Unused notification WNF_SEB_LOW_LATENCY_POWER_REQUEST id1 A3BCF075 id2 41840B3E
Low-latency power request notification WNF_SEB_RESILIENCY_NOTIFICATION_PHASE id1 A3BCF875 id2 41840B3E
Resiliency phase notification WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK id1 A3BD0075 id2 41840B3E
Fullscreen video playback notification WNF_SEB_NFC_PERF_BOOST id1 A3BD0875 id2 41840B3E
Indicates high-performance boost mode for critical NFC background activity WNF_SEB_APP_LAUNCH_PREFETCH id1 A3BD1075 id2 41840B3E
Indicates app launch pre-fetch phase WNF_SEB_DEPRECATED1 id1 A3BD1875 id2 41840B3E
Unused notification WNF_SEB_APP_RESUME id1 A3BD2075 id2 41840B3E
Indicates app resume phase WNF_SEB_DEPRECATED2 id1 A3BD2875 id2 41840B3E
Unused notification WNF_SEB_DEPRECATED3 id1 A3BD3075 id2 41840B3E
Unused notification WNF_SEB_DEPRECATED4 id1 A3BD3875 id2 41840B3E
Unused notification WNF_SEB_DEPRECATED5 id1 A3BD4075 id2 41840B3E
Unused notification WNF_SEB_DEPRECATED6 id1 A3BD4875 id2 41840B3E
Unused notification WNF_SEB_CALL_STATE_CHANGED id1 A3BD5075 id2 41840B3E
Call state change notification WNF_SEB_VOICEMAIL_CHANGED id1 A3BD5875 id2 41840B3E
Voicemail change notification WNF_SEB_CALL_HISTORY_CHANGED id1 A3BD6075 id2 41840B3E
Call history change notification WNF_SEB_LINE_CHANGED id1 A3BD6875 id2 41840B3E
Phone line change notification WNF_SEB_AIRPLANE_MODE_DISABLED_FOR_EMERGENCY_CALL id1 A3BD7075 id2 41840B3E
Airplane mode disabled for emergency call notification WNF_SEB_MOBILE_BROADBAND_REGISTRATION_STATE_CHANGE id1 A3BD7875 id2 41840B3E
Registration state has changed WNF_SEB_MOBILE_BROADBAND_RADIO_STATE_CHANGE id1 A3BD8075 id2 41840B3E
Radio state has changed WNF_SEB_MOBILE_BROADBAND_PIN_LOCK_STATE_CHANGE id1 A3BD8875 id2 41840B3E
Pin lock state has changed WNF_SEB_MOBILE_BROADBAND_DEVICE_SERVICE_NOTIFICATION id1 A3BD9075 id2 41840B3E
Device service command has been received WNF_SEB_DEFAULT_SIGN_IN_ACCOUNT_CHANGE id1 A3BD9875 id2 41840B3E
Default Sign In account has changed WNF_SEB_NETWORK_CONNECTIVITY_IN_STANDBY id1 A3BDA075 id2 41840B3E
Network connectivity in Standby WNF_SEB_USER_PRESENCE_CHANGED id1 A3BDA875 id2 41840B3E
User presence changed WNF_SEB_AUDIO_ACTIVITY id1 A3BDB075 id2 41840B3E
Audio activity in progress WNF_SEB_FULL_SCREEN_HDR_VIDEO_PLAYBACK id1 A3BDB875 id2 41840B3E
Fullscreen HDR video playback notification WNF_SEB_UWP_APP_LAUNCH id1 A3BDC075 id2 41840B3E
Indicates UWP app launch phase WNF_SEB_MOBILE_BROADBAND_PCO_VALUE_CHANGE id1 A3BDC875 id2 41840B3E
Pco data has been received WNF_SEB_MIXED_REALITY id1 A3BDD075 id2 41840B3E
Mixed reality notification WNF_SEB_GAME_MODE id1 A3BDD875 id2 41840B3E
Game mode scenario WNF_SPI_LOGICALDPIOVERRIDE id1 A3BC0835 id2 418F1E3E
Signals a change caused by SystemParametersInfo(SPI_SETLOGICALDPIOVERRIDE). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_SPI_PRIMARY_MONITOR_DPI_CHANGED id1 A3BC1035 id2 418F1E3E
This is triggered when the Primary monitor's DPI is different than the session's DPI. WNF_TMCN_ISTABLETMODE id1 A3BC0835 id2 F850339
The computer has changed density mode. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TEAM_SHELL_HOTKEY_PRESSED id1 A3BC0875 id2 C870B39
Indicates a hotkey was pressed WNF_TEL_STORAGE_CAPACITY id1 A3BE0875 id2 418A0B39
This is fired every time an SENSE's storage fullness crosses into a new tier or is reset. struct { DWORD PercentageFull[4]; } WNF_TEL_DAILY_UPLOAD_QUOTA id1 A3BE1075 id2 418A0B39
This is fired every time an SENSE's daily upload quota crosses into a new tier or is reset. struct { DWORD PercentageFull; } WNF_TEL_ONESETTINGS_UPDATED id1 A3BE1875 id2 418A0B39
This is fired every time a onesettings namespace is updated. {UINT64 SettingsCount; struct {UINT64 NamespaceHash; UINT64 TimeLastChanged;}[16]} WNF_TEL_SETTINGS_PUSH_NOTIFICATION_RECEIVED id1 A3BE2075 id2 418A0B39
This is fired every time a push notification is received from the OneSettings service. UTF8 string. WNF_TEL_TIMER_RECONFIGURED id1 A3BE2875 id2 418A0B39
This is fired every time a UTC service timer changes its configuration values so subscribers can call GetTimerConfiguration to check any new values. WNF_PHN_CALL_STATUS id1 A3BC2875 id2 4188063D
Bitmask containing the current relevant call states. Any 3rd party app is allowed to listen to this. See PhoneWnf.h for valid values. SID referenced below is that of the Phone service. WNF_PHN_CALLFORWARDING_STATUS_LINE0 id1 A3BC3075 id2 4188063D
Bitmask containing the call forwarding state for phone line 0. See PhoneWnf.h for valid values. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml WNF_PHNP_SERVICE_INITIALIZED id1 A3BC3875 id2 1188063D
BOOL indicating whether the Phone service has been initialized. SDDL comes from phoneCall and ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%%\src\src\comms\Packages\CommsPlat\Comms.pkg.xml WNF_PHNP_SIMSEC_READY id1 A3BC4075 id2 1188063D
BOOL indicating whether SimSec is ready to receive requests. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml WNF_PHNP_ANNOTATION_ENDPOINT id1 A3BC4875 id2 1188063D
Wide string indicating the call annotation provider's RPC endpoint name. SDDL comes from ID_CAP_CALLMESSAGING_FILTER and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml WNF_PHNL_LINE1_READY id1 A3BC4075 id2 D88063D
BOOL indicating whether the line is ready. SDDL comes from PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml WNF_TETH_TETHERING_STATE id1 A3BC0875 id2 9920B39
State name for the Tethering service notification of all state changes WNF_TETH_AUTOSTART_BLUETOOTH id1 A3BC1075 id2 9920B39
State name for starting Tethering service over Bluetooth WNF_IME_INPUT_MODE_LABEL id1 A3BC0875 id2 41830324
Input Mode Indicator label IME want to show on systray. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_IME_EXPLICIT_PRIVATE_MODE id1 A3BC1035 id2 41830324
Explicit IME private mode status. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622 WNF_IME_AUTOMATIC_PRIVATE_MODE id1 A3BC1835 id2 41830324
Automatic IME private mode status. WNF_THME_THEME_CHANGED id1 A3BC0875 id2 48B0639
Notifies when the theme of the system changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TZ_LEGACY_STORE_CHANGED id1 A3BC0875 id2 41C61439
Time Zone Legacy store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TZ_STORE_CHANGED id1 A3BC1075 id2 41C61439
Time Zone store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TZ_TIMEZONE_CHANGED id1 A3BC1875 id2 41C61439
This state is notified when the timezone is changed via SetTimeZoneInformationByID - The data value is a UINT that indicates the new TZID. SDDL comes from ID_CAP_BUILTIN_SETTIME, ID_CAP_EVERYONE and tzautoupdate in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml WNF_TZ_LAST_TIME_SYNC_INFO id1 A3BC2075 id2 41C61439
This event has information about last time sync. SDDL comes from autotimesvc's account. WNF_TZ_NETWORK_TIME_SYNC_TRIGGER id1 A3BC2875 id2 41C61439
This event is used to trigger Network Sync. SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml WNF_TZ_AUTOTIMEUPDATE_STATE_CHANGED id1 A3BC3075 id2 41C61439
This state is notified when autotimeupdate state changed. The data value is a DWORD that indicates if autotimeupdate is enabled (1) or disabled (0). SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml WNF_TOPE_INP_POINTER_DEVICE_ACTIVITY id1 A3BC0875 id2 4960139
Touch Event WNF_TKBN_KEYBOARD_VISIBILITY id1 A3BC0835 id2 F840539
The touch keyboard's appearance on the screen has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_RESTRICTED_KEYBOARD_VISIBILITY id1 A3BC1035 id2 F840539
The restricted mode touch keyboard's appearance on the screen has changed. WNF_TKBN_IMMERSIVE_FOCUS_TRACKING id1 A3BC1835 id2 F840539
An immersive application has encountered a focus change. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_TOUCH_EVENT id1 A3BC2035 id2 F840539
An application encountered a touch down/up event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_RESTRICTED_TOUCH_EVENT id1 A3BC2835 id2 F840539
An application encountered a touch down/up event WNF_TKBN_LANGUAGE id1 A3BC3035 id2 F840539
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_FOREGROUND_WINDOW id1 A3BC3835 id2 F840539
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_CARET_TRACKING id1 A3BC4035 id2 F840539
Caret tracking has updated on the desktop. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_AUTOCOMPLETE id1 A3BC4835 id2 F840539
The autocomplete window has been updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_MODERN_KEYBOARD_FOCUS_TRACKING id1 A3BC5035 id2 F840539
Determines whether focus is in an editable field for the purposes of the modern keyboard. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_KEYBOARD_VIEW_CHANGE id1 A3BC5835 id2 F840539
The view being shown by the touch keyboard has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_RESTRICTED_KEYBOARD_VIEW_CHANGE id1 A3BC6035 id2 F840539
The view being shown by the restricted mode touch keyboard has changed. WNF_TKBN_KEYBOARD_GESTURE id1 A3BC6835 id2 F840539
The keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_RESTRICTED_KEYBOARD_GESTURE id1 A3BC7035 id2 F840539
The restricted keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. WNF_TKBN_CANDIDATE_WINDOW_STATE id1 A3BC7835 id2 F840539
The candidate window state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_KEYBOARD_LAYOUT_CHANGE id1 A3BC8035 id2 F840539
The layout being shown by the touch keyboard has changed. WNF_TKBN_RESTRICTED_KEYBOARD_LAYOUT_CHANGE id1 A3BC8835 id2 F840539
The layout being shown by the restricted mode touch keyboard has changed. WNF_TKBN_COMPOSITION_STATE id1 A3BC9035 id2 F840539
The composition state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_SYSTEM_IMMERSIVE_FOCUS_TRACKING id1 A3BC9835 id2 F840539
A System Mode Application(Logon/OOBE) has encountered a focus change WNF_TKBN_SYSTEM_TOUCH_EVENT id1 A3BCA035 id2 F840539
A System Mode application(Logon/OOBE) encountered a touch down/up event WNF_TKBN_INPUT_PANE_DISPLAY_POLICY id1 A3BCA835 id2 F840539
The edit control in focus has changed the input pane display policy (manual/automatic). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_DESKTOP_MODE_AUTO_IHM id1 A3BCB035 id2 F840539
The system is in desktop mode but the user prefers tablet-mode IHM behavior. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_KEYBOARD_SET_VISIBLE id1 A3BCB835 id2 F840539
The touch keyboard should show or hide. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBN_KEYBOARD_SET_VISIBLE_NOTIFICATION id1 A3BCC035 id2 F840539
Update the show/hide status of touch keyboard that is being tracked in tabtip. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_TKBR_CHANGE_SYSTEM id1 A3BC08F5 id2 13840539
This state name is used to notify system components about state changes in the Token Broker WNF_TKBR_CHANGE_APP id1 A3BC1075 id2 13840539
This state name is used to notify apps about state changes in the Token Broker WNF_TKBR_CHANGE_APP_INTERNAL id1 A3BC18F5 id2 13840539
This state name is used to notify apps about state changes in the Token Broker WNF_TPM_OWNERSHIP_TAKEN id1 A3BC0875 id2 418B1E39
This event signals when the Win32_TPM provider has completed taking ownership of the TPM. WNF_TPM_DEVICEID_STATE id1 A3BC1075 id2 418B1E39
This event signals the state of the TPM-based DeviceID. WNF_TPM_PROVISION_TRIGGER id1 A3BC1875 id2 418B1E39
This event triggers the TPM provisioning/status check to run. WNF_TPM_CLEAR_PENDING id1 A3BC2075 id2 418B1E39
This event signals a TPM Clear will be attempted. WNF_TPM_CLEAR_RESULT id1 A3BC2875 id2 418B1E39
This event signals if ownership was taken during TPM Provisioning and the result of TPM Clear on last reboot. WNF_TPM_DISABLE_DEACTIVATE_PENDING id1 A3BC3075 id2 418B1E39
This event signals a TPM Disable or TPM Deactivate will be attempted. WNF_TPM_ENABLE_ACTIVATE_COMPLETED id1 A3BC3875 id2 418B1E39
This event signals after the TPM is Enabled or Activated. WNF_TPM_MAINTENANCE_TASK_STATUS id1 A3BC4075 id2 418B1E39
This event signals the TPM maintenance task status. WNF_UBPM_POWER_SOURCE id1 A3BC0875 id2 C960C38
The machine power source state WNF_UBPM_CONSOLE_MONITOR id1 A3BC1075 id2 C960C38
The machine console monitor on/off state WNF_UBPM_FRMU_ALLOWED id1 A3BC1875 id2 C960C38
