вторник, 3 июля 2018 г.

WNF IDs from perf_nt_c.dll (adk version 17692)

to compare with



  • WNF_AAD_DEVICE_REGISTRATION_STATUS_CHANGE id1 A3BC0875 id2 41820F2C
    This event is signalled when device changes status of registration in Azure Active Directory.
  • WNF_ACC_EC_ENABLED id1 A3BC0835 id2 41850D2C
    This event is bool signaled to indicate the EC accessibility feature enabled state
  • WNF_ACT_DATA_UPDATED id1 A3BC0835 id2 41920D2C
    Indicates Activity Data has been updated
  • WNF_AFD_IGNORE_ORDERLY_RELEASE_CHANGE id1 A3BC0875 id2 4182082C
    A system entity has requested a change in AFD's orderly release behavior.
  • WNF_AOW_BOOT_PROGRESS id1 A3BC0875 id2 4191012C
    This state is incremented when a discrete part of the AoW boot sequence has completed. Security: WNF_STATE_SUBSCRIBE (1) by everyone (WD) and app containers (S-1-15-2-1); WNF_STATE_SUBSCRIBE | WNF_STATE_PUBLISH (3) by Local System (SY) and the Interactive User account (IU).
  • WNF_BCST_APP_BROADCAST_STREAM_STATE id1 A3BC0875 id2 15950D2F
    Contains the current stream state information for the app broadcast service.
  • WNF_AI_USERTILE id1 A3BC0875 id2 41C6072C
    AppInstallation state name to receive RAW notifications
  • WNF_AI_PACKAGEINSTALL id1 A3BC1075 id2 41C6072C
    This event is signalled when a package install operation completes
  • WNF_AI_PACKAGEUPDATE id1 A3BC1875 id2 41C6072C
    This event is signalled when a package update operation completes
  • WNF_AI_PACKAGEUNINSTALL id1 A3BC2075 id2 41C6072C
    This event is signalled when a package uninstall operation completes
  • WNF_A2A_APPURIHANDLER_INSTALLED id1 A3BC0875 id2 41877C2C
    An app implementing windows.AppUriHandler contract has been installed
  • WNF_APXI_CRITICAL_PACKAGES_INSTALLED id1 A3BC0875 id2 89E1E2C
    This event is fired when all critical packages (those that need to be installed before the shell is displayed) have installed.
  • WNF_AA_LOCKDOWN_CHANGED id1 A3BC0875 id2 41C60F2C
    Mobile lockdown configuration has been changed
  • WNF_AA_CURATED_TILE_COLLECTION_STATUS id1 A3BC1075 id2 41C60F2C
    Curate tile collection for all allowed apps for current AssignedAccess account has been created
  • WNF_AA_MDM_STATUS_EVENT_LOGGED id1 A3BC1875 id2 41C60F2C
    Events are logged to the assigned access status trace logging.
  • WNF_AUDC_CPUSET_ID id1 A3BC08B5 id2 2821B2C
    This state holds the CPU Set ID for audio threads. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_AUDC_PHONECALL_ACTIVE id1 A3BC1075 id2 2821B2C
    This state indicates an active phone call, which can be from a cellular call or active Communications category audio streams
  • WNF_AUDC_TUNER_DEVICE_AVAILABILITY id1 A3BC1875 id2 2821B2C
    This notification indicates whether or not the tuner endpoint is available.
  • WNF_AUDC_HEALTH_PROBLEM id1 A3BC2075 id2 2821B2C
    State for problems detected in the audio core.
  • WNF_AUDC_CPUSET_ID_SYSTEM id1 A3BC2875 id2 2821B2C
    This state keeps other system services apprised of the audio-reserved CPU set ID.
  • WNF_AUDC_RENDER id1 A3BC3075 id2 2821B2C
    Reports the number of, and all endpoints currently rendering audio. Returns a WNF_STREAM_EVENT_HEADER data structure
  • WNF_AUDC_VOLUME_CONTEXT id1 A3BC3875 id2 2821B2C
    This notification is raised when contextual volume for endpoints have changed.
