Windows Application event log
Classic Windows Event Log Application channel. Covers application crashes and hangs (Application Error/Hang, WER reports, .NET unhandled exceptions), MSI install outcomes (retry-later result codes read as benign), profile-load failures, ESENT and SQL Server corruption records, AD CS CRL and chain failures, and vendor GPU and service failures. Nothing is deleted: licensing, vendor and transaction chatter is retained at the Debug severity tier. Some events state a severity that does not match their real impact; the stored severity is authoritative, and severity_original keeps the event's own value when the two differ.
Feed id: win.eventlog.application.
Channels
This feed reads one Windows Event Log channel, Application.
Curated reasons
Severity here is what the condition is worth to the person holding the ticket, not the level the provider stated for itself.
adcs_ca_chain_failed
Active Directory Certificate Services reported a CA chain or publication failure family event.
Severity: Error
Impact: Certificate trust or revocation publishing may be unhealthy until the CA issue is corrected.
Channel: Application
Provider: Microsoft-Windows-CertificationAuthority
Event ids: 58, 65, 66
Where to look next:
- Check CA chain, CRL, and distribution-point health together.
- Read adjacent CertificationAuthority events before assuming the exact sub-family.
Related reasons:
adcs_crl_publish_failed: same AD CS Application providercert_enroll_failed: clients may later fail enrollment or trust checks
adcs_crl_publish_failed
Active Directory Certificate Services reported a CRL publication failure.
Severity: Error
Impact: Revocation checks may fail or use stale data once the published CRL expires.
Channel: Application
Provider: Microsoft-Windows-CertificationAuthority
Event ids: 74
Where to look next:
- Check the CA, CRL distribution point, and CRL freshness.
- Read adjacent CertificationAuthority events before assuming the exact sub-family.
Related reasons:
adcs_ca_chain_failed: same AD CS Application providercert_enroll_failed: clients may later fail enrollment or trust checks
app_crash
A Windows application process crashed.
Severity: Error
Impact: The app exited unexpectedly; user work, background processing, or service functionality may have been interrupted.
Channel: Application
Provider: Application Error
Event ids: 1000
Where to look next:
- Group by app name, faulting module, exception code, and report id.
- Check for recurrence after updates or driver changes.
Related reasons:
app_crash_report: WER report record for a crash familyapp_hang: app stopped responding rather than crasheddotnet_unhandled_exception: managed exception crash record
Fields it can set: win.eventlog.application.app_name, win.eventlog.application.exception_code, win.eventlog.application.module_name, win.eventlog.application.report_id
app_crash_report
Windows Error Reporting recorded a crash or hang report.
Severity: Notice
Impact: The report can join crash recurrence by bucket, app name, and report id even when the primary crash event is missing.
Channel: Application
Provider: Windows Error Reporting
Event ids: 1001
Where to look next:
- Use EventName to separate crash reports from unrelated WER report types.
- Group by fault bucket and report id for recurrence.
Related reasons:
Fields it can set: win.eventlog.application.app_name, win.eventlog.application.event_name, win.eventlog.application.fault_bucket, win.eventlog.application.report_id
Event id 1001 also carries BlueScreen, PnP, Store install, and other report families. The reason only applies to crash-shaped EventName values.
app_hang
A Windows application stopped responding and was closed.
Severity: Error
Impact: The user-facing app or background process became unusable until Windows terminated it.
Channel: Application
Provider: Application Hang
Event ids: 1002
Where to look next:
- Group by app name, report id, and hang type.
- Check whether hangs cluster around updates, add-ins, or file paths.
Related reasons:
app_crash: process terminated by crash rather than hangapp_crash_report: WER report record for crash and hang families
Fields it can set: win.eventlog.application.app_name, win.eventlog.application.hang_type, win.eventlog.application.report_id
aspnet_compilation_failed
A web application on this host could not be compiled and is not serving requests.
Severity: Error
Impact: Every request to that application fails until the source or the deployment is corrected. Other applications on the host are unaffected.
Channel: Application
Provider: ASP.NET <version>
Event ids: 1310
Where to look next:
- Read the compiler error and the file it names from the message.
- A compilation error immediately after a deployment usually means the deployment was partial.
- Confirm whether the application answered at all in the window before the first occurrence.
Related reasons:
aspnet_unhandled_exception: one request failing inside an application that otherwise worksiis_apppool_failed: the application pool itself failing rather than the application code
aspnet_unhandled_exception
A web application on this host raised an unhandled exception while serving a request.
Severity: Minor
Impact: That request failed for the user who made it. The application keeps serving other requests.
Channel: Application
Provider: ASP.NET <version>
Event ids: 1309
Where to look next:
- Read the exception type and stack from the message before treating this as an infrastructure question.
- A count that jumps after a deployment points at the deployment.