The user is present and machine is on batteries and the battery level is above firmware update thershold WNF_UBPM_PRESHUTDOWN_PHASE id1 A3BC2075 id2 C960C38
The machine entered pre shutdown phase WNF_UMDF_WUDFSVC_START id1 A3BC0875 id2 7820338
Trigger the Driver Manager service start WNF_UMDF_DRVMGR_STATUS id1 A3BC1075 id2 7820338
State name indicating the status of the UMDF driver manager WNF_USO_STATE_CHANGE id1 A3BC0875 id2 41891D38
Signals that a state transition occurred for an update session. WNF_USO_STATE_ATTENTION_REQUIRED id1 A3BC1075 id2 41891D38
Signals that a state encounter a condition that requires attention. WNF_USO_UPDATE_PROGRESS id1 A3BC1875 id2 41891D38
Signals the a change in progess of an update session. WNF_USO_REBOOT_REQUIRED id1 A3BC2075 id2 41891D38
Signals that a reboot is required to complete the update session. WNF_USO_ACTIVE_SESSION id1 A3BC2875 id2 41891D38
Signals that the current active session is changed. WNF_USO_UPDATE_SUCCEEDED id1 A3BC3075 id2 41891D38
Signals that updates have installed successfully on lite servicing stack. WNF_USO_UPTODATE_STATUS_CHANGED id1 A3BC3875 id2 41891D38
Signals that the machine's up to date status has changed. WNF_USO_REBOOT_BLOCK_REQUESTED id1 A3BC4075 id2 41891D38
Signals that USO should not reboot the system. WNF_USO_DOWNLOAD_STARTED id1 A3BC4875 id2 41891D38
Signals that update download has started on lite servicing stack. WNF_USO_INSTALL_STARTED id1 A3BC5075 id2 41891D38
Signals that update install has started on lite servicing stack. WNF_USO_INSTALL_STATE id1 A3BC5875 id2 41891D38
Signals various install states on lite servicing stack. WNF_USO_SERVICE_STOPPING id1 A3BC6075 id2 41891D38
Signals that USO is stopping. WNF_USO_SETTINGS_REFRESHED id1 A3BC6875 id2 41891D38
Signals that USO settings have been refreshed. WNF_USO_ACTIVEHOURS_STARTED id1 A3BC7075 id2 41891D38
Signals that USO active hours have started. WNF_DICT_CONTENT_CHANGED id1 A3BC0875 id2 15850729
The content of a user dictionary has changed (word either added or removed). SDDL SID's come from capability ID_CAP_INPUT_CORE (both application and service SID's), and DefAppsCapabilitiesGroup WNF_UMGR_SIHOST_READY id1 A3BC0835 id2 13810338
Shell Infrastructure host is ready. WNF_UMGR_USER_LOGIN id1 A3BC1075 id2 13810338
The user was logged in to the system. WNF_UMGR_USER_LOGOUT id1 A3BC1875 id2 13810338
The user was logged out of the system. WNF_UMGR_SYSTEM_USER_CONTEXT_CHANGED id1 A3BC2075 id2 13810338
Default system user, as defined by start view, has changed. WNF_UMGR_SESSIONUSER_TOKEN_CHANGE id1 A3BC2875 id2 13810338
Token for the session user changed. WNF_UMGR_SESSION_ACTIVE_SHELL_USER_CHANGE id1 A3BC3035 id2 13810338
Session active shell user changed. WNF_UMGR_USER_TILE_CHANGED id1 A3BC3875 id2 13810338
The user tile for the specified SID was changed. The payload is the String user sid and the datasize is the byte count of MAX_PATH. WNF_VAN_VANUI_STATUS id1 A3BC0875 id2 41880F3B
The VAN UI open close status WNF_VTSV_CDS_SYNC id1 A3BC0875 id2 17951A3B
Notification for syncing CDS WebCredential store WNF_VPN_CLIENT_CONNECTIVITY_STATUS id1 A3BC0875 id2 41881E3B
The VPN Client connectivity status. SDDL gives RasMan read/write permissions, rescap:networkingVpnProvider read permissions, and Authenticated User read permissions. WNF_WAAS_QUALITY_IMPACT id1 A3BC0875 id2 12870F3A
WaaS Assessment Impact level for quality update WNF_WAAS_FEATURE_IMPACT id1 A3BC1075 id2 12870F3A
WaaS Assessment Impact level for feature update WNF_WCM_INTERFACE_LIST id1 A3BC0875 id2 418B0D3A
This event signals when a WCM-managed network interface has been added or removed WNF_WCM_SERVICE_STATUS id1 A3BC1075 id2 418B0D3A
Connection Manager service restart WNF_WCM_MAPPING_POLICY_UPDATED id1 A3BC1875 id2 418B0D3A
WNF state for refreshing WCM service mapping policies cache WNF_WCM_PROFILE_CONFIG_UPDATED id1 A3BC2075 id2 418B0D3A
WNF state for refreshing WCM's selection multiplex table and selectable connection list WNF_WCM_INTERFACE_CONNECTION_STATE id1 A3BC2875 id2 418B0D3A
This event signals when a WCM-managed network interface has changed its connection quality state WNF_CNET_DPU_GLOBAL_STATE_OVER_LIMIT id1 A3BC1075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to OVER_LIMIT, otherwise it is 0 WNF_CNET_DPU_GLOBAL_STATE_OFF_TRACK id1 A3BC1875 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to OFF_TRACK, otherwise it is 0 WNF_CNET_DPU_GLOBAL_STATE_ON_TRACK id1 A3BC2075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to ON_TRACK, otherwise it is 0 WNF_CNET_DPU_GLOBAL_STATE_UNDER_TRACK id1 A3BC2875 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to UNDER_TRACK, otherwise it is 0 WNF_CNET_DPU_GLOBAL_STATE_NOT_TRACKED id1 A3BC3075 id2 1583002E
the data of this state is 1 when the global data usage state is less than or equal to NOT_TRACKED, otherwise it is 0 WNF_CNET_CELLULAR_CONNECTIONS_AVAILABLE id1 A3BC4875 id2 1583002E
State name for Cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_CNET_NON_CELLULAR_CONNECTED id1 A3BC6875 id2 1583002E
The state is 1 when a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_CNET_RADIO_ACTIVITY_OR_NON_CELLULAR_CONNECTED id1 A3BC7075 id2 1583002E
The state is 1 when Radio is active or a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_CNET_RADIO_ACTIVITY id1 A3BC7875 id2 1583002E
The state is 1 when Cellular data is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System WNF_CNET_WIFI_ACTIVITY id1 A3BC8075 id2 1583002E
The state is 1 when WiFi is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System WNF_DUSM_TASK_TOAST id1 A3BC0875 id2 C951B29
Trigger task scheduler to launch task for toast WNF_DUSM_IS_CELLULAR_BACKGROUND_RESTRICTED id1 A3BC1075 id2 C951B29
The state is 1 when cellular internet connection is not allowed to any UWP Application running in background, the state is 0 when cellular internet connection is allowed to any applications running in foreground or background. WNF_WDAG_SETTINGS_CHANGED_USER id1 A3BC0875 id2 6870A3A
A Settings for WDAG requiring the user context has changed. WNF_WDAG_SETTINGS_CHANGED_SYSTEM id1 A3BC1075 id2 6870A3A
A Settings for WDAG requiring system context has changed. WNF_WDSC_ACCOUNT_PROTECTION_REFRESH id1 A3BC0875 id2 2950A3A
This event triggers a refresh for the account pillar state WNF_WEBA_CTAP_DEVICE_STATE id1 A3BC0875 id2 840B3A
This event signals CTAP device state changes. WNF_WEBA_CTAP_DEVICE_CHANGE_NOTIFY id1 A3BC1075 id2 840B3A
This event signals CTAP device was inserted or tapped. WNF_WER_SERVICE_START id1 A3BC0875 id2 41940B3A
The WER service needs to start. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187 WNF_WER_QUEUED_REPORTS id1 A3BC1075 id2 41940B3A
The number of reports queued to the machine store. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187 WNF_WER_CRASH_STATE id1 A3BC1875 id2 41940B3A
Information about applications currently crashing. WNF_WIFI_CONNECTION_STATUS id1 A3BC0875 id2 880073A
State name for Wifi radio and connection status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_CPL_STATUS id1 A3BC1075 id2 880073A
State name for Wifi CPL status flags WNF_WIFI_SERVICE_NOTIFICATIONS id1 A3BC2075 id2 880073A
Notifications received from the WiFi Conn Svc. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_HOTSPOT_HOST_READY id1 A3BC2875 id2 880073A
State name for Wifi Hotspot Host ready flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_AOAC_STATUS id1 A3BC4875 id2 880073A
State name for Wifi power status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_CONNECTION_SCORE id1 A3BC5875 id2 880073A
State name for Wifi connection status and connection score updates WNF_WIFI_TILE_UPDATE id1 A3BC6075 id2 880073A
State name for Wifi network tiles updated. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_AVERAGE_TRANSMIT id1 A3BC6875 id2 880073A
Average peak transmitted traffic seen by NCSI WNF_WIFI_MEDIA_STREAMING_MODE id1 A3BC7075 id2 880073A
Last media streaming mode state change WNF_WIFI_TASK_TRIGGER id1 A3BC7875 id2 880073A
State name triggering WiFiNetworkManager background task. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_L3_AUTH_STATE id1 A3BC8075 id2 880073A
State for triggering browser UI when a network is hijacked. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml WNF_WIFI_WLANSVC_NOTIFICATION id1 A3BC8875 id2 880073A
This event sends notifications from wlansvc WNF_WIFI_HOTSPOT2_REGISTRATION_STATUS id1 A3BC9075 id2 880073A
State name for triggering hotspot2 registration status from online signup server WNF_WIFI_PROTECTED_SCENARIO id1 A3BC9875 id2 880073A
Signals that the Wi-Fi stack is handling an important scenario which must be protected from disruptive activity such as unexpected scans, or activity on a shared radio. WNF_WIFI_MOVEMENT_DETECTED id1 A3BCA075 id2 880073A
Event indicating that the user may have moved to a different location based on nearby AP RSSI and other signals. Value is a counter indicating how many times movement has been detected. WNF_WCDS_SYNC_WLAN id1 A3BC0875 id2 12820D3A
State name for starting the WLAN scheduled task. WNF_WFDN_WFD_DISCONNECTION_PROPERTIES id1 A3BC0875 id2 F82083A
Reports properties about a Wi-Fi Display disconnect WNF_WFDN_MOVEMENT_DETECTED id1 A3BC1075 id2 F82083A
Event indicating that the user may have moved to a different location during the Infracast session. Value is a counter indicating how many times movement has been detected. WNF_WFDN_STAY_CONNECTED_TRIGGER id1 A3BC1875 id2 F82083A
Event indicating the current state of the infra walk-away listener. 0: Listening, 1: User elected to stay connected, 2: Auto Disconnect was triggered, 3: Session ended without triggering movement detection. WNF_WIL_FEATURE_STORE id1 A3BC0C75 id2 418A073A
Event indicating the Normal feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml WNF_WIL_BOOT_FEATURE_STORE id1 A3BC1475 id2 418A073A
Event indicating the Boot feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_1 id1 A3BC1C75 id2 418A073A
Event to indicate the first use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_2 id1 A3BC2475 id2 418A073A
Event to indicate the first use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_3 id1 A3BC2C75 id2 418A073A
Event to indicate the first use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_USAGE_TRACKING_1 id1 A3BC3475 id2 418A073A
Event to indicate unique use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_USAGE_TRACKING_2 id1 A3BC3C75 id2 418A073A
Event to indicate unique use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_USAGE_TRACKING_3 id1 A3BC4475 id2 418A073A
Event to indicate unique use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_1 id1 A3BC4C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_2 id1 A3BC5475 id2 418A073A
Event to indicate uniquely observed code failures on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_3 id1 A3BC5C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_4 id1 A3BC6475 id2 418A073A
Event to indicate uniquely observed code failures on this device (4). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_5 id1 A3BC6C75 id2 418A073A
Event to indicate uniquely observed code failures on this device (5). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_HEALTH_TRACKING_6 id1 A3BC7475 id2 418A073A
Event to indicate uniquely observed code failures on this device (6). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_MACHINE_FEATURE_STORE id1 A3BC7C75 id2 418A073A
Event indicates modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_MACHINE_FEATURE_STORE_MODIFIED id1 A3BC8075 id2 418A073A
Event fires once per boot on modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_USER_FEATURE_STORE id1 A3BC88F5 id2 418A073A
Event indicates modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_USER_FEATURE_STORE_MODIFIED id1 A3BC90F5 id2 418A073A
Event fires once per user session on modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582. WNF_WIL_FEATURE_USAGE_FOR_SRUM id1 A3BC9835 id2 418A073A
Event indicates there is unique and custom usage of a feature. This is for SRUM consumption. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582 WNF_WBIO_ENROLLMENT_FINISHED id1 A3BC0875 id2 E8F0C3A
This event is fired when an enrollment completes, either successfully, or unsuccessfully. WNF_SRT_WINRE_CONFIGURATION_CHANGE id1 A3BC0875 id2 41921C3E