  • WNF_AUDC_CAPTURE id1 A3BC4075 id2 2821B2C
    Reports the number of, and process ids of all applications currently capturing audio. Returns a WNF_CAPTURE_STREAM_EVENT_HEADER data structure
  • WNF_AUDC_RINGERVIBRATE_STATE_CHANGED id1 A3BC4875 id2 2821B2C
    Reports the changes to the Ringervibrate state of the device
  • WNF_AUDC_SPATIAL_STATUS id1 A3BC5075 id2 2821B2C
    Reports for each spatial audio endpoint if spatial audio is currently being rendered. Returns a WNF_SPATIAL_STATUS_HEADER data structure
  • WNF_AUDC_DEFAULT_RENDER_ENDPOINT_PROPERTIES id1 A3BC5875 id2 2821B2C
    Reports certain properties of the default render multimedia endpoint whenever the default endpoint changes or a property of interest changes on the default render endpoint
  • WNF_AUDC_CHAT_APP_CONTEXT id1 A3BC6075 id2 2821B2C
    Publishes a list of the current chat applications on the device
  • WNF_AVA_SOUNDDETECTOR_PATTERN_MATCH id1 A3BC0875 id2 4187182C
    This notification is used to signal that a match has been detected for Voice Activation
  • WNF_AVLC_DRIVER_REQUEST id1 A3BC0875 id2 28A182C
    A driver requst permission for volume limit change.
  • WNF_AVLC_VOLUME_WARNING_ACCEPTED id1 A3BC1075 id2 28A182C
    This event propagates the user's choice from the warning dialog.
  • WNF_AVLC_SHOW_VOLUMELIMITWARNING id1 A3BC1875 id2 28A182C
    This event informs the system that we need to show reached volume limit warning message
  • WNF_ACHK_SP_CORRUPTION_DETECTED id1 A3BC0875 id2 A8E0D2C
    Event fired when we scan the System Partition and find corruption.
  • WNF_BMP_BG_PLAYSTATE_CHANGED id1 A3BC0875 id2 4196032F
    The background media player's playstate has changed.
  • WNF_BMP_BG_PLAYBACK_REVOKED id1 A3BC1075 id2 4196032F
    The following tasks aren't able to play under current policy
  • WNF_OS_IP_OVER_USB_AVAILABLE id1 A3BC8075 id2 41C61D22
    IP Over USB Availability. SDDL comes from ID_CAP_EVERYONE and IpOverUsb in %SDXROOT%\src\baseos\prod\packages\MfgIpOverUsb\MfgIpOverUsb.pkg.xml
  • WNF_OS_IU_PROGRESS_REPORT id1 A3BC8875 id2 41C61D22
    Update progress reporting status. SDDL comes from ID_CAP_BASEOS_UPDATEAPI in %SDXROOT%\src\baseos\prod\packages\imgupd\MainOS\ImgUpd.pkg.xml
  • WNF_FVE_DE_SUPPORT id1 A3BC0875 id2 4183182B
    This event triggers when Device Encryption support status is evaluated, and receives the result of that evaluation.
  • WNF_FVE_DE_MANAGED_VOLUMES_COUNT id1 A3BC1075 id2 4183182B
    This event triggers when the BitLocker service detects a change in the count of DE-managed volumes, and includes the count of such volumes.
  • WNF_FVE_WIM_HASH_GENERATION_TRIGGER id1 A3BC1875 id2 4183182B
    This event triggers or signals to stop WIM hash generation task.
  • WNF_FVE_WIM_HASH_GENERATION_COMPLETION id1 A3BC2075 id2 4183182B
    This event signals completion of WIM hash generation.
  • WNF_FVE_WIM_HASH_DELETION_TRIGGER id1 A3BC2875 id2 4183182B
    This event triggers WIM hash deletion.
  • WNF_FVE_BDESVC_TRIGGER_START id1 A3BC3075 id2 4183182B
    This event trigger-starts BdeSvc service.
  • WNF_FVE_STATE_CHANGE id1 A3BC3875 id2 4183182B
    This event triggers on every BitLocker state change.
  • WNF_FVE_MDM_POLICY_REFRESH id1 A3BC4075 id2 4183182B
    This event triggers where RequireDeviceEncryption policy arrives under the BitLocker area.
  • WNF_FVE_REQUIRE_SDCARD_ENCRYPTION id1 A3BC4875 id2 4183182B
    This event triggers SD card encrytion policy arrival notification.
  • WNF_FVE_SDCARD_ENCRYPTION_REQUEST id1 A3BC5075 id2 4183182B
    This event triggers SecTask to enable/disable SD Card encryption.
  • WNF_FVE_SDCARD_ENCRYPTION_STATUS id1 A3BC5875 id2 4183182B
    This event indicates completion of SD Card encryption/decryption request.
  • WNF_FVE_DETASK_TRIGGER_START id1 A3BC6075 id2 4183182B
    This event trigger-starts device encryption task.
  • WNF_FVE_BITLOCKER_ENCRYPT_ALL_DRIVES id1 A3BC6875 id2 4183182B
    This event triggers BitLocker task to enable BitLocker on all volumes.