- A steady low rate is normal for most web applications.
Related reasons:
aspnet_compilation_failed: the application failing to build at all rather than failing one requestiis_worker_crash: the worker process hosting the application terminating
cert_enroll_failed
A Windows certificate enrollment failed or did not complete. Enrollment against a Microsoft attestation-identity endpoint that no longer serves requests is labeled separately as expected noise.
Severity: Warning or Verbose
Impact: Certificate-dependent authentication, attestation, or device trust workflows may fail later.
Channel: Application
Provider: Microsoft-Windows-CertificateServicesClient-CertEnroll, Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Event ids: 1, 6, 86, 87
| Case | Severity | Ticket class |
|---|---|---|
failed | Warning | certificates |
retired_aik | Verbose | certificates |
autoenroll_cycle_failed | Warning | certificates |
Where to look next:
- Review enrollment URL, status, and template or policy context in the event.
- Check whether the device later received the expected certificate.
Related reasons:
adcs_ca_chain_failed: CA chain or publication issue can block enrollment trustadcs_crl_publish_failed: CRL publication issue can block revocation checkscert_expiring: the consequence when enrollment keeps failing: a certificate reaches its expiry with no replacement
The retired-endpoint shape needs no action: the endpoint no longer serves requests. It repeats on consumer TPM devices and is kept out of the attention bands.
cert_expiring
A certificate held by this machine is about to expire or has already expired, and has not been replaced.
Severity: Warning
Impact: Nothing fails until something asks for the certificate. When something does, it fails with an error that usually names neither the certificate nor its age: a service refusing connections, a network sign-in rejected, or a trust check that stops passing.
Channel: Application
Provider: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Event ids: 64
Where to look next:
- Check whether the same thumbprint keeps being reported, which means the renewal is not happening.
- Read the enrollment failures on the same provider: they usually name why the renewal cannot run.
- Confirm the machine can reach a domain controller and the certification authority.
- Check the certificate template's autoenrollment permissions for the machine account.
Related reasons:
cert_enroll_failed: the enrollment attempt that would have replaced it failing
dotnet_unhandled_exception
A .NET application terminated because of an unhandled managed exception.
Severity: Error
Impact: The affected .NET app stopped unexpectedly; repeated events can point to an application defect, dependency issue, or bad input path.
Channel: Application
Provider: .NET Runtime
Event ids: 1026
Where to look next:
- Inspect the exception type and application name in the event message.
- Correlate with deploy, update, and dependency changes.
Related reasons:
app_crash: native Application Error crash recordapp_crash_report: WER report record for crash families
entra_password_hash_sync_failed
Password hash synchronization failed for an on-premises domain.
Severity: Error
Impact: Password changes made in that domain do not reach the cloud directory, so affected users sign in to cloud services with an outdated password.
Channel: Application
Provider: Directory Synchronization
Event ids: 611
Where to look next:
- Read the domain and the domain controller from the message and confirm the controller is reachable.
- One occurrence around a controller restart is expected; a repeating pattern is not.
Related reasons:
entra_sync_run_failed: a synchronization run that did not completeentra_sync_scheduler_aborted: the scheduler thread stopping, which stops every cycle
entra_sync_run_failed
A directory synchronization run profile failed to complete.
Severity: Error
Impact: The changes that run profile carries did not move on this cycle. Repeated failures leave the cloud directory progressively out of date.
Channel: Application
Provider: ADSync
Event ids: 6056
Where to look next:
- Read the connector and run profile names from the message.
- Check the connector's own run history in the synchronization console for the underlying error.
Related reasons:
entra_password_hash_sync_failed: password hashes specifically failing to reach the cloudentra_sync_scheduler_aborted: the scheduler stopping, which prevents every run
entra_sync_scheduler_aborted
The directory synchronization scheduler stopped, so no further synchronization cycles run on this server.
Severity: Error
Impact: Directory changes stop reaching the cloud directory from this server until the synchronization service is restarted.
Channel: Application
Provider: Directory Synchronization
Event ids: 906
Where to look next:
- Restart the synchronization service and confirm cycles resume.
- Read the exception in the message: memory exhaustion points at the host rather than at the product.
- Confirm whether this server is the active one or is in staging mode.
Related reasons:
entra_password_hash_sync_failed: password hashes specifically failing to reach the cloudentra_sync_run_failed: a single synchronization run that did not complete
esent_db_corruption
ESENT reported embedded database corruption or a corruption-adjacent failure.
Severity: Error
Impact: Windows features backed by that embedded store may fail, rebuild state, or lose local cached state.
Channel: Application
Provider: ESENT
Event ids: 447, 448, 474
Where to look next:
- Identify which ESENT database path or component is named in the event.
- Correlate with Search, SRUM, token broker, profile, or OS feature symptoms.