Triggered each time there is a configuration change in WinRE WNF_STOR_CONFIGURATION_DEVICE_INFO_UPDATED id1 A3BC0875 id2 13891A3E
This WNF event fires when the OEM, MO, and Device Hardware values change in the registry. WNF_STOR_CONFIGURATION_MO_TASK_RUNNING id1 A3BC1075 id2 13891A3E
This WNF event fires when the MO discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running. WNF_STOR_CONFIGURATION_OEM_TASK_RUNNING id1 A3BC1875 id2 13891A3E
This WNF event fires when the OEM discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running. WNF_WUA_NUM_PER_USER_UPDATES id1 A3BC08F5 id2 41871B3A
State stores the number of per-user updates for the current user WNF_WUA_AU_SCAN_COMPLETE id1 A3BC1075 id2 41871B3A
Triggered each time an AU scan is completed WNF_WUA_CALL_HANG id1 A3BC1875 id2 41871B3A
State stores information regarding WU call hangs WNF_WUA_SERVICE_HANG id1 A3BC2075 id2 41871B3A
State stores information regarding WU service hangs WNF_WUA_STAGEUPDATE_DETAILS id1 A3BC2875 id2 41871B3A
Triggered when a StageUpdate call has completed for a phone update installation. WNF_WUA_UPDATE_EXPIRING id1 A3BC3075 id2 41871B3A
Indicates an update will expire on the next WU service scavenge task. The data type is a GUID which represents the update ID. WNF_WHTP_WINHTTP_PROXY_DISCOVERED id1 A3BC0875 id2 1192063A
A network proxy has been discovered. WinHttpAutoProxySvc can write, NlaSvc can read. WNF_WHTP_WINHTTP_PROXY_AUTHENTICATION_REQUIRED id1 A3BC1075 id2 1192063A
A proxy has returned a 407 status code. WNF_WSQM_IS_OPTED_IN id1 A3BC0875 id2 C971D3A
Mirrors the state of CEIPEnable and CEIPSampledIn registry settings. WNF_WNS_CONNECTIVITY_STATUS id1 A3BC0875 id2 4195003A
The WNS Connection Provider connectivity status WNF_WOF_OVERLAY_CONFIGURATION_CHANGE id1 A3BC0875 id2 4180013A
Overlay configuration change WNF_SHR_SHARING_CHANGED id1 A3BC0835 id2 4194063E
System sharing status changed WNF_SHR_DHCP_IPv4_LEASE_LIST id1 A3BC1075 id2 4194063E
ICS DHCP IPv4 lease list changed WNF_SHR_DHCP_IPv4_FASTIP_ADDRS id1 A3BC1875 id2 4194063E
New assigned Fast-IP Address(es) WNF_KSV_STREAMSTATE id1 A3BC0875 id2 41901D26
This is the current stream state of a camera for a process in a given session WNF_KSV_DEVICESTATE id1 A3BC1075 id2 41901D26
This is the current device state WNF_KSV_FSSTREAMACTIVITY id1 A3BC1875 id2 41901D26
This is stream activity indicator WNF_KSV_KSSTREAMACTIVITY id1 A3BC2075 id2 41901D26
This is stream activity indicator WNF_KSV_CAMERAPRIVACY id1 A3BC2875 id2 41901D26
This is user global camera privacy state indicator when switched via physical button WNF_TB_SYSTEM_TIME_CHANGED id1 A3BC0875 id2 41C60C39
Time Broker has finished processing a change ot time WNF_UDM_SERVICE_INITIALIZED id1 A3BC0835 id2 418B0A38
BOOL + UserContextToken indicating whether the UserDataService service has been initialized for the specified user. On OneCore, SDDL gives read access to callers with userDataSystem/userDataSystem capablity group and all access to IU/AU/System. On phone, SDDL comes from ID_CAP_APPOINTMENTS, ID_CAP_COMMS_COMMON, ID_CAP_CONTACTS, ID_CAP_EVERYONE, ID_CAP_PLATFORM_EXTENSIBILITY, UserDataSvc and ID_CAP_SMS in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml WNF_UDA_CONTACT_SORT_CHANGED id1 A3BC2835 id2 41870A38
State name for aggregate sort and display order changes. SDDL comes from ID_CAP_COMMS_APPLICATIONS and ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml WNF_XBOX_APPLICATION_CONTEXT_CHANGED id1 A3BC0875 id2 19890C35
The application specific context has changed in steady state. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_XBOX_APPLICATION_FOCUS_CHANGED id1 A3BC1075 id2 19890C35
The currently focused application has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_XBOX_APPLICATION_ACTIVATING id1 A3BC1875 id2 19890C35
An application is activating. WNF_XBOX_APPLICATION_COMPONENT_FOCUS id1 A3BC2075 id2 19890C35
The currently focused application component has changed. WNF_XBOX_SHELL_TOAST_NOTIFICATION id1 A3BC2875 id2 19890C35
A new toast notification has been delivered to the shell. WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_LAUNCH id1 A3BC3075 id2 19890C35
A package is about to be unmounted from the System OS ready to launch it on the Title OS. WNF_XBOX_PACKAGE_INSTALL_STATE_CHANGED id1 A3BC3875 id2 19890C35
A new application package has been added or an existing one has been removed. WNF_XBOX_IDLE_DIMMER_CHANGED id1 A3BC4075 id2 19890C35
Idle dimmer has changed state. WNF_XBOX_GLOBALIZATION_SETTING_CHANGED id1 A3BC4875 id2 19890C35
An application package has been removed. WNF_XBOX_APPLICATION_NO_LONGER_RUNNING id1 A3BC5075 id2 19890C35
An application is no longer running. WNF_XBOX_AUTOPLAY_CONTENT_DETECTED id1 A3BC5875 id2 19890C35
An optical disc or other media has been detected with content. WNF_XBOX_APPLICATION_ERROR id1 A3BC6075 id2 19890C35
Application error handler WNF_XBOX_STORAGE_ERROR id1 A3BC6875 id2 19890C35
Handler for achievement cache and game save storage WNF_XBOX_LIVE_CONNECTIVITY_CHANGED id1 A3BC7075 id2 19890C35
Connectivity to the Xbox LIVE service has changed. WNF_XBOX_SYSTEM_TITLE_AUTH_STATUS_CHANGED id1 A3BC7875 id2 19890C35
System Title Authentication status has changed. WNF_XBOX_ACHIEVEMENTS_RAW_NOTIFICATION_RECEIVED id1 A3BC8075 id2 19890C35
A new achievements-related raw notifications was received. WNF_XBOX_ERA_VM_STATUS_CHANGED id1 A3BC8875 id2 19890C35
ERA VM status has changed. WNF_XBOX_APPLICATION_LAYOUT_CHANGED id1 A3BC9075 id2 19890C35
One or more application layouts changed. WNF_XBOX_SYSTEM_IDLE_TIMEOUT_CHANGED id1 A3BC9875 id2 19890C35
System Idle Timeout has changed. WNF_XBOX_SYSTEM_CONSTRAINED_MODE_STATUS_CHANGED id1 A3BCA075 id2 19890C35
System constrained status has changed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991. WNF_XBOX_APPLICATION_COM_RESILIENCY_STATUS_CHANGED id1 A3BCD875 id2 19890C35
Application's COM resiliency status has changed. WNF_XBOX_SYSTEM_USER_CONTEXT_CHANGED id1 A3BCE075 id2 19890C35
Default system user, as defined by start view, has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_XBOX_HOST_STORAGE_CONFIGURATION_CHANGED id1 A3BCF075 id2 19890C35
A storage device was either plugged or unplugged. WNF_XBOX_EXIT_SILENT_BOOT_MODE id1 A3BCF875 id2 19890C35
The system is exiting silent boot mode. WNF_XBOX_APPLICATION_LICENSE_CHANGED id1 A3BD0075 id2 19890C35
The license used by the application has changed. WNF_XBOX_SHELL_INITIALIZED id1 A3BD0875 id2 19890C35
The system shell is initialized and ready. WNF_XBOX_PASS3_UPDATE_NOTIFICATION id1 A3BD1875 id2 19890C35
Pass 3 system update has progressed and is sending a notification. WNF_XBOX_MSA_ENVIRONMENT_CONFIGURED id1 A3BD2075 id2 19890C35
The MSA and WNS environments have been configured to match the XBL environment. WNF_XBOX_SIP_VISIBILITY_CHANGED id1 A3BD2875 id2 19890C35
The visibility of the Software Input Pane has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. WNF_XBOX_SYSTEM_GAME_STREAMING_STATE_CHANGED id1 A3BD3075 id2 19890C35
Game streaming state has changed. WNF_XBOX_SIP_FOCUS_TRANSFER_NOTIFICATION id1 A3BD3875 id2 19890C35
It is possible to transfer focus away from the Software Input Pane. WNF_XBOX_XAM_SMB_SHARES_INIT_ALLOW_SYSTEM_READY id1 A3BD4075 id2 19890C35
SMB shares have been launched. WNF_XBOX_XBBLACKBOX_SNAP_NOTIFICATION id1 A3BD4875 id2 19890C35
A snap of XBBlackbox has occurred WNF_XBOX_SYSTEM_LOW_POWER_MAINTENANCE_WORK_ALLOWED id1 A3BD5075 id2 19890C35
Maintenance work is allowed in low power mode WNF_XBOX_ERA_TITLE_LAUNCH_NOTIFICATION id1 A3BD5875 id2 19890C35
ERA launch notification with XBL title info WNF_XBOX_STORAGE_STATUS id1 A3BD6075 id2 19890C35
Status of attached storage devices WNF_XBOX_STORAGE_CHANGED id1 A3BD6875 id2 19890C35
A storage device, or its contents, have changed WNF_XBOX_PACKAGE_STREAMING_STATE id1 A3BD7075 id2 19890C35
Current state of the streaming package WNF_XBOX_STREAMING_QUEUE_CHANGED id1 A3BD7875 id2 19890C35
The install streaming queue contents have changed WNF_XBOX_QUERY_UPDATE_NOTIFICATION id1 A3BD8075 id2 19890C35
An update is available for installing content. WNF_XBOX_REPOSITORY_CHANGED id1 A3BD8875 id2 19890C35
A change has been made to the pre-indexed state repository. WNF_XBOX_LIVETV_TUNER_COUNT_CHANGED id1 A3BD9075 id2 19890C35
The number of LiveTV tuners connected to the system has changed WNF_XBOX_PACKAGECACHE_CHANGED id1 A3BD9875 id2 19890C35
A change has been made to the package cache. WNF_XBOX_WPN_PLATFORM_HOST_INITIALIZED id1 A3BDA075 id2 19890C35
The WPN platform host is initialized and ready. WNF_XBOX_NARRATOR_RECT_CHANGED id1 A3BDA875 id2 19890C35
The rectangle visual of the Narrator has changed. WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_UNINSTALL id1 A3BDB075 id2 19890C35
A package is about to be unmounted from the System OS for uninstall. WNF_XBOX_SEND_LTV_COMMAND_REQUESTED id1 A3BDB875 id2 19890C35
A module requested for an ltv command to be issued. WNF_XBOX_SHELL_DATACACHE_ENTITY_CHANGED id1 A3BDC075 id2 19890C35
An entity has changed in the shell data cache. WNF_XBOX_CORTANAOVERLAY_VISIBILITY_CHANGED id1 A3BDC875 id2 19890C35
The visibility of the Cortana Overlay view has changed. WNF_XBOX_NOTIFICATION_UNREAD_COUNT id1 A3BDD075 id2 19890C35
Number of unread notifications for the current system user. WNF_XBOX_EXTENDED_RESOURCE_MODE_CHANGED id1 A3BDD875 id2 19890C35
Extended resource mode has been toggled WNF_XBOX_AUTO_SIGNIN_IN_PROGRESS id1 A3BDE075 id2 19890C35
Indicates whether the shell is in the process of auto-signin. Payload is UINT32 with a 1 or 0. WNF_XBOX_REMOTE_SIGNOUT id1 A3BDE875 id2 19890C35
A local user has signed out remotely via SPOP. WNF_XBOX_ACCESSIBILITY_NARRATOR_ENABLED id1 A3BDF075 id2 19890C35
Indicates whether the Narrator is enabled. Payload is UINt32 with 1 (enabled) or 0 (disabled). WNF_XBOX_GLOBAL_SPEECH_INPUT_NOTIFICATION id1 A3BDF875 id2 19890C35
A global speech command was recognized that translates to a controller button press. WNF_XBOX_APPLICATION_CURRENT_USER_CHANGED id1 A3BE0075 id2 19890C35
The current user of the application has changed. WNF_XBOX_ERA_VM_INSTANCE_CHANGED id1 A3BE0875 id2 19890C35
ERA VM Instance has come up or gone down WNF_XBOX_RESET_IDLE_TIMER id1 A3BE1075 id2 19890C35
Idle monitor timer should be reset due to user activity. WNF_XBOX_CORTANA_TV_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE1875 id2 19890C35
Notification for when TV grammars for cortana needs rebuilding WNF_XBOX_CORTANA_SIGNEDIN_USERS_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE2075 id2 19890C35
Notification for when signed in users change results in rebuilding grammars for cortana WNF_XBOX_KINECT_IS_REQUIRED id1 A3BE2875 id2 19890C35
An application that requires Kinect has connected to the NuiService. WNF_XBOX_ADJUST_SNAP_CPU_AFFINITY id1 A3BE3075 id2 19890C35
Adjust an app's CPU affinity if in constrained mode WNF_XBOX_VIDEOPLAYER_ACTIVEPLAYER id1 A3BE3875 id2 19890C35
The active shared video player host has changed. WNF_XBOX_VIDEOPLAYER_PLAYERSTATE id1 A3BE4075 id2 19890C35
The video player app has changed internal state. WNF_XBOX_VIDEOPLAYER_PLAYBACKPROGRESS id1 A3BE4875 id2 19890C35
The video player app has changed playback progress. WNF_XBOX_SAFEAREA_SETTING_CHANGED id1 A3BE5075 id2 19890C35
Indicates whether the safe area setting is enabled. Payload is UINT32 with a 1 or 0. WNF_XBOX_ACTIVE_BACKGROUNDAUDIO_APPLICATION_CHANGED id1 A3BE5875 id2 19890C35
The application providing audio from the background has changed. WNF_XBOX_KEYBOARD_LOCALE_CHANGED id1 A3BE6075 id2 19890C35
Indicates that the desired keyboard locale has changed. WNF_XBOX_GAMER_ACCOUNT_CHANGED id1 A3BE6875 id2 19890C35
The local gamer account has signed in or out. Payload is uint32 representing sessionid WNF_XBOX_ERA_VM_IOPRIORITY_CHANGED id1 A3BE7075 id2 19890C35
ERA VM IO priority has been changed WNF_XBOX_SPEECH_INPUT_DEVICE id1 A3BE7875 id2 19890C35
Input device changed for OneCore speech WNF_XBOX_CORTANA_USER_CHANGED_UPDATE_NOTIFICATION id1 A3BE8875 id2 19890C35
Notification for when the active user of Cortana changes from signing in/out/switching user WNF_XBOX_ACCESSIBILITY_EXCLUSIVE_INPUT_MODE_CHANGED id1 A3BE9075 id2 19890C35
The exclusive input modality for an accessibility component changed WNF_XBOX_PROACTIVE_NOTIFICATION_TRIGGERED id1 A3BE9875 id2 19890C35
Proactive notification service is triggered WNF_XBOX_ACHIEVEMENT_TRACKER_STATE_CHANGED id1 A3BEA075 id2 19890C35
Notification for when the Achievement Tracker's state should change WNF_XBOX_GUIDE_DIRECT_ACTIVATION id1 A3BEA875 id2 19890C35
Event to trigger direct activation of xbox guide when nexus is pressed WNF_XBOX_TITLE_SPOP_VETO_RECEIVED id1 A3BEB075 id2 19890C35
A title SPOP veto has been received. WNF_XBOX_LIBRARY_RAW_NOTIFICATION_RECEIVED id1 A3BEB875 id2 19890C35
A new library-related raw notifications was received. WNF_XBOX_MESSAGING_RAW_NOTIFICATION_RECEIVED id1 A3BEC075 id2 19890C35
A new messaging-related raw notifications was received. WNF_XBOX_PEOPLE_RAW_NOTIFICATION_RECEIVED id1 A3BEC875 id2 19890C35
A new people-related raw notifications was received. WNF_XBOX_MULTIPLAYER_RAW_NOTIFICATION_RECEIVED id1 A3BED075 id2 19890C35
A new multiplayer-related raw notifications was received. WNF_XBOX_LIVETV_RAW_NOTIFICATION_RECEIVED id1 A3BED875 id2 19890C35
A new live tv-related raw notifications was received. WNF_XBOX_SYSTEMUI_RAW_NOTIFICATION_RECEIVED id1 A3BEE075 id2 19890C35
A new SystemUI-related raw notifications was received. WNF_XBOX_CLUB_RAW_NOTIFICATION_RECEIVED id1 A3BEE875 id2 19890C35
A new club-related raw notifications was received. WNF_XBOX_CLUBCHAT_RAW_NOTIFICATION_RECEIVED id1 A3BEF075 id2 19890C35
A new club chat-related raw notifications was received. WNF_XBOX_SETTINGS_RAW_NOTIFICATION_RECEIVED id1 A3BEF875 id2 19890C35
A new settings-related raw notifications was received. WNF_XBOX_MEDIA_IS_PLAYING_CHANGED id1 A3BF0075 id2 19890C35
Notification of whether any media is playing. WNF_XBOX_EXPANDED_RESOURCES_INACTIVE id1 A3BF0875 id2 19890C35
An expandedResources app has gone inactive. WNF_XBOX_PARENTAL_RESTRICTIONS_CHANGED id1 A3BF1075 id2 19890C35
The maximum age rating currently permissable has changed. WNF_XBOX_PARTY_OVERLAY_STATE_CHANGED id1 A3BF1875 id2 19890C35
Notification for when the Party Overlay's state should change WNF_XBOX_CLOUD_SETTINGS_UPDATED id1 A3BF2075 id2 19890C35
A cloud settings collection was updated WNF_XBOX_ERA_FAST_ITERATION_STATUS_CHANGED id1 A3BF2875 id2 19890C35
ERA Fast Iteration Mode has changed. WNF_XBOX_NTM_CONSTRAINED_MODE_CHANGED id1 A3BF3075 id2 19890C35
The Network Transfer Manager's constrained mode changed. WNF_XBOX_NARRATOR_INPUT_LEARNING_MODE_CHANGED id1 A3BF3875 id2 19890C35
Narrator input learning mode changed. WNF_XBOX_SUSPEND_SKELETAL_TRACKING_INITIALIZATION id1 A3BF4075 id2 19890C35
Initialization of the skeletal tracking pipeline should be suspended / resumed. WNF_XBOX_NEON_SETTING_CHANGED id1 A3BF4875 id2 19890C35
Immersive background or connected animation setting changed. WNF_XBOX_COPYONLAN_UPLOAD_STATE_CHANGED id1 A3BF5075 id2 19890C35
Copy on LAN upload state has changed. WNF_XBOX_DASHBOARD_DIRECT_ACTIVATION id1 A3BF5875 id2 19890C35
Event to trigger direct activation of xbox dashboard. WNF_XBOX_COMMANDSERVICE_RAW_NOTIFICATION_RECEIVED id1 A3BF6075 id2 19890C35
A new Command Service raw notification was received. WNF_XBOX_NOTIFICATION_SETTING_CHANGED id1 A3BF6875 id2 19890C35
A notification settings was updated WNF_UTS_USERS_ENROLLED id1 A3BC0C75 id2 41951A38
Indicates whether there are any enrolled users. WNF_UTS_LOCKSCREEN_DISMISSAL_TRIGGERED id1 A3BC1475 id2 41951A38
Triggered when the lock screen is dismissed to kick-off trusted signals. WNF_USB_TYPE_C_PARTNER_STATE id1 A3BC0875 id2 41841D38
This event indicates the state of a USB Type-C connector's partner device. WNF_USB_BILLBOARD_CHANGE id1 A3BC1075 id2 41841D38
This event indicates that the number of Billboard devices in the system has changed. WNF_USB_PEER_DEVICE_STATE id1 A3BC1875 id2 41841D38
This is the state of a peer device. WNF_USB_CHARGING_STATE id1 A3BC2075 id2 41841D38
This event indicates the USB charging state for this Windows device. WNF_USB_FUNCTION_CONTROLLER_STATE id1 A3BC2875 id2 41841D38
This event indicates the state of a USB function controller, such as detached, or attached, and successfully enumerated with host PC. WNF_USB_ERROR_NOTIFICATION id1 A3BC3075 id2 41841D38
This event indicates that a USB error notification needs to be published. WNF_USB_POLICY_MANAGER_HUB_COLLECTION_STATE id1 A3BC3875 id2 41841D38
This indicates that the hub collection in USB Policy Manager has changed. WNF_USB_XHCI_AUDIO_OFFLOAD_STATE id1 A3BC4075 id2 41841D38
This event indicates the state of a USB XHCI controller's audio offload state.
This event is signalled when device changes status of registration in Azure Active Directory.
This event is bool signaled to indicate the EC accessibility feature enabled state
Indicates Activity Data has been updated
A system entity has requested a change in AFD's orderly release behavior.
This state is incremented when a discrete part of the AoW boot sequence has completed. Security: WNF_STATE_SUBSCRIBE (1) by everyone (WD) and app containers (S-1-15-2-1); WNF_STATE_SUBSCRIBE | WNF_STATE_PUBLISH (3) by Local System (SY) and the Interactive User account (IU).
Contains the current stream state information for the app broadcast service.
AppInstallation state name to receive RAW notifications
This event is signalled when a package install operation completes
This event is signalled when a package update operation completes
This event is signalled when a package uninstall operation completes
An app implementing windows.AppUriHandler contract has been installed
This event is fired when all critical packages (those that need to be installed before the shell is displayed) have installed.
Mobile lockdown configuration has been changed
Curate tile collection for all allowed apps for current AssignedAccess account has been created
Events are logged to the assigned access status trace logging.
This state holds the CPU Set ID for audio threads. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
This state indicates an active phone call, which can be from a cellular call or active Communications category audio streams
This notification indicates whether or not the tuner endpoint is available.
State for problems detected in the audio core.
This state keeps other system services apprised of the audio-reserved CPU set ID.
Reports the number of, and all endpoints currently rendering audio. Returns a WNF_STREAM_EVENT_HEADER data structure
This notification is raised when contextual volume for endpoints have changed.
Reports the number of, and process ids of all applications currently capturing audio. Returns a WNF_CAPTURE_STREAM_EVENT_HEADER data structure
Reports the changes to the Ringervibrate state of the device
Reports for each spatial audio endpoint if spatial audio is currently being rendered. Returns a WNF_SPATIAL_STATUS_HEADER data structure
Reports certain properties of the default render multimedia endpoint whenever the default endpoint changes or a property of interest changes on the default render endpoint
Publishes a list of the current chat applications on the device
This notification is used to signal that a match has been detected for Voice Activation
A driver requst permission for volume limit change.
This event propagates the user's choice from the warning dialog.
This event informs the system that we need to show reached volume limit warning message
Event fired when we scan the System Partition and find corruption.
The background media player's playstate has changed.
The following tasks aren't able to play under current policy
IP Over USB Availability. SDDL comes from ID_CAP_EVERYONE and IpOverUsb in %SDXROOT%\src\baseos\prod\packages\MfgIpOverUsb\MfgIpOverUsb.pkg.xml
Update progress reporting status. SDDL comes from ID_CAP_BASEOS_UPDATEAPI in %SDXROOT%\src\baseos\prod\packages\imgupd\MainOS\ImgUpd.pkg.xml
This event triggers when Device Encryption support status is evaluated, and receives the result of that evaluation.
This event triggers when the BitLocker service detects a change in the count of DE-managed volumes, and includes the count of such volumes.
This event triggers or signals to stop WIM hash generation task.
This event signals completion of WIM hash generation.
This event triggers WIM hash deletion.
This event trigger-starts BdeSvc service.
This event triggers on every BitLocker state change.
This event triggers where RequireDeviceEncryption policy arrives under the BitLocker area.
This event triggers SD card encrytion policy arrival notification.
This event triggers SecTask to enable/disable SD Card encryption.
This event indicates completion of SD Card encryption/decryption request.
This event trigger-starts device encryption task.
This event triggers BitLocker task to enable BitLocker on all volumes.
State name for Bluetooth overall status notification. Flags from the BLUETOOTH_GLOBAL_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTConnMgr in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
State name for Bluetooth Audio Gateway status notification. A 32-bit bitmask of BLUETOOTH_AUDIO_GATEWAY_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTAGService in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
State name for Bluetooth MAP status notification. A 32-bit bitmask of BLUETOOTH_MAP_STATUS enum are returned.
Indicates when a Bluetooth Device gets connected and disconnected
Indicates that a legacy Gatt client request is present. The local radio and remote device BTH_ADDR are returned.
Indicates that a legacy Gatt client request was no longer present. The previously granted access token to be revoked is returned.
Notification that the user requested a change to the status of the QuickPair engine.
Notification that the user has changed the volume level using AVRCP on a Bluetooth peripheral.
Notification that a Bluetooth device's battery is low.
Exposes the status of Bluetooth LE Advertisement scanning.
The state is published once the previous shutdown was not clean.
The state is published if system time is initialized with a backup time source.
The state reflects memory partiton restoration state (nothing to restore, restore in progress, restore completed, failure)
Notifies brightness classes of the active window in order to apply their brightness preferences
Background work execution trigger
BI user logon system state notification channel
BI user logoff system state notification channel
BI session connect system state notification channel
BI session disconnect system state notification channel
BI application uninstall system state notification channel
BI application servicing start system state notification channel
BI application servicing stop system state notification channel
BI lock screen update system state notification channel
BI event deletion system state notification channel
PSM policy test hook
BI Quiet Mode update system state notification channel
Indicates that BI is ready and also publish channels list for each session
BI notify new session system state notification channel
PSM notification to clients for querying application performance usage
Notification that the system is entering or exiting a network limited standby
A button press has caused a request.
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Event fired when access to the corresponding named app capability changes
Indicates CDP Service is ready
Indicates CDP Service is stopping
Indicates CDP User Service is ready
Indicates CDP User Service is stopping
Indicates CDP service queued the message(s) for designated applications
Indicates CDP service received new activities
Indicates that the user has changed the CDP policy
Indicates failure either delivering or invoking a Notification Action on a remote device
Indicates that the user has changed Rome SDK authorization setting
Indicates that the user has changed Near Share authorization setting
Indicates whether ActivityFeed is enabled. It is responsible for mirroring different activity types (as applicable) across device graph of the user.
Indicates the settings policy (enabled/disabled) for 'User Activity' publishing has changed.
Indicates CDP service received local activities
Indicates the persisted values associated with a resource has changed.
Indicates the settings policy (enabled/disabled) for 'User Activity' upload has changed.
Indicates clipboard history policy has changed.
Indicates cross device clipboard policy has changed.