Related reasons:
mssql_db_corruption: SQL Server database corruption is a separate workload provider
gpu_driver_error
The NVIDIA display stack reported a warning-or-worse driver error.
Severity: Notice at most; native level decides below
Impact: Users may see display resets, graphics hangs, application crashes, or GPU-accelerated workload interruption. A single event is commonly benign: driver upgrades reset the display stack.
Channel: Application
Provider: nvlddmkm, NVIDIA OpenGL Driver
Where to look next:
- Check whether a GPU driver was installed or updated around the same time.
- Look for REPETITION without an adjacent driver install: rate is the signal here, not any one event.
- Inspect GPU driver version, hardware health, and workload timing.
This reason names a provider-level driver-error family, not a specific mechanism.
group_policy_cse_apply_failed
A Group Policy preference extension could not apply the settings from a policy object.
Severity: Minor
Impact: None of that policy object's preference items were delivered to the affected user or machine on this refresh.
Channel: Application
Provider: Group Policy Shortcuts, Group Policy Files, and the other preference extensions
Event ids: 8194
Where to look next:
- A network path error normally means the host could not reach the policy share at that moment.
- Repeated failures on the same host are the shape worth investigating, not one occurrence.
Related reasons:
group_policy_drive_map_failed: the drive-mapping extension's own diagnostic of one mappinggroup_policy_pref_item_failed: a single item failing rather than the whole extension
group_policy_drive_map_failed
A Group Policy drive mapping did not complete on this host.
Severity: Warning
Impact: The affected user does not have the mapped drive for that session. Nothing else on the machine is affected, and the mapping is attempted again at every policy refresh.
Channel: Application
Provider: Group Policy Drive Maps
Event ids: 4117
| Case | Severity | Ticket class |
|---|---|---|
share_unreachable | Warning | device_management |
network_name_invalid | Warning | device_management |
credential_rejected | Minor | device_management |
letter_in_use | Notice | device_management |
other_error | Warning | device_management |
Where to look next:
- The error name in the tail says which question to ask: reachability of the server, resolution of the name, or the stored password.
- A rejected stored credential repeats against the share at every refresh and can lock the account out.
- The drive letter and the share ride the event as fields, so the same share failing across many hosts is one query.
Related reasons:
group_policy_cse_apply_failed: the whole preference extension failing rather than one mappinggroup_policy_pref_item_failed: the same failure recorded by the preference item itself, across every preference extension
Fields it can set: win.eventlog.application.drive, win.eventlog.application.share
group_policy_pref_item_failed
A Group Policy preference item did not apply on this host. A refused stored credential is held one rung higher, because no later refresh can improve on it.
Severity: Minor or Warning
Impact: The configured item is missing for the affected user or machine. The rest of the policy object applied normally.
Channel: Application
Provider: Group Policy Shortcuts, Group Policy Files, and the other preference extensions
Event ids: 4098
| Case | Severity | Ticket class |
|---|---|---|
credential_rejected | Minor | device_management |
other_error | Warning | device_management |
Where to look next:
- Read the item name, the policy object and the error code from the message.
- Access denied and file-not-found on a preference item usually mean the source path or its permissions changed.
- An item failing at every refresh will not clear itself.
- A refused stored credential repeats against the target on every refresh and can lock the account out.
Related reasons:
group_policy_cse_apply_failed: the whole preference extension failing rather than one itemgroup_policy_drive_map_failed: the drive-mapping extension's own diagnostic of the same conditions
mfa_login_succeeded
A sign-in completed with its second factor verified.
Severity: Info
Channel: Application
Provider: Duo Security
Event ids: 0
Where to look next:
- Read these beside the fail-open rows on the same host: the ratio is what says how long a gap lasted.
- The absence of these on a host that has the product installed is itself the finding.
Related reasons:
mfa_unavailable_access_granted: a sign-in allowed through without the second factormfa_user_not_enrolled: a sign-in refused for an account with no second factor registered
mfa_not_configured
A multi-factor logon agent is installed on this host but holds no configuration, so it enforces no second factor.
Severity: Warning
Impact: Sign-ins on this host complete with a single factor while the product is present and appears deployed.
Channel: Application
Provider: Duo Security
Event ids: 0
Where to look next:
- Confirm whether this host is inside the intended rollout scope.
- Compare against hosts of the same group that do enforce, to see whether the gap is deliberate.
Related reasons:
mfa_unavailable_access_granted: a configured agent that could not reach its verification service
mfa_unavailable_access_granted
A sign-in was allowed without its second factor because the multi-factor service could not be reached.
Severity: Error
Impact: Multi-factor authentication was not applied to that sign-in. While the service stays unreachable, sign-ins on this host continue to complete with a single factor.
Channel: Application
Provider: Duo Security
Event ids: 0
Where to look next:
- Check network reachability from this host to the verification service.