Modem power state of the first modem, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_EVERYONE, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Number of bars (0..5) of signal strength for the first cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
System type of the first cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current registration status of the first cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Status of the UICC in the first slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
The current state of airplanemode. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current serving operator for the first cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Activation, PRL, and provisioning state for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
NITZ information for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
List of available operators for the first cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Device info (RIL_GetDeviceInfo) for the first cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Cellular data enabled state as set by user. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Phone number (MSISDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Voicemail number (MBDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Registration preferences for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Can state (between CellManager and CellUX) for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Power state of the modem as last preferred by the user, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
The current state of airplanemode details. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
This is triggered if cellcore suspects that data activity may have been affected. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Root state describing cellular system configuration (all modems and their cans). SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Detailed registration status of the first cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_EVERYONE, ID_CAP_ISV_CAMERA, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_ISV_CAMERA and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
UICC toolkit setup menu notification for slot 0. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
UICC toolkit proactive command notification for all slots. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
CM CSPWWAN+ readyness state. SDDL comes from ID_CAP_CMCSPWWAN_PLUS in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
Call-forwarding status for the first cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Modem radio type of the first modem, values defined by RILRADIOCONFIGURATIONRADIOTYPE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Number of bars (0..5) of signal strength for the second cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
System type of the second cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current registration status of the second cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Status of the UICC in the second slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current serving operator for the second cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Activation, PRL, and provisioning state for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
NITZ information for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
List of available operators for the second cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Device info (RIL_GetDeviceInfo) for the second cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Phone number (MSISDN) for the second cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Registration preferences for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Can state (between CellManager and CellUX) for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Detailed registration status of the second cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CELL_WNF, ID_CAP_EVERYONE, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
UICC toolkit setup menu notification for slot 1. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Call-forwarding status for the second cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Configured lines for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Configured lines for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Status details of the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Status details of the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Preferred languages in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Preferred languages in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Migration action for legacy cellcore settings. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Answer to reset from the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Answer to reset from the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 0. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 1. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Indication that all executors have been configured and that there are no outstanding configurations pending in the modem. SDDL comes from WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
This is published when cellcore needs MV to kick in. SDDL comes from ID_CAP_EVERYONE, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Signal-strength details for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Signal-strength details for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Indication about the current emergency callback mode. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current IMS registration for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Current IMS registration for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
iWLAN availability for Can 0, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
iWLAN availability for Can 1, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
PS Media preferences for Can 0, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
PS Media preferences for Can 1, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
Reports detailed states of PIN on slot 0. It is private for Wwansvc access only
Reports detailed states of PIN on slot 1. It is private for Wwansvc access only
Table of all modems and executors under it.
This event is published by WwanSvc to indicate the arrival of an eUICC.
This event is published by WwanSvc to indicate a change in cellular state snapshot.
State name triggering WiFiTask from WwanSvc.
Sms Router Broker is ready.
Sms Router Broker is ready.
Sms Router received a new incoming SMS message.
Push Notification Received from Entitlement Server
This event signals flush cache in all processes where flush is enabled.
This event signals when flush cache was started and completed in each process where enabled.
Central Access Policies have been updated
This notification is triggered when contents on the clipboard change
This notification is triggered when contents of the clipboard history change
This notification is triggered when roaming clipboard enabled/disabled setting value changes
This notification is triggered when clipboard history enabled/disabled setting value changes
Notification of web app status change. Payload is status type plus web app cxid of length 512
Notification when CloudExperienceHost app is finished. Payload is result plus result string of length 512
Notification of web app back button state. Payload is a boolean for on/off
Notification when back command is issued
System-wide signal that the CloudExperienceHost app launched during OOBE is ready with its first webapp visible. Payload is a boolean for true/false
This event signals that change of S mode has occurred.
Core shell has initialized, including all of its services (e.g. TLAVM), and the Product Composer can be launched. If the event has not been fired, then CoreShell is still initializing and the Composer cannot be launched. Payload is a DWORD to inidicate it has been fired.
On UI Automation.
Fired every time a Composer registers with TLAVM and inidicates that the composer is ready to host applications. If the event has not been fired, then no composer is ready to host applications. Payload is a DWORD to inidicate it has been fired.
Fired every time a Product Composer has finished initializing and indicates that Shell has entered normal operations (i.e. not in restricted mode or running OOBE/PostUpdateUX). If the event has not been fired, then the Product Composer is still initializing. Payload is a DWORD to inidicate it has been fired.
When set to the value 1, it indicates that the current composer has finished unintializing.
Indicates the composer has changed which updates the registry (ComposerManagerBaseKey) indicating which composer can be restored after a crash
Fired when a test job wants to skip CXH stage of OOBE
Triggered each time one or more flight configurations changes.
Triggered each time one or more flight configurations is deleted.
Triggered each time one or more flight configurations is added.
Components blocked waiting for restore from snapshot can now continue
This event triggers when the Delivery Optimization service manager is active or idle
Delivery Optimization system policy has been updated
This event triggers when the user changes device access for an applocation or the user
This event signals when authentication stage change.
Notification for when an app is installed so we can register a device background task if necessary.
Notification for when an app is removed so we can clean up any registered device background tasks if necessary.
Signals that Migration started. DWORD[1] = {started flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
Signals that Migration completed. DWORD[2] = {completed flag, status}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
Current Migration state. DWORD[4] = {Phase, Total Phases, Step, Total Steps}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
Signals when data migration is complete after reboot and update results need to be displayed. DWORD[1] = {completed flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml and DuPostUpdateUX in %SDXROOT%\src\devmgmt\du\packages\UX\UX.pkg.xml and WINCAP_SHELL_EXPERIENCE_COMPOSER in %SDXROOT%\shellcommon\Composable\Core\dll\microsoft-windows-coreshell.wm.xml
State stores the current stereo cpl setting. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when mode change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when any occlusion related OS state change happens.
Triggered by kernel when the state of a network display device is changed.
Triggered by kernel when monitor change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when video memory has to be trimmed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when video memory budget for an application changes. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by hardware content protection tilt detection. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Stores information about the physical dimensions (in mm) of the integrated panel if available, and 0's if not.
Triggered when a lowbox application starts or stops using OutputDuplication.
Triggered by kernel when a change is made to the display configuration.
Triggered when a device has been removed for any reason, not just adapter removal. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Triggered when a lowbox application starts or stops using OutputDuplication and provides list of active lowbox contexts
Triggered when the default color profile for any attached display changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
State is used to indicate the process that should be targeted by GPM.
Triggered by kernel when a GPU is started. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when a GPU is stopped. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Triggered by kernel when SDR white level value is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
Triggered when any of the color overrides are changed for any display.
Triggered by kernel when colorimetry data is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
This event signals when a disk that requires scrubbing is brought online
Triggered by the kernel when any adapter receives a TDR or PNP event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Triggered by the kernel when an active display path asynchronously transitions to either a failed or invalidated state
When all the DNS Servers Timeout, this event is notified
Triggered when the dwm starts/terminates
Triggered when exclusive mode apps are presenting at a low framerate to the holographic compositor
Triggered when the compositor toggles between not having and having (any) protected content
Triggered when 3D compositor is presenting at a low framerate
Triggered when the dwm composition capabilities changes
State name for holding application window handle of calling UX
Narrator has moved its focused region
Represents whether Narrator is currently running. A 32-bit unsigned integer with a zero value meaning Narrator is off.
UISettings have changed. The payload carries an identifier for the particular setting that has changed, such as TextScaleFactor.
This event is fired when a top level frame navigation is complete, the payload contains the host name
This event is fired when an extension is installed. The payload is the extension id
This event is fired on edge open if any extension is installed
This event is fired on edge open if any extension, supported in InPrivate, is installed
The application was launched in the specified mode under the specified Enterprise context.
The keys associated with a data protection identity were removed.
Current state of the Data Protection under Lock private keys
Either a copy or override operation occurred, leading to clipboard metadata changes. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
An EDP blocking dialog has been canceled programmatically.
Application UI EDP context has been changed for the process.
The AAD token used by EDP has expired.
The EDP enterprise contexts have been updated.
EDP process UI enforcement global state
EDP thread UI enforcement. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
Data Protection under Lock private keys will be dropped from memory shortly.
EDP cred service cannot access credentials required
Purge application learning events cache
Cred service is updating user credentials.
This event is triggered when an MDM printer policy is changed.
This event trigger-starts EFS service.
EFS service needs to check GP at boot, which requires the SOFTWARE hive in HKLM. This signals its availability when EFS worker thread detects it.
Current changed policy values represented as bits for the Device Lock policy area. SDDL comes from NgcctnrSvc in %SDXROOT%\src\baseos\prod\packages\ngc\ngc.pkg.xml and ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml, %sdxroot%\onecoreuap\admin\dm\wap\service\dmwappushservice.wm.xml
Current changed policy values represented as bits for the Wifi policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the System policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xmlSDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Connectivity policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Experience policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Accounts policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Security policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Browser policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Update policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the Camera policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the ApplicationManagement policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed security policy RequireDeviceEncryption value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
An MDM Push notification has been received. SDDL comes from ID_CAP_CSP_DMCLIENT in %SDXROOT%\src\devmgmt\dm\packages\dmapps\dmapps.pkg.xml
Current changed policy values represented as bits for the Search policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Current changed policy values represented as bits for the AboveLock policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A Dataprotection AllowApplications provider policy value has changed.
A Dataprotection EDPEnforcementLevel provider policy value has changed.
A WAP message has been received that dmwappushsvc needs to handle.
An enterprise context has changed it's state
An enterprise WNS based push was received
A TextInput AllowInputPanel provider policy value has changed.
Allow use of diacritics for indexing.
Always use automatic language detection when indexing content and properties.
Do not allow locations on removable drives to be added to libraries.
Stop indexing in the event of limited hard drive space.
Allow indexing of encrypted files.
Bluetooth policy configuration has changed. SDDL comes from ID_CAP_POLICY_MANAGER in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
A Dataprotection networking policy value has changed.
DataProtection Require Protection Under Lock Config policy change.
Windows Defender policy configuration has changed.
ApplicationManagement AllowAllTrustedApps provider policy value has changed.
ApplicationManagement AllowSharedUserAppData provider policy value has changed.
ApplicationManagement RestrictAppToSystemVolume provider policy value has changed.
ApplicationManagement RestrictAppDataToSystemVolume provider policy value has changed.
ApplicationManagement AllowDeveloperUnlock provider policy value has changed.
Update AllowUpdateService provider policy value has changed.
Update UpdateServiceUrl provider policy value has changed.
Update AllowNonMicrosoftSignedUpdate provider policy value has changed.
DisableWBA policy value has changed.
The domains for which email is disabled have changed.
The AllowCellularDataRoaming policy value has changed.
The AllowCellularData policy value has changed.
EDPEnforcementLevel cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
EnterpriseProtectedDomainNames cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
The AllowMessageSync policy value has changed.
Privacy DisableAdvertisingId policy value has changed.
EnterpriseDataProtection (EDP) state has changed.
AllowAppHVSI cached policy has changed.
A NetworkIsolation area policy value has changed.
AppHVSI (Hypervisor-based Virtualized Security Isolation) state has changed.
EdpShowIcons policy value has changed.
AllowWifi policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
AllowManualWifiConfiguration policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
Allow windows indexer.
AllowWifiDirect policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
AllowProjectionToPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
The AllowMessageMMS policy value has changed.
The AllowMessageRCS policy value has changed.
SMBAutoEncryptedFileExtensions policy value has changed.
Any AppHVSI policy value is changed
The AllowSet24HourClock policy value has changed.
AllowProjectionFromPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
The ExploitGuard policy values have changed.
The WindowsDefenderSecurityCenter policy values have changed.
Event fired when app privacy policy values have changed
A TextInput EnableTouchKeyboardAutoInvokeInDesktopMode policy value has changed.
A TextInput TouchKeyboardFullModeAvailability policy value has changed.
A TextInput TouchKeyboardWideModeAvailability policy value has changed.
A TextInput TouchKeyboardNarrowModeAvailability policy value has changed.
A TextInput TouchKeyboardHandwritingModeAvailability policy value has changed.
A TextInput TouchKeyboardSplitModeAvailability policy value has changed.
A TextInput TouchKeyboardEmojiButtonAvailability policy value has changed.
A TextInput ForceTouchKeyboardDockedState policy value has changed.
A TextInput TouchKeyboardDictationButtonAvailability policy value has changed.
BITS policy area value has changed.
ETW subsystem initialized
This event signal when a task completion has been revoked due to memory pressure
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates all application views should be closed
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates background tasks should be terminated
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates a warning should be displayed to the user
This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates MRC should be stopped
Family Safety settings have changed in the cloud service but have not been downloaded and committed
Family Safety time remaining alerts to warn the user the allocated time is running out. The data is published as json blob with fileds U.SID for User SID as wide character and TR for time remaining in minutes as int value
Family member login event
Family Safety settings have changed and have downloaded and committed. Clients should refresh Family Safety settings.
This event contains a feedback question for the user. Payload is a JSON string specifying the feedback question.
Free network available or not
Triggered every time there is a change in flight IDs
Triggered every time upon WNS notification or policy change
Wait for rundown release in Filter Manager may be blocked by a suspended Modern application
Installation status of Features on demand
This event signals when a tiered volume is mounted
Oplock break acknowledgement may be blocked by a suspended Modern application
This event is signalled when the graphics driver presents the initial frame.
This event is fired for GIP adapter state change, such as connect/disconnect
This event triggers when the user changes Geolocation access for an application or the user.
Do not use this WNF event, it is deprecated. Was WIN32_API_ACCESS_CHANGED.
This event triggers when there is an event that accesses location data -- this trigger starts LocationNotifications.exe which is a systray app.
This is triggered when an app is making use of the location service. It has two possible data values associated to it: BOOL TRUE: one or more applications are using location. BOOL FALSE: no application is using location.
This state is used to notify when the location service starts or stops running
This state is used to notify when the phone location master switch status changes with BOOL as payload. TRUE indicating master switch is ON and FALSE indicating master switch is OFF
This state is used to notify Geofence tracking state for the geofences added by the applications. TRUE if atleast one geofence is actively being tracked and FALSE if there are no geofences being tracked.
Do not use this WNF event, it is deprecated. Was WNF_LFS_BACKGROUND_PERMISSIONCHANGE_STATE
This state is used to notify when a new freely available position can be queried from the location framework.
This state is published whenever the permissions of an active client have changed. Every client on the system receives it, and should run domain-specific logic to see what the impact is (e.g., reconnect location session when permission re-allowed).
This event notifies when the permission regarding the ability to show the location notification icon has changed. The current state needs to be queried for as it is different for each user.
This event notifies when a new action dialog is available
This event notifies when there's a significant change in the location of the device.
This event notifies when there's a visit or a significant change in the location of the device.
This event is fired when an MDM Location policy change occurs.
This event is fired when an MDM EnableLocation policy change occurs.
This state is notified when the ANSI codepage changes - The data value is a UINT that indicates the new ANSI codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the OEM codepage changes - The data value is a UINT that indicates the new OEM codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the user default locale changes - The data value is an LCID that indicates the new locale. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the user default UI language changes - The data value is a LANGID that indicates the new UI language. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the locale info changes by means of calling SetLocaleInfo - The data value is a DWORD that indicates the LCTYPE that changed. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the user Geo ID changes by means of calling SetUserGeoID - The data value is a DWORD that indicates the new GeoID. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
Notification indicating lang update launcher needs to be started. SDDL comes from ID_CAP_EVERYONE, ID_CAP_NTSERVICES and ID_CAP_INPUT_LOCALES in %SDXROOT%\src\uxplat\Input\Packages\InputServer\InputServer.pkg.xml
Notification indicating NLS/MUI user settings replicator needs to be started. - The data value is the replication cookie GUID (binary). SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
Notification indicating NLS/MUI user settings replication has completed. - The data value is an HRESULT. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This state is notified when the globalization user profile has changed via SetUserProfileLanguagesWP. There is nothing in the payload - call GetUserProfileLanguagesWP to get the updated user profile language list. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
System policy has been updated
User policy has been updated
This event signals a request to get (if needed) and verify Health Certificate with HAS
Event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
Event raised when the input context changes (ex. from 3D input to 2D Desktop input). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
Event raised when the Holographic Shell running state changes (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState
This event signals when input focus changes to a different window. Data is a MPCInputFocusChange struct.
If payload is non-zero, room boundary is forced to be visible.
This event signals whether streaming is active. Data contains a bool indicating if streaming is active.
This event signals that the persisted room boundary data has changed.
A non-zero payload indicates the room boundary is visible to the user. Writable by DWM and System.
This event signals when various input types should be disabled from natively working in the Windows Holographic shell, useful for apps that simulate GGV via mouse and/or gamepad. Data contains a DWORD of bitflags from Windows::Internal::Shell::Holographic::ShellInput3DSwitchDisableFlags.
This event contains the file path for the environment app's audio asset, which is used by Triton
This event signals that it's time for uninstall preparations, which includes shutting down Oasis apps.
This event signals that uninstall has finished. Data contains a HRESULT representing uninstall success.
This event signals that the shell spawn point should be moved. Data is a DWORD indicating the id of the point that should be set.
Event raised when the Windows Mixed Reality retail demo timer state changes. Data contains a DWORD equivalent to MixedRealityPortal::RetailDemoTimerState.
Event raised when the benchmarked quality level changes. Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:DisplayQualityState
This event signals that a HoloCoordinator completed uninstall preparation.
System scoped event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
This event signals the desire to change the HMD use state (the overrideable internal setting, not the physical presence state reported by the HMD). Meant to be used by non-shell inbox applications to trigger the equivalent of the input switch hotkey. Data contains a DWORD equivalent to a bool; true = HmdUseState::InUse, false = HmdUseState::Idle.
This event signals the desire to change the current input foreground to go to the last active 3D window. Meant to be used by non-shell inbox applications to return focus to 3D realm.
This event signals a reset of the holographic idle timer. Writable by DWM and System.
Event raised when the Holographic Shell running state changes on the interactive users session (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState
This event signals whether sharing session is active. Data contains a name of the data provider.
This event signals a miracast projection to establish.
This event signals whether recording is active. Data contains a bool indicating if recording is active.
This state signals NTOS has CPU management privileges in the current partition.
The state of Hyper-V's host-only WMI object provider.
The state of Hyper-V's host-only WMI event provider.
A monitor has changed immersive modes
The immersive launcher's visibility has changed
The monitor the immersive environment is running on has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
User-perceived focus has left an edit box.
Projection display availability has changed
The user experience transparency policy stores the global system transparency policy as a DWORD which contains 0 for disabled and 1 for enabled.
The global/shared lights have changed.
The immersive UI scale has changed for the current session.
Last recorded user activity
Fires if there is new input after track interval.
Cursor Manager is initialized. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
This event signals when the Zephyrus controller has encountered a fault that requires a shell notification.
Embedded mode policy value has changed.
settings for the foreground app and/or iot startup type background tasks have changed
Installation of language features on demand was started (either through Settings or through installation task).
LedAlert settings has changed
A running package's license is now invalid and the package must be suspended or terminated.
A content license's state has been modified.
A root license's state has been modified.
A running optional package's license is lost.
Multi-purpose event for app license notifications.
A offline pc state has been changed.
Licenses have been refreshed.
Failed to launch the modern app because no valid licenses and leases were found
The device license hardware ID is out of tolerance with the device's hardware ID
The hardware ID has changed but is still with in tolerance with the device's hardware ID
A new device license with a different device ID was installed
The device license was uninstalled
The required device license was nout found
The integration device license has expired and can no longer be used to verify or decrypt modern app licenses.
Found a local migrated license which needs to be refereshed with a store signed license.
The MDM Licensing Device Registration Policy has been refreshed.
OS Edition has changed.
OS Policy has changed.
The License Terms can be considered as accepted on this device.
OS will soon notify user of non-genuine state.
Indicates where the ease of access flyout should appear in LogonUI and User Oobe, the data type is RECT. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
Indicates that a shutdown has been triggered via Slide-to-shutdown. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
Indicates that user intends to interact with the lock screen (e.g. for Projection or Cortana) and LogonUI should return to the lock screen.
Indicates that the mobile pinpad is visible.
Indicates logon from local console happened, the data type is a GUID which represents the logged-on credential provider CLSID. The sddl string grants subscribe and publish permission to System
This event signals when a credential tile has been selected or deselected.
Indicates that device wake via fingerprint sensor should be disabled. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts, and to App Containers with the userSignInSupport Capability
Current progress of the MapLoader background engine.
The new status of ODML.
A map package has been added or removed or repositioned in the list.
Sync sets this value to request a wifi probe due to SSL error. SDDL comes from ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
Interface to Media-UI-request-State mapping for WLAN (802.1x) interfaces
Interface to Media-UI-request-State mapping for LAN (802.3) interfaces
Notification for alerting client apps that the connected account ticketing state has changed
Notification for alerting client apps that the server has reported TPM claims are available in new tickets. Payload is DWORD (enum TpmKeyStateServer) and permanent since it represents device capability needed across reboot.
Notification for alerting client apps about the current client and server TPM state for logging and retry logic. Payload is a struct of two DWORDs (enum TpmKeyStateServer, enum TpmKeyStateClient).
This notification is raised when the memory manager is unable to automatically offline a bad memory page
Triggered by a monitor device when the thermal limit on brightness is changed. Payload is a MONITOR_THERMAL_BRIGHTNESS_LIMIT_LIST.
This state is notified when the constrast qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
This state is notified when the theme qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
This state is notified when some persistent qualifier changed its value. Payload is qualifier@package_name with a max length of 512 bytes (256 WCHARs including null terminator). Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
This state is notified when system PRI files are merged. Payload has a max length of 128 bytes (64 WCHARs including null terminator) and consists of 'start [starting timestamp]' or 'done [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
This state is notified when a system PRI file is merged. Payload has a max length of 512 bytes (256 WCHARs including null terminator) and consists of either 'start [path] [starting timestamp]' or '{done,skipped} [path] [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
NaAuth User Presence Status
NaAuth Service Running
NaAuth User Authentication Status
NaAuth Extended Dynamic Lock Status for Bluetooth plugin
NCB indication of CCT or Socket Broker Based App availability.
NDIS finds a network adapter that needs to be configured by NetSetupSvc.
NDIS detects corruption in the binding store.
This event is signalled by rasman about reconnect VPN state change and is used by NLM
This event is signalled by NLM when the aggregated network conditions indicate that a connection to the internet is present
This state is used to notify that the NFC CE policy changed.
This state is used to notify that the CanMakePayment background broker is initialized and ready.
This event signals when an caller wants to trigger KeyPregenTask.
This event signals when an caller wants to trigger AikCertEnrollTask.
This event is fired when a policy change occurs in the NGC Pro CSP.
This event signals when an caller wants to trigger KeyPregenTask with some delay.
This event signals when NGC container service (ngcctnrsvc) authenticates a gesture.
This event is fired when an MDM cryptographic policy change occurs.
This event is fired when an activity occurs that requires the NGC PIN cred prov to refresh its credential state.
This event is fired when the state has changed during the PIN reset scenario.
This event is fired from the NGC PIN cred prov to signal that the PIN reset scenario should be launched.
Boolean state representing whether or not the Credential Reset User Experience is active.
This event is fired from NGC container service (ngcctnrsvc) when containers are created or deleted.
This event is fired from the NGC PIN cred prov to signal that an Nth user scenario should be launched.
This event triggers the NgcIsoCtnr key pre-gen pool to start generating a key.
This event is notified when NCSI detects a capability change
State name triggering WiFiTask from NlaSvc
This WNF state indicates to users of WPN endpoints (except AppEndpoint) that platform is ready to use. This state can also be used to know if WPN platform restarted.
This WNF state can be used by first party Apps / Services to determine when WPN platform is ready to handle app related requests like posting toast / tile and getting channel uri.
State indicating that system notification platform has been registered and ready to user.
This WNF state indicates that USER_PLATFORM_READY was fired for a user in the current session. This is intended to provide a workaround for the inability to use RtlSubscribeWnfStateChangeNotification for a user other than the current process token. A process can register for this WNF and then poll the per-user WNF states under impersonation.
This notification is to indicate that the NPSM service has started up.
NSI service status. The SDDL grants subscribe access to all who have access to NSI RPC interface and subcribe + publish access to NSI service.
CSC Service start trigger
Triggered every time there is a change in the OneSettings configuration for machine learning model configurations
Triggered every time there is a change in the OneSettings configuration for Velocity feature configurations
Notification from ISM to OOBE to query the user whether to activate the always-on Magnifier in OOBE
Notification from OOBE to ISM whether the user confirms to activate the always-on Magnifier in OOBE
Notification to User OOBE monitor on where the progress is
Notification of speech controller state change. Payload is state type plus string of length 512
The window's override scale has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
First Pen Tap Gesture
First Pen Drag Gesture
Sent when the WDI session corresponding to a power scenario changes
Sent when the composite battery is updated
Sent after WNF_PO_COMPOSITE_BATTERY when batteries are added or removed and when one or more batteries' AC, charging, or discharging states changes
Triggered when Energy Saver state changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
Triggered when Energy Saver setting changes
Triggered to indicate Energy Saver override settings
Triggered to indicate CR3 condition
Sent when the previous shutdown was due to a thermal trip
Sent when the previous hibernate was due to a thermal trip
Estimated time until full discharge in seconds
Filetime of last known start of discharge
Estimated time until full charge in seconds
Triggered to indicate excessive thermal throttling
Sent to indicate whenever user-away prediction is updated.
Sent to indicate whether a display request is active in the current session.
Triggered when battery charge crosses well-known charge level boundaries.
Sent when the global user presence changes.
Sent when the background activity policy changes.
Triggered when battery is being discharged, irrespective of AC/DC state of the system.
Visible state of the primary display as MONITOR_DISPLAY_STATE
Logical state of the primary display as MONITOR_LOGICAL_DISPLAY_STATE
Sent on every boot to notify previous shutdown state
Triggered at the start of a transition to exit modern standby
Sent when SW DRIPS is more than HW DRIPS by a specific threshold
Sent once platform idle states and associated device constraints have been registered
One time system-wide transition to switch from the basic brightness engine to the high-precision brightness engine.
ALS brightness offset consumed by the basic brightness engine.
Set to TRUE when the video system is initialized.
Notification for power-setting overlay scheme change.
Set when an you want IOCTL_CAD_DISABLE_CHARGING to behave in a sticky manner
Describes the current state of the power button.
Supplies the notification about system time changed. Payload has 2 ULONGLONG for new time and old time.
Triggered when a weak charger is detected. Note that there may be several minute delay between when charger is plugged in and when the notification is produced.
Triggered several minutes prior to idling to sleep.
Triggered when device is sourced from battery(DC) with lid closed and no external monitor connected.
Sent when wake on voice state changes.
Sent to indicate period of opportunistic connectivity in standby.
Describes the input suppression state for modern standby system based on power source, lid state, monitor state, external monitor state and system opted-in policy.
Set to TRUE when one of the battery is in charge limiting mode and FALSE when none of the battery is in charge limiting mode.
This corresponds to a DBT_DEVNODES_CHANGED message
This corresponds to a DBT_DEVNODES_CHANGED message
This corresponds to a drive letter arrival/removal message
This corresponds to a drive letter arrival/removal message
This corresponds to a hardware profiles changed message
This corresponds to a hardware profiles changed message
This corresponds to a ports changes message
This corresponds to a ports changes message
This corresponds to kernel PNP waiting synchronously for user-mode clients
This corresponds to a reboot of the system needs to be performed due to a device installation
Device installation is requested.
A change that requires a device container to be updated has occured.
Fired when a full set of packages are processed.
Fired when TPM, NGC, and MSA all report ready for new tickets to contain the TPM claim. Event contains the HRESULT for the operation.
Fired when an AutoPilot profile is available locally and is non-empty. Event contains the HRESULT for the operation.
Fired when the AutoPilot profile manager completes and is ready to unload.