- Count these against successful sign-ins on the same host to see how long the gap lasted.
- Review the configured failure mode: allowing the sign-in through is a deliberate setting.
Related reasons:
mfa_login_succeeded: the sign-ins where the second factor did completemfa_not_configured: an agent that enforces nothing because it holds no configuration
mfa_user_not_enrolled
A sign-in was refused because the account is not enrolled with the multi-factor service.
Severity: Notice
Impact: The user cannot sign in on this host until the account is enrolled or excluded from the policy.
Channel: Application
Provider: Duo Security
Event ids: 0
Where to look next:
- Enrol the account, or place it in the exclusion the policy intends.
- Service accounts appearing here usually need a policy exclusion rather than an enrolment.
Related reasons:
mfa_login_succeeded: sign-ins where the second factor completedmfa_unavailable_access_granted: a sign-in allowed through without a second factor
mssql_db_corruption
SQL Server reported database I/O failure, logical page corruption, or a read retry warning.
Severity: Critical, Error or Warning
Impact: A SQL database may have corrupted pages or an unreliable storage path; affected data or application workloads can be at risk.
Channel: Application
Provider: MSSQLSERVER, MSSQL$<instance>
Event ids: 823, 824, 825
| Case | Severity | Ticket class |
|---|---|---|
io_error | Error | database |
logical_corruption | Critical | database |
read_retry | Warning | database |
Where to look next:
- Identify the database, file, page, and storage path named in the event.
- Treat 824 as confirmed corruption and 825 as early storage warning.
Related reasons:
esent_db_corruption: embedded Windows ESENT store corruption, not SQL Server
office_subscription_licensing_failed
The subscription licensing check for the installed office suite failed.
Severity: Warning
Impact: The suite keeps working on the licence it already holds. If the check keeps failing, the applications eventually drop to reduced functionality and documents become read-only.
Channel: Application
Provider: Office 2016 Licensing Service
Event ids: 0
Where to look next:
- Check whether the same host reports it repeatedly, or only around periods of being offline.
- Confirm the signed-in account still holds a licence in the tenant.
- Check outbound access to the licensing endpoints from that machine.
remote_assist_session_started
A remote assistance session started on this host and a remote party could see the desktop.
Severity: Notice
Impact: Someone remote had a view of this desktop from this moment. Whether that was expected depends on whether a support session was arranged.
Channel: Application
Provider: Quick Assist
Event ids: 0
Where to look next:
- Confirm the session was arranged with the user before treating it as routine.
- Compare the time against the helpdesk record for that user.
- Unexpected sessions on a workstation are the shape support-desk impersonation leaves.
Related reasons:
security_agent_host_isolated: the endpoint agent cutting a host off the network
restart_manager_app_pending
Restart Manager could not shut down or restart an app during an update session.
Severity: Info cap
Impact: The update may need a retry, reboot, or user action to close the blocking app.
Channel: Application
Provider: Microsoft-Windows-RestartManager
Event ids: 10006, 10007
Where to look next:
- Join by Restart Manager session id when present.
- Review blocked app name, path, and status.
Related reasons:
win_msi_install_error: installer errors can pair with restart-manager blockerswin_msi_operation_failed: install failure may occur in the same update session
Fields it can set: win.eventlog.application.blocked_app, win.eventlog.application.blocked_app_path, win.eventlog.application.rm_session_id, win.eventlog.application.rm_status
security_agent_config_fetch_failed
A security agent could not retrieve its configuration because its credentials were refused.
Severity: Error
Impact: The agent takes no new configuration or detection content and drifts from the policy it is meant to enforce, while continuing to appear installed.
Channel: Application
Provider: HuntressAgent
Event ids: 4
Where to look next:
- Re-register the agent with a valid identifier and key.
- Check the vendor console for whether this host is reporting at all.
Related reasons:
security_agent_host_isolated: an action by the same agent when it is working
security_agent_host_isolated
An endpoint detection agent isolated this host from the network, or later released it.
Severity: Serious or Notice
Impact: While isolated the host cannot reach the network, so the user cannot work and the machine's other telemetry may stop arriving.
Channel: Application
Provider: HuntressAgent
Event ids: 1, 2
| Case | Severity | Ticket class |
|---|---|---|
isolated | Serious | endpoint_protection |
released | Notice | endpoint_protection |
Where to look next:
- Confirm from the vendor console whether the isolation was automatic or triggered by an analyst.
- Pair the isolation with its release before judging how long the host was off the network.
- The event names no threat: read the detection that preceded it in the vendor console.
Related reasons:
security_agent_config_fetch_failed: the same agent unable to reach its management service
vpn_dial_failed
A remote-access dial attempt failed.