Fired when the AutoPilot profile manager determines that the MSA client may need to update TPM state
Fired when the Server provisioning in the blocking Device Bootstrap page of commercial OOBE is complete. Data passed in is a DWORD. 0x1, if Bootstrap is complete.
State of boot provisioning tasks. Set to 1 when provisioning is complete. SDDL comes from ID_CAP_PHONEPROVISIONER_EVENTS and PhoneProvisioner in %SDXROOT%\src\devmgmt\dm\packages\provisioning\provisioning.pkg.xml and MvProvisionHost in %SDXROOT%\src\devmgmt\dm\packages\multivariant\multivariant.pkg.xml
Multivariant is ready to deliver SMS messages to RILAdaptation (or any registered recipient)
Multivariant provisioning session status (per slot). Everyone (WD) can subscribe, but just Local System and Admin can publish (SY, BA).
This corresponds to an application that has eclipsed job wake charge resource policy
A WNS notification has been received and the Push To Install service should process it.
This event signals when system radio is changed
This event signals when the client didn't discover SMB1 usage for a specific period
Supplies the current RM memory monitor memory usage level. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Supplies the process ID of the current game mode recipient, or 0 if no recipient is active
Supplies the current quiet mode state as recorded by central resource manager
Supplies the current state of the system as recorded by the system state tracker
This event signals when the RPC firewall manager is initialized
An RPC service trigger has been added or removed
A named pipe service trigger has been added or removed
This event triggers to indicate SCM autostart state
This event signals that there is an update available to the Secure Boot variables.
A notification dialog should be shown to the user.
This event triggers when there is a simple device orientation change. It's data value is one of the SimpleDeviceOrientation enum values. Rights: SensorService can publish, Everyone can subscribe.
This event triggers when the system has completed OOBE (Windows Welcome)
This event triggers when the Uninstall of the system has been disabled
This event signals when the Immersive Shell is started
Set to 0 or more to indicate whether there are any unseen notifications in the notification center. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable the notification on OneCore
This system-scope event is signaled each time a user's desktop becomes ready. Consider using WNF_SHEL_SESSION_LOGON_COMPLETE for a session-scoped version.
This event signals when logon of the first user after OOBE is complete. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed access.
TDL dispatcher pipe has been closed
This event is signalled when there is a tile change to a background task
Event signals when toast notification settings have changed.
This event signals when a SoftLanding rule is triggered
This event signals when Start Experience Host completes loading the Start menu layout
Event signals a full app resolver scan has been invoked.
Set to 0 or 1 to indicate whether the lock screen is active. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and system can write. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_INSTALL_FINISHED event from TDL
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_DOWNLOAD_STARTED event from TDL
Event is for the shell to notify when app layout state is changed. Payload is ShellApplicationStateWnf struct.
This event signals when focus changes to a different process, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
This event signals to toggle exclusive gamepad listening on and off, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
This event signals to toggle exclusive gamepad input on and off
This even signals when Start layout MDM policy has been applied
Event signals when the apps have been pushed to the indexer has completed
This event signals when SoftLanding rules folder is updated
This event signals that a critical notification such as an incoming call was posted. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable notification on OneCore
This event signals when Start visibility changes
Set to 0 or 1 to indicate whether the searchbox is visibile in the tray. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write.
This event signals that the device is unlocked in the current session
This event signals the changes in places' database (clientgraph)
Event is for the shell to notify when app background activity should be suspended. Payload is DWORD set to 1 or 0.
This event signals a creative event has been triggered
Event signals that the jumplist for an app has changed. Payload is a struct containing the current sessionId as well as a string representing the aumid of the app whose jumplist was updated.
This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_UNINSTALL_FINISHED event from TDL
This event signals whenever the nexus button policy changes.
This event signals when a settings toggle has changed
This event signals when a new toast is published
This event signals when a new soft landing tip is published
Event signals when an app requests cortana to build the settings constraint index
This is the state of dictation. SDDL comes from dwm.exe in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml and WPNarrator in %SDXROOT%\src\media\apps\packages\Apps\WPNarrator.pkg.xml. And Phone DefApps group is required too.
This event signals when a parsed command is ready for processing
This event signals when a command has been delivered via WNS
This event signals when a command has been delivered via SMS
This event signals that the device is locked in the current session
This event signals a subscription has been activated.
This event signals the content of one or more subscriptions has been updated.
This event signals that lock screen image had changed. It contains the user sid whose image was changed
Set to 0 (uncovered or unknown) or 1 (covered).
This event signals when connected accounts have changed and register device should be called
This event signals when OOBE in a Shell should enable its provisioning flow
This event signals that the Lock application has been presented to the user. It contains an instance cookie as specified from LogonUI.
This event signals that the Lock application is requesting to unlock so the user can enter credentials.
This event is signalled when there is a tile install to a background task
This event is signalled when there is a tile update to a background task
This event is signalled when there is a tile uninstall to a background task
This event is signalled when there is an app launched (1) or terminated (0) above lock. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed full access, while all other app containers have read access.
This event is signalled when the RadialController Experience has restarted to allow registered API component to re-establish connection and repopulate state
This event is signalled when there is bio feedback active (1) or inactive (0) above lock
This event can be signalled when a handsfree device needs to request Cortana to cancel speech activity.
Set to 0 (inactive) or 1 (active).
This event signals a start layout change to a background task so that assets can be retrieved if necessary. Payload is PlaceholderTileWnf.
This event is signalled when there is a change to the Pinned People list
Current lock state of the device. Payload is DEVICE_LOCKSTATE. On multisession SKUs, everyone can read while only SYSTEM can write. On single session SKUs, everyone can read while only DefaultAccount can write. On single session SKUs, also include allow list from the SDDL for DEVICE_LOCK_STATE. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
Event is for the shell to notify when app spatial information has changed. Payload is ApplicationSpatialInformationWnf struct.
Indicates the state of Cortana speech input and output.
This event signals that the LockScreen info is updated.
This event notifies the CDM when a new feature configuration is first used. The SDDL is scoped to AuthenticatedUsers, AppContainers and LPACs (CAPABILITY_SID_LpacAppExperience)
This event is signals when an application launches. The Payload is the appID.
This event is signals when an application is terminated. The Payload is the appID.
This event is signals when a request is made to show a Windows Tip bubble. The Payload is the content id(String).
This event signals when the first time a user is idle after logon. The payload is the time the user has been idled for
This event is signalled when there is a change to the People Pane Views
This event signals that the lock screen should be reset due to a re-lock request.
This event signals that the lock screen is ready after a reset was requested.
This event is scoped to the user session and signaled when the desktop is ready after a logon
This event signals when the health state of the device changes
This event signals that Content Delivery Manager content needs remediation
This event is signals when a desktop application launches. The Payload is the executable name.
This event is signals when a desktop application is terminated. The Payload is the executable name.
This event signals that the app launched by sign in suggestions is ready.
This event is scoped to the user session and signaled when the CDM registration is complete
This event signals that Content Delivery Manager Cache Monitoring is Enabled or not.
Used to signal logon controller across the desktop boundary. Only local system or the composer can read and write. Currently payload is present but ignored.
This event signals when the HidePeopleBar MDM policy has been updated
This event signals when cortana speech training for 'Respond only to me' is complete
This event notifies the CDM when a feature configuration is used
This event signals when OOBE in a Shell has completed its provisioning flow. It is permanent since provisioning is only supported during first user OOBE.
This event signals when the signal manager fires a signal
Notification is incremented / signaled when a cloudfile state change is detected by the indexer service. Payload is count of changes. User can subscribe, but only service (indexer) can publish
Notification when a sync client or shell session updates in-memory progress within the indexer service. Payload is the tick count when the last change occurred. User can subscribe, but only service (indexer) can publish
This event signals when Start Experience Host completes a layout migration
This event signals when a Start place MDM policy (AllowPinnedFolder*) has been applied
This event is used by the Signal Manager for WIL Feature Usage subscriptions required by registered signal triggers.
This event signals the current view state of action center.
State of the network as reflected by shell32 listeners. Subscribed to, and published from, explorer.exe, a user process.
This wnf is used for testing purposes.
This event signals for different app install state from the Store. The Payload is the aumId and app state.
CDS restore payload data is downloaded during OOBE
This wnf is signaled everytime the user connects an autoplay device. The payload is the device id (VID and PID).
This wnf is signaled when Cortana's QuietMoment @Home inferred that the user has arrived of left home .
This wnf is signaled everytime the Action Center/Cortana beacon state changes. Payload is an int mapping to an enum representing the new state.
This wnf is signaled whenever active quiet hours profile/mode changes. The value is the restrictive level of an active profile and the restrictive level is unique per profile
This wnf is signaled when WinLogon detects an automatic lock on logon sequence to optimize displaying the user lock screen when the shell is ready.
This wnf indicates for some types of devices if a lid, cover or enclosure around it is closed (zero value) or open (non-zero value).
This event signals a creative event has been triggered that will allow to run during battery saver
This event allows user-mode services such as Windows Notification Platform to determine when Start is suspended
This event signals when a new System Dialog toast is published
This wnf indicates that a variable in the settings environment has changed. The payload is the current sessionId.
This event signals when Quiet Hours game mode state changes
A system-wide unique rolling id for notification controller sink sessions
Event signals Tab Shell component initialization is complete, potentially after an explorer crash. Payload is an incrementing DWORD that can be used to poll if the current objects are new.
Set to 0 or 1 to indicate whether lockapphost is currently active. Anyone (including apps) can read, system has write access (but on multi-session skus authenticated users also have write access). Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
This wnf indicates that a cortana capabilties have changed. The payload will be the changed capabilties. The below sids are the cortana app and test app sids
This event indicates taskbar pins were updated. The SDDL is scoped to AuthenticatedUsers.
This system-scope event is signaled each time the shell attempts to start a local session on WCOS-based SKUs. It carries the latest session ID. Everyone can read from it. Authenticated users can write to it. Apps in general can read from it. Apps with WINCAP_SHELL_EXPERIENCE_COMPOSER can write to it.
This wnf indicates that the assistant state has changed, e.g Talking, idle, thinking, notification pending etc
Used to notify the PIN list that a PIN has been enrolled and that it should refresh.
Used to notify the Delay Lock settings that Biometric enrollment has been modified.
A file has changed on storage and a request is received to sync.
A user's quota has changed.
This event triggers when the user revokes SMS access.
This event triggers when the system has multiple memory channels and memory cooling can be started
This notification is issued when a property of an object changes
This notification is issued to request work in user-mode
Indicates the state of the shared recognizer.
Indicates the data pertaining to a remote request to start/stop a speech recognition session. Published by BTAGService and HidSrv
Indicates the KWS request from a remote device. Certain peripherals that support in-built KWS may request the system to disable the KWS runnning on Windows. Published by BTAGService
Sent when a screen on study session starts or ends
This event signals when the server (SRV2) start/stop
This event signals when the server didn't discover SMB1 usage for a specific period
This event indicates a change in the mount state of an SD card.
This event indicates a change in the volume status of an SD card.
This event indicates a change in the free space state of storage.
This event indicates a change in the temp file cleanup state of storage.
This event indicates completion of an update of storage usage categories.
This event informs the system tray that the date-time has changed
This event informs StorSvc that SHSVCS received a device handle event.
This event indicates a change in the app pairing state of an SD card.
Enable the Error Details Cache
The state is published when the system has begun the shutdown or reboot process.
Internet available or not
Free network available or not
SMS has been received
Network state has changed
Radio Operator Message received
Network control channel triggers have been reset
Time zone change
Online ID connected state changed. SDDL comes from ID_CAP_EVERYONE in %SDXROOT%\src\baseos\prod\packages\WLId\WLId.pkg.xml
system is idle or not
System is idle or not
System is domain joined or not
System has booted
System has at least 1 user present
System is AC or DC
Monitor is ON or OFF
IP address is available or not
Indicate a change in the background work cost
Background work cost is high or not
System is in Low Power Epoch or not
Smart card transaction notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
System is in good state for maintenance
Geolocation service should be started
OEM custom notification received
MO custom notification received
Cached file has updated
Smart card field entry/exit notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
Smart card HCE application activation notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
Unused notification
Unused notification
Low-latency power request notification
Resiliency phase notification
Fullscreen video playback notification
Indicates high-performance boost mode for critical NFC background activity
Indicates app launch pre-fetch phase
Unused notification
Indicates app resume phase
Unused notification
Unused notification
Unused notification
Unused notification
Unused notification
Call state change notification
Voicemail change notification
Call history change notification
Phone line change notification
Airplane mode disabled for emergency call notification
Registration state has changed
Radio state has changed
Pin lock state has changed
Device service command has been received
Default Sign In account has changed
Network connectivity in Standby
User presence changed
Audio activity in progress
Fullscreen HDR video playback notification
Indicates UWP app launch phase
Pco data has been received
Mixed reality notification
Game mode scenario
Signals a change caused by SystemParametersInfo(SPI_SETLOGICALDPIOVERRIDE). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
This is triggered when the Primary monitor's DPI is different than the session's DPI.
The computer has changed density mode. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Indicates a hotkey was pressed
This is fired every time an SENSE's storage fullness crosses into a new tier or is reset. struct { DWORD PercentageFull[4]; }
This is fired every time an SENSE's daily upload quota crosses into a new tier or is reset. struct { DWORD PercentageFull; }
This is fired every time a onesettings namespace is updated. {UINT64 SettingsCount; struct {UINT64 NamespaceHash; UINT64 TimeLastChanged;}[16]}
This is fired every time a push notification is received from the OneSettings service. UTF8 string.
This is fired every time a UTC service timer changes its configuration values so subscribers can call GetTimerConfiguration to check any new values.
Bitmask containing the current relevant call states. Any 3rd party app is allowed to listen to this. See PhoneWnf.h for valid values. SID referenced below is that of the Phone service.