Severity: Minor
Impact: The user did not reach the network through that profile on that attempt. A single failure is normally retried successfully; repeated failures on one profile are the tunnel rather than the user.
Channel: Application
Provider: RasClient
Event ids: 20227
Where to look next:
- Read the error code from the message: an authentication code points at the credential.
- Check whether the same profile connected successfully soon afterwards.
- The same profile failing across many hosts points at the concentrator, not the users.
Related reasons:
vpn_connected: a dial that succeeded, which is what makes a failure readable
vss_data_integrity_writer_failed
A backup writer for a database, mail store, virtual machine host, or directory service reported a failure during shadow copy creation.
Severity: Error
Impact: The backup of that data store may be incomplete or inconsistent, even if the backup job itself reported success.
Channel: Application
Provider: VSS, SQLWRITER
Event ids: 8193, 24581, 24582, 24583
What you see: A VSS or SQLWRITER event in the Application log naming a writer that fronts a data store (SQL Server, Exchange, Hyper-V, Active Directory, a failover cluster, a Certificate Authority) and the snapshot phase it failed in.
What it means: That writer could not do its part of the shadow copy: the backup of the store it fronts may be inconsistent or unusable even though the snapshot finished and the job reported success. VSS does not report a per-writer recovery, and the risk shows only at restore time.
What to do: Identify the named writer, then check the most recent restore point for the store it protects and the application's own log in the same window, where the cause is usually recorded.
When to ignore it: Ignore a registry probe from the writer service reporting an error constant beside a result of zero; that combination means success.
References:
- Microsoft Learn - Overview of Processing a Backup Under VSS: The phases a writer takes part in, which is what the failing operation names.
- Microsoft Learn - Volume Shadow Copy Service Overview: What a writer is and how it relates to the backup product that asked for the snapshot.
Example
A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur.
. Changes that the writer made to the writer components while handling the event will not be available to the requester.
Operation:
PrepareForSnapshot Event
Context:
Execution Context: Writer
Writer Class Id: {00000000-0000-0000-0000-000000000010}
Writer Name: SqlServerWriter
Writer Instance ID: {00000000-0000-0000-0000-000000000011}
Command Line: "C:\Program Files\Example\sqlwriter.exe"
Process ID: 4321
channel: Application
provider_name: VSS
event_id: 8229
SparkLogs: vss_data_integrity_writer_failed, Error, vss_data_integrity_writer_failed: NOTABLE: A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur. . Changes that the writer made to the writer components while handling the event will not be available to the requester. Operation: PrepareForSnapshot Event Context: Execution Context: Writer Writer Class Id: {00000000-0000-0000-0000-000000000010} Writer Name: SqlServerWriter Writer Instance ID: {00000000-0000-0000-0000-000000000011} Command Line: "C:\Program Files\Example\sqlwriter.exe" Process ID: 4321
Where to look next:
- Identify the named writer and verify the most recent restore point for that store.
- Check the application's own logs in the same window; the writer failure usually has a cause recorded there.
- Recurring failures for the same writer mean the protected data has no verified recent backup.
Related reasons:
vss_optimization_time_budget_reached: best-effort snapshot pruning giving upvss_snapshot_call_failed: a snapshot call that did not complete, harmlessly or notvss_writer_callback_query: VSS plumbing permission check that fails harmlesslyvss_snapshots_failing_for_space
Fields it can set: win.eventlog.application.vss_execution_context, win.eventlog.application.vss_operation_call, win.eventlog.application.vss_operation_intent, win.eventlog.application.vss_routine, win.eventlog.application.vss_writer
vss_legacy_driver_scan
The VSS System Writer could not read a driver binary while enumerating for a snapshot.
Severity: Info cap
Impact: None on its own. Snapshot enumeration continues and this event does not indicate a failed backup.
Channel: Application
Provider: Microsoft-Windows-CAPI2
Event ids: 513
Where to look next:
- Do not treat this line as evidence that a backup or snapshot failed.
- Confirm backup outcomes from the backup product's own job result, never from writer state.
Related reasons:
app_crash: a real backup-agent failure would appear as its own event, not as this one
vss_optimization_time_budget_reached
Shadow copy optimization did not finish excluding temporary files within its time budget.
Severity: Debug
Impact: The shadow copy is larger than it would otherwise be. Backup correctness is unaffected.
Channel: Application
Provider: VSS
Event ids: 8219, 8220, 8226
Where to look next:
- Persistent occurrences on a host with tight free space are worth a disk-space check, not a backup investigation.
Related reasons:
vss_writer_callback_query: VSS plumbing permission check that fails harmlessly
Fields it can set: win.eventlog.application.vss_execution_context, win.eventlog.application.vss_operation_call, win.eventlog.application.vss_operation_intent, win.eventlog.application.vss_writer
vss_provider_class_not_registered
A component the Volume Shadow Copy Service needs is not registered, so shadow copies cannot be created on this machine.
Severity: Error
Impact: Snapshot-based backups, System Restore and anything else that needs a shadow copy fail on this host until the registration is repaired. A backup product may still complete a job by other means, so a green backup report does not clear this.
Channel: Application
Provider: VSS
Event ids: 22, 8193, 12292
Where to look next:
- Confirm the Volume Shadow Copy and COM+ Event System services are installed and start.
- Re-register the shadow copy provider and the VSS component libraries on the host.
- Expect the host to keep producing this at high volume until it is repaired; it does not self-heal.
Related reasons:
vss_snapshot_call_failed: a snapshot call refused for a reason other than a missing providervss_snapshots_failing_for_space: shadow copies failing because storage ran out rather than a missing component
Fields it can set: win.eventlog.application.vss_execution_context, win.eventlog.application.vss_operation_call, win.eventlog.application.vss_operation_intent, win.eventlog.application.vss_routine, win.eventlog.application.vss_snapshot_attrs, win.eventlog.application.vss_snapshot_context
vss_snapshot_call_failed
A call the Volume Shadow Copy Service makes while working with shadow copies did not complete.
Severity: Warning on the refused calls, Info on the harmless ones
Impact: On the refused calls, shadow copy handling on the affected volume is constrained: the storage area cannot be resized, or a snapshot phase did not complete as asked. Backups may still succeed, so this is context for a backup problem rather than proof of one. On the harmless calls there is no impact at all: the snapshot is taken again on the next run, or it proceeds unaffected.
Channel: Application
Provider: VSS
Event ids: 13, 8193, 12289
What you see: A VSS error in the Application log naming the call that did not complete and the coordinator operation it was made for: resizing the shadow copy storage area, a snapshot preparation or commit phase, a call abandoned to a shutdown, or a lookup against a process that had exited.
What it means: One call inside shadow copy handling was refused or rejected. A refused resize means the storage area on that volume stays the size it is. A rejected preparation or commit call points at the storage driver or a third-party shadow copy provider. Neither says the backup failed: this event sees one call and not the job.
What to do: Read the class first, then match the remedy to the call: permissions on the volume and its shadow storage association for a refused resize, the storage driver or provider for a rejected phase call, and the backup product's own report for whether the job succeeded.
When to ignore it: A call abandoned because the machine was shutting down is only a finding without a matching restart on the same host and window; a process image lookup against an already-exited process is a normal race on a busy machine.
References:
- Microsoft Learn - vssadmin resize shadowstorage: The shadow storage allocation the refused resize call was trying to change.
- Microsoft Learn - Volume Shadow Copy Service Overview: How the coordinator, the provider and the requester divide the work these calls belong to.
Example
Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\Volume{00000000-0000-0000-0000-000000000060} - 0000000000000001,0x0053c008,0000000000000002,0,0000000000000003,4096,[0]). hr = 0x80070057, The parameter is incorrect.
.
Operation:
Processing EndPrepareSnapshots
Context:
Execution Context: System Provider
channel: Application
provider_name: VSS
event_id: 12289
SparkLogs: vss_snapshot_call_failed, Warning, vss_snapshot_call_failed: NOTABLE: Volume Shadow Copy Service error: Unexpected error DeviceIoControl(\\?\Volume{00000000-0000-0000-0000-000000000060} - 0000000000000001,0x0053c008,0000000000000002,0,0000000000000003,4096,[0]). hr = 0x80070057, The parameter is incorrect. . Operation: Processing EndPrepareSnapshots Context: Execution Context: System Provider | error_code=87 error_code_name=ERROR_INVALID_PARAMETER
| Case | Severity | Ticket class | Event ids |
|---|---|---|---|
diff_area_resize_denied | Warning | backup | 12289 |
phase_parameter_rejected | Warning | backup | 12289 |
shutdown_in_progress | Info | backup | 13, 8193 |
process_exited | Info | backup | 8193 |
Where to look next:
- Read the class first: the harmless calls carry BENIGN and the refused ones do not.
- Check the permissions on the volume and its shadow storage association for the resize refusal.
- Check the storage driver and any third-party shadow copy provider for the parameter rejections.
- Treat a shutdown-interrupted call as a finding only without a matching restart on the same host and window.
- Confirm the backup job outcome separately; this line does not report it.
Related reasons:
vss_provider_class_not_registered: the provider missing entirely rather than refusing a callvss_snapshots_failing_for_space: shadow copy storage actually running out rather than a refused resizevss_data_integrity_writer_failed
Fields it can set: win.eventlog.application.vss_execution_context, win.eventlog.application.vss_operation_call, win.eventlog.application.vss_operation_intent, win.eventlog.application.vss_routine, win.eventlog.application.vss_snapshot_attrs, win.eventlog.application.vss_snapshot_context, win.eventlog.application.vss_state
vss_snapshots_failing_for_space
Shadow copy storage is full, so restore points are being deleted or no longer created.