Bitmask containing the call forwarding state for phone line 0. See PhoneWnf.h for valid values. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
BOOL indicating whether the Phone service has been initialized. SDDL comes from phoneCall and ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%%\src\src\comms\Packages\CommsPlat\Comms.pkg.xml
BOOL indicating whether SimSec is ready to receive requests. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml
Wide string indicating the call annotation provider's RPC endpoint name. SDDL comes from ID_CAP_CALLMESSAGING_FILTER and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
BOOL indicating whether the line is ready. SDDL comes from PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
State name for the Tethering service notification of all state changes
State name for starting Tethering service over Bluetooth
Input Mode Indicator label IME want to show on systray. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
Explicit IME private mode status. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
Automatic IME private mode status.
Notifies when the theme of the system changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Time Zone Legacy store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Time Zone store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
This state is notified when the timezone is changed via SetTimeZoneInformationByID - The data value is a UINT that indicates the new TZID. SDDL comes from ID_CAP_BUILTIN_SETTIME, ID_CAP_EVERYONE and tzautoupdate in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
This event has information about last time sync. SDDL comes from autotimesvc's account.
This event is used to trigger Network Sync. SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml
This state is notified when autotimeupdate state changed. The data value is a DWORD that indicates if autotimeupdate is enabled (1) or disabled (0). SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml
Touch Event
The touch keyboard's appearance on the screen has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The restricted mode touch keyboard's appearance on the screen has changed.
An immersive application has encountered a focus change. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
An application encountered a touch down/up event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
An application encountered a touch down/up event
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Caret tracking has updated on the desktop. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The autocomplete window has been updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Determines whether focus is in an editable field for the purposes of the modern keyboard. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The view being shown by the touch keyboard has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The view being shown by the restricted mode touch keyboard has changed.
The keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The restricted keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact.
The candidate window state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The layout being shown by the touch keyboard has changed.
The layout being shown by the restricted mode touch keyboard has changed.
The composition state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A System Mode Application(Logon/OOBE) has encountered a focus change
A System Mode application(Logon/OOBE) encountered a touch down/up event
The edit control in focus has changed the input pane display policy (manual/automatic). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The system is in desktop mode but the user prefers tablet-mode IHM behavior. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The touch keyboard should show or hide. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Update the show/hide status of touch keyboard that is being tracked in tabtip. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
This state name is used to notify system components about state changes in the Token Broker
This state name is used to notify apps about state changes in the Token Broker
This state name is used to notify apps about state changes in the Token Broker
This event signals when the Win32_TPM provider has completed taking ownership of the TPM.
This event signals the state of the TPM-based DeviceID.
This event triggers the TPM provisioning/status check to run.
This event signals a TPM Clear will be attempted.
This event signals if ownership was taken during TPM Provisioning and the result of TPM Clear on last reboot.
This event signals a TPM Disable or TPM Deactivate will be attempted.
This event signals after the TPM is Enabled or Activated.
This event signals the TPM maintenance task status.
The machine power source state
The machine console monitor on/off state
The user is present and machine is on batteries and the battery level is above firmware update thershold
The machine entered pre shutdown phase
Trigger the Driver Manager service start
State name indicating the status of the UMDF driver manager
Signals that a state transition occurred for an update session.
Signals that a state encounter a condition that requires attention.
Signals the a change in progess of an update session.
Signals that a reboot is required to complete the update session.
Signals that the current active session is changed.
Signals that updates have installed successfully on lite servicing stack.
Signals that the machine's up to date status has changed.
Signals that USO should not reboot the system.
Signals that update download has started on lite servicing stack.
Signals that update install has started on lite servicing stack.
Signals various install states on lite servicing stack.
Signals that USO is stopping.
Signals that USO settings have been refreshed.
Signals that USO active hours have started.
The content of a user dictionary has changed (word either added or removed). SDDL SID's come from capability ID_CAP_INPUT_CORE (both application and service SID's), and DefAppsCapabilitiesGroup
Shell Infrastructure host is ready.
The user was logged in to the system.
The user was logged out of the system.
Default system user, as defined by start view, has changed.
Token for the session user changed.
Session active shell user changed.
The user tile for the specified SID was changed. The payload is the String user sid and the datasize is the byte count of MAX_PATH.
The VAN UI open close status
Notification for syncing CDS WebCredential store
The VPN Client connectivity status. SDDL gives RasMan read/write permissions, rescap:networkingVpnProvider read permissions, and Authenticated User read permissions.
WaaS Assessment Impact level for quality update
WaaS Assessment Impact level for feature update
This event signals when a WCM-managed network interface has been added or removed
Connection Manager service restart
WNF state for refreshing WCM service mapping policies cache
WNF state for refreshing WCM's selection multiplex table and selectable connection list
This event signals when a WCM-managed network interface has changed its connection quality state
the data of this state is 1 when the global data usage state is less than or equal to OVER_LIMIT, otherwise it is 0
the data of this state is 1 when the global data usage state is less than or equal to OFF_TRACK, otherwise it is 0
the data of this state is 1 when the global data usage state is less than or equal to ON_TRACK, otherwise it is 0
the data of this state is 1 when the global data usage state is less than or equal to UNDER_TRACK, otherwise it is 0
the data of this state is 1 when the global data usage state is less than or equal to NOT_TRACKED, otherwise it is 0
State name for Cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
The state is 1 when a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
The state is 1 when Radio is active or a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
The state is 1 when Cellular data is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System
The state is 1 when WiFi is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System
Trigger task scheduler to launch task for toast
The state is 1 when cellular internet connection is not allowed to any UWP Application running in background, the state is 0 when cellular internet connection is allowed to any applications running in foreground or background.
A Settings for WDAG requiring the user context has changed.
A Settings for WDAG requiring system context has changed.
This event triggers a refresh for the account pillar state
This event signals CTAP device state changes.
This event signals CTAP device was inserted or tapped.
The WER service needs to start. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
The number of reports queued to the machine store. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
Information about applications currently crashing.
State name for Wifi radio and connection status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
State name for Wifi CPL status flags
Notifications received from the WiFi Conn Svc. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
State name for Wifi Hotspot Host ready flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
State name for Wifi power status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
State name for Wifi connection status and connection score updates
State name for Wifi network tiles updated. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
Average peak transmitted traffic seen by NCSI
Last media streaming mode state change
State name triggering WiFiNetworkManager background task. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
State for triggering browser UI when a network is hijacked. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
This event sends notifications from wlansvc
State name for triggering hotspot2 registration status from online signup server
Signals that the Wi-Fi stack is handling an important scenario which must be protected from disruptive activity such as unexpected scans, or activity on a shared radio.
Event indicating that the user may have moved to a different location based on nearby AP RSSI and other signals. Value is a counter indicating how many times movement has been detected.
State name for starting the WLAN scheduled task.
Reports properties about a Wi-Fi Display disconnect
Event indicating that the user may have moved to a different location during the Infracast session. Value is a counter indicating how many times movement has been detected.
Event indicating the current state of the infra walk-away listener. 0: Listening, 1: User elected to stay connected, 2: Auto Disconnect was triggered, 3: Session ended without triggering movement detection.
Event indicating the Normal feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
Event indicating the Boot feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
Event to indicate the first use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate the first use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate the first use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate unique use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate unique use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate unique use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (4). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (5). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event to indicate uniquely observed code failures on this device (6). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event indicates modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event fires once per boot on modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event indicates modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event fires once per user session on modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
Event indicates there is unique and custom usage of a feature. This is for SRUM consumption. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582
This event is fired when an enrollment completes, either successfully, or unsuccessfully.
Triggered each time there is a configuration change in WinRE
This WNF event fires when the OEM, MO, and Device Hardware values change in the registry.
This WNF event fires when the MO discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
This WNF event fires when the OEM discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
State stores the number of per-user updates for the current user
Triggered each time an AU scan is completed
State stores information regarding WU call hangs
State stores information regarding WU service hangs
Triggered when a StageUpdate call has completed for a phone update installation.
Indicates an update will expire on the next WU service scavenge task. The data type is a GUID which represents the update ID.
A network proxy has been discovered. WinHttpAutoProxySvc can write, NlaSvc can read.
A proxy has returned a 407 status code.
Mirrors the state of CEIPEnable and CEIPSampledIn registry settings.
The WNS Connection Provider connectivity status
Overlay configuration change
System sharing status changed
ICS DHCP IPv4 lease list changed
New assigned Fast-IP Address(es)
This is the current stream state of a camera for a process in a given session
This is the current device state
This is stream activity indicator
This is stream activity indicator
This is user global camera privacy state indicator when switched via physical button
Time Broker has finished processing a change ot time
BOOL + UserContextToken indicating whether the UserDataService service has been initialized for the specified user. On OneCore, SDDL gives read access to callers with userDataSystem/userDataSystem capablity group and all access to IU/AU/System. On phone, SDDL comes from ID_CAP_APPOINTMENTS, ID_CAP_COMMS_COMMON, ID_CAP_CONTACTS, ID_CAP_EVERYONE, ID_CAP_PLATFORM_EXTENSIBILITY, UserDataSvc and ID_CAP_SMS in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
State name for aggregate sort and display order changes. SDDL comes from ID_CAP_COMMS_APPLICATIONS and ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
The application specific context has changed in steady state. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
The currently focused application has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
An application is activating.
The currently focused application component has changed.
A new toast notification has been delivered to the shell.
A package is about to be unmounted from the System OS ready to launch it on the Title OS.
A new application package has been added or an existing one has been removed.
Idle dimmer has changed state.
An application package has been removed.
An application is no longer running.
An optical disc or other media has been detected with content.
Application error handler
Handler for achievement cache and game save storage
Connectivity to the Xbox LIVE service has changed.
System Title Authentication status has changed.
A new achievements-related raw notifications was received.
ERA VM status has changed.
One or more application layouts changed.
System Idle Timeout has changed.
System constrained status has changed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
Application's COM resiliency status has changed.
Default system user, as defined by start view, has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
A storage device was either plugged or unplugged.
The system is exiting silent boot mode.
The license used by the application has changed.
The system shell is initialized and ready.
Pass 3 system update has progressed and is sending a notification.
The MSA and WNS environments have been configured to match the XBL environment.
The visibility of the Software Input Pane has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
Game streaming state has changed.
It is possible to transfer focus away from the Software Input Pane.
SMB shares have been launched.
A snap of XBBlackbox has occurred
Maintenance work is allowed in low power mode
ERA launch notification with XBL title info
Status of attached storage devices
A storage device, or its contents, have changed
Current state of the streaming package
The install streaming queue contents have changed
An update is available for installing content.
A change has been made to the pre-indexed state repository.
The number of LiveTV tuners connected to the system has changed
A change has been made to the package cache.
The WPN platform host is initialized and ready.
The rectangle visual of the Narrator has changed.
A package is about to be unmounted from the System OS for uninstall.
A module requested for an ltv command to be issued.
An entity has changed in the shell data cache.
The visibility of the Cortana Overlay view has changed.
Number of unread notifications for the current system user.
Extended resource mode has been toggled
Indicates whether the shell is in the process of auto-signin. Payload is UINT32 with a 1 or 0.
A local user has signed out remotely via SPOP.
Indicates whether the Narrator is enabled. Payload is UINt32 with 1 (enabled) or 0 (disabled).
A global speech command was recognized that translates to a controller button press.
The current user of the application has changed.
ERA VM Instance has come up or gone down
Idle monitor timer should be reset due to user activity.
Notification for when TV grammars for cortana needs rebuilding
Notification for when signed in users change results in rebuilding grammars for cortana
An application that requires Kinect has connected to the NuiService.
Adjust an app's CPU affinity if in constrained mode
The active shared video player host has changed.
The video player app has changed internal state.
The video player app has changed playback progress.
Indicates whether the safe area setting is enabled. Payload is UINT32 with a 1 or 0.
The application providing audio from the background has changed.
Indicates that the desired keyboard locale has changed.
The local gamer account has signed in or out. Payload is uint32 representing sessionid
ERA VM IO priority has been changed
Input device changed for OneCore speech
Notification for when the active user of Cortana changes from signing in/out/switching user
The exclusive input modality for an accessibility component changed
Proactive notification service is triggered
Notification for when the Achievement Tracker's state should change
Event to trigger direct activation of xbox guide when nexus is pressed
A title SPOP veto has been received.
A new library-related raw notifications was received.
A new messaging-related raw notifications was received.
A new people-related raw notifications was received.
A new multiplayer-related raw notifications was received.
A new live tv-related raw notifications was received.
A new SystemUI-related raw notifications was received.
A new club-related raw notifications was received.
A new club chat-related raw notifications was received.
A new settings-related raw notifications was received.
Notification of whether any media is playing.
An expandedResources app has gone inactive.
The maximum age rating currently permissable has changed.
Notification for when the Party Overlay's state should change
A cloud settings collection was updated
ERA Fast Iteration Mode has changed.
The Network Transfer Manager's constrained mode changed.
Narrator input learning mode changed.
Initialization of the skeletal tracking pipeline should be suspended / resumed.
Immersive background or connected animation setting changed.
Copy on LAN upload state has changed.
Event to trigger direct activation of xbox dashboard.
A new Command Service raw notification was received.
A notification settings was updated
Indicates whether there are any enrolled users.
Triggered when the lock screen is dismissed to kick-off trusted signals.
This event indicates the state of a USB Type-C connector's partner device.
This event indicates that the number of Billboard devices in the system has changed.
This is the state of a peer device.
This event indicates the USB charging state for this Windows device.
This event indicates the state of a USB function controller, such as detached, or attached, and successfully enumerated with host PC.
This event indicates that a USB error notification needs to be published.
This indicates that the hub collection in USB Policy Manager has changed.
This event indicates the state of a USB XHCI controller's audio offload state.