Severity: Error
Impact: Snapshot-based backups and System Restore lose history or stop working on the affected volume. A backup job may still report success while protecting less than it appears to.
Channel: Application
Provider: VSS
Event ids: 8193
What you see: A VSS event in the Application log saying there is no room left for shadow copy data on a volume: no remaining diff area candidates, copies deleted because the storage could not grow, or the insufficient-storage result.
What it means: Shadow copy storage is at its cap on that volume: Windows is either deleting restore points to stay under it or has stopped taking new ones, and the loss already happened. A backup job can still report success while protecting less history than expected.
What to do: Check the shadow storage association and maximum size for the volume, compare the oldest surviving restore point against the retention the customer expects, then free space or raise the cap.
When to ignore it: A refused resize of the storage area is a different event with a different remedy: it is about changing a maximum size, not about having room to create a copy.
References:
- Microsoft Learn - vssadmin resize shadowstorage: The command that reads and changes the shadow storage allocation this event ran out of.
Example
Volume Shadow Copy Service error: There is insufficient storage available to create either the shadow copy storage file or other shadow copy data. hr = 0x8004231f.
channel: Application
provider_name: VSS
event_id: 8193
SparkLogs: vss_snapshots_failing_for_space, Error, vss_snapshots_failing_for_space: NOTABLE: Volume Shadow Copy Service error: There is insufficient storage available to create either the shadow copy storage file or other shadow copy data. hr = 0x8004231f.
Where to look next:
- Check the shadow storage association and maximum size for the affected volume.
- Verify the oldest surviving restore point against the retention the customer expects.
- Free space or raise the cap; the condition recurs until the allocation changes.
Related reasons:
vss_data_integrity_writer_failed: a specific writer failing rather than storage running outvss_snapshot_call_failed: the harmless traffic on the same event id, told apart by the classvss_shadow_lostvss_shadow_aborted
vss_writer_callback_query
The Volume Shadow Copy Service could not read a writer's callback interface because of process permissions, and continued.
Severity: Info
Impact: None on its own. Shadow copy creation is not blocked by this check.
Channel: Application
Provider: VSS
Event ids: 8194
Where to look next:
- Treat as a real finding only alongside a failed backup on the same host and window.
Related reasons:
vss_data_integrity_writer_failed: a writer fronting a transactional store actually failingvss_snapshot_call_failed: another VSS call that did not complete, harmlessly on its benign arms
Fields it can set: win.eventlog.application.vss_operation_call, win.eventlog.application.vss_operation_intent, win.eventlog.application.vss_routine, win.eventlog.application.vss_writer
wcf_request_failed
A hosted service on this machine could not process a request.
Severity: Minor
Impact: The caller did not get an answer for that request. Other requests and other applications on the host are unaffected.
Channel: Application
Provider: System.ServiceModel <version>
Event ids: 3
Where to look next:
- Read the endpoint path from the message: an endpoint that does not exist usually means a caller pointed at the wrong address or a deployment that did not land.
- Compare the count against the web server's own request log for the same window.
- The same endpoint failing across several hosts points at the deployment rather than at a client.
win_msi_install_error
Windows Installer reported an install or configuration error. If the installer status says another install is already running, the same event is treated as retry-later context.
Severity: Warning / Info cap for retry-later
Impact: Software installation, update, or repair may not have completed successfully.
Channel: Application
Provider: MsiInstaller
Event ids: 1013, 1032, 10005
| Case | Severity | Ticket class |
|---|---|---|
error | Warning | patching |
retry_later | Info | patching |
Where to look next:
- Check MSI status and nearby install outcome events.
- Separate retry-later status from product or privilege failures.
Related reasons:
restart_manager_app_pending: open apps can block update sessionswin_msi_operation_failed: the same family where the id names a published installer error code
Fields it can set: win.eventlog.application.msi_status
The id set spans multiple installer templates, so the promoted fields are the ones every template carries; the rest stays in the raw payload.
win_msi_operation_failed
A Windows Installer operation did not complete. If the installer status says another install is already running, the same event is treated as retry-later context, and an operation refused for want of administrator rights or blocked by an open file is recorded as blocked rather than failed.
Severity: Minor / Notice when blocked / Info cap for retry-later
Impact: The product may be absent or partially configured until the install is retried or repaired.
Channel: Application
Provider: MsiInstaller
Event ids: 1033, 11306, 11321, 11500, 11708, 11714, 11729, 11730
| Case | Severity | Ticket class |
|---|---|---|
failed | Minor | patching |
privilege_refused | Notice | patching |
file_in_use | Notice | patching |
outcome_failed | Minor | patching |
retry_later | Info | patching |
Where to look next:
- The decoded installer error in the tail says which condition it was, and it reads the same on a machine whose text is not English.
- A blocked record means the operation never ran: elevate it, or find what keeps attempting it unelevated.
- Check product name and MSI status when present.
- Look for nearby 11707 success or repeated 11708 failures.
- Compare against the completed installs of the same product to see whether it landed later.
Related reasons:
restart_manager_app_pending: open apps can block update sessionswin_msi_install_error: broader installer error family
Fields it can set: win.eventlog.application.msi_code_meaning, win.eventlog.application.msi_status, win.eventlog.application.product
Retry-later detection reads the installer status value rather than the message text, so it behaves the same on a non-English system.
win_msi_product_install_succeeded
A Windows Installer product install completed successfully.
Severity: Notice
Impact: The product is installed. The record is the change-history anchor for what arrived on the machine and when.
Channel: Application
Provider: MsiInstaller
Event ids: 1033, 11707
Where to look next:
- Join on the product name to find the failed attempts that preceded it.
- Compare against the software inventory when a product is expected and absent.
Related reasons:
restart_manager_app_pending: open apps can block install sessionswin_msi_operation_failed: the same operation reporting a non-zero outcome
Fields it can set: win.eventlog.application.msi_code_meaning, win.eventlog.application.msi_status, win.eventlog.application.product
The outcome is read from the installer result field rather than from the message text, so it behaves the same on a non-English system.
win_msi_product_reconfigure_succeeded
A Windows Installer product configuration operation completed successfully.
Severity: Notice
Impact: The product's installed configuration changed. The record is the change-history anchor for what was reconfigured and when.
Channel: Application
Provider: MsiInstaller
Event ids: 11728
Where to look next:
- Join on the product name to see what was reconfigured and how often.
- A product reconfiguring on a timer is normally a management agent driving it, not a person.
Related reasons:
win_msi_operation_failed: an installer operation that did not completewin_msi_product_install_succeeded: the product arriving rather than changing
Fields it can set: win.eventlog.application.msi_code_meaning, win.eventlog.application.product
The outcome is read from the installer error code the event id carries rather than from the message text, so it behaves the same on a non-English system.
win_msi_product_removal_succeeded
A Windows Installer product removal completed successfully.
Severity: Notice
Impact: The product is no longer installed. The record is the change-history anchor for what left the machine and when.
Channel: Application
Provider: MsiInstaller
Event ids: 11724
Where to look next:
- Join on the product name to see whether the product returned afterwards.
- Compare against the software inventory when a product is expected and absent.
Related reasons:
win_msi_operation_failed: an installer operation that did not completewin_msi_product_install_succeeded: the same lifecycle in the other direction
Fields it can set: win.eventlog.application.msi_code_meaning, win.eventlog.application.product
The outcome is read from the installer error code the event id carries rather than from the message text, so it behaves the same on a non-English system.
win_user_profile_load_failed
Windows could not load a user profile, or loaded a temporary profile.
Severity: Serious
Impact: The user cannot work normally on that machine: they log on with missing settings, missing data paths, or a temporary profile until the profile issue is fixed.
Channel: Application
Provider: Microsoft-Windows-User Profiles Service
Event ids: 1511, 1542
Where to look next:
- Identify the affected user profile from the event message.
- Check profile service errors, disk space, permissions, and roaming or FSLogix state.
wmi_provider_registered_as_localsystem
A WMI provider registered to run under the LocalSystem account.
Severity: Info cap
Impact: None. This states what the provider is permitted to do, not that anything happened.
Channel: Application
Provider: Microsoft-Windows-WMI
Event ids: 63
Where to look next:
- Do not treat this line as a security finding: it reports a registration, never an action.
Vocabularies
These token sets are closed: a value outside the set leaves its field unset instead of invented.
result_constant
Published Microsoft constant for the result this compact family named. Minted to the constants these rows emit, not bound to the full win32 table. Inline because the constant is the action-changing token and the string an engineer searches for.
VSS_E_WRITERERROR_TIMEOUTVSS_E_WRITERERROR_RETRYABLEVSS_E_WRITERERROR_NONRETRYABLEVSS_E_FLUSH_WRITES_TIMEOUTVSS_E_HOLD_WRITES_TIMEOUTERROR_NO_SUCH_ALIAS
Portable vocabularies
Library-wide sets, so the same token means the same thing on every data feed.
sparklogs.result.code_space
msi: Windows Installer error codevss: Volume Shadow Copy Service private result code (VSS_E_*/VSS_S_*)
Ask this feed a question
Every reason code, token and field on this page is queryable across the endpoints you manage. Connect your AI and ask in plain language, or open the same evidence in Explore.