  • WNF_BLTH_BLUETOOTH_STATUS id1 A3BC0875 id2 992022F
    State name for Bluetooth overall status notification. Flags from the BLUETOOTH_GLOBAL_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTConnMgr in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
  • WNF_BLTH_BLUETOOTH_AUDIO_GATEWAY_STATUS id1 A3BC1075 id2 992022F
    State name for Bluetooth Audio Gateway status notification. A 32-bit bitmask of BLUETOOTH_AUDIO_GATEWAY_STATUS enum are returned. SDDL comes from ID_CAP_EVERYONE and BTAGService in %SDXROOT%\src\net\Bluetooth\Packages\Product\Bluetooth\Bluetooth.pkg.xml
  • WNF_BLTH_BLUETOOTH_MAP_STATUS id1 A3BC1875 id2 992022F
    State name for Bluetooth MAP status notification. A 32-bit bitmask of BLUETOOTH_MAP_STATUS enum are returned.
  • WNF_BLTH_BLUETOOTH_CONNECTION_STATE_CHANGE id1 A3BC2075 id2 992022F
    Indicates when a Bluetooth Device gets connected and disconnected
  • WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_REQUEST id1 A3BC2875 id2 992022F
    Indicates that a legacy Gatt client request is present. The local radio and remote device BTH_ADDR are returned.
  • WNF_BLTH_BLUETOOTH_GATT_CLIENT_LEGACY_INVALIDATE_TOKEN id1 A3BC3075 id2 992022F
    Indicates that a legacy Gatt client request was no longer present. The previously granted access token to be revoked is returned.
  • WNF_BLTH_BLUETOOTH_QUICKPAIR_STATUS_CHANGED id1 A3BC3875 id2 992022F
    Notification that the user requested a change to the status of the QuickPair engine.
  • WNF_BLTH_BLUETOOTH_AVRCP_VOLUME_CHANGED id1 A3BC4075 id2 992022F
    Notification that the user has changed the volume level using AVRCP on a Bluetooth peripheral.
  • WNF_BLTH_BLUETOOTH_DEVICE_BATTERY_IS_LOW id1 A3BC4875 id2 992022F
    Notification that a Bluetooth device's battery is low.
  • WNF_BLTH_BLUETOOTH_LE_ADV_SCANNING_STATUS id1 A3BC5075 id2 992022F
    Exposes the status of Bluetooth LE Advertisement scanning.
  • WNF_BOOT_DIRTY_SHUTDOWN id1 A3BC0875 id2 1589012F
    The state is published once the previous shutdown was not clean.
  • WNF_BOOT_INVALID_TIME_SOURCE id1 A3BC1075 id2 1589012F
    The state is published if system time is initialized with a backup time source.
  • WNF_BOOT_MEMORY_PARTITIONS_RESTORE id1 A3BC1875 id2 1589012F
    The state reflects memory partiton restoration state (nothing to restore, restore in progress, restore completed, failure)
  • WNF_BRI_ACTIVE_WINDOW id1 A3BC0875 id2 418F1C2F
    Notifies brightness classes of the active window in order to apply their brightness preferences
  • WNF_BI_BROKER_WAKEUP_CHANNEL id1 A3BC0875 id2 41C6072F
    Background work execution trigger
  • WNF_BI_USER_LOGON_CHANNEL id1 A3BC1075 id2 41C6072F
    BI user logon system state notification channel
  • WNF_BI_USER_LOGOFF_CHANNEL id1 A3BC1875 id2 41C6072F
    BI user logoff system state notification channel
  • WNF_BI_SESSION_CONNECT_CHANNEL id1 A3BC2075 id2 41C6072F
    BI session connect system state notification channel
  • WNF_BI_SESSION_DISCONNECT_CHANNEL id1 A3BC2875 id2 41C6072F
    BI session disconnect system state notification channel
  • WNF_BI_APPLICATION_UNINSTALL_CHANNEL id1 A3BC3075 id2 41C6072F
    BI application uninstall system state notification channel
  • WNF_BI_APPLICATION_SERVICING_START_CHANNEL id1 A3BC3875 id2 41C6072F
    BI application servicing start system state notification channel
  • WNF_BI_APPLICATION_SERVICING_STOP_CHANNEL id1 A3BC4075 id2 41C6072F
    BI application servicing stop system state notification channel
  • WNF_BI_LOCK_SCREEN_UPDATE_CHANNEL id1 A3BC4875 id2 41C6072F
    BI lock screen update system state notification channel
  • WNF_BI_EVENT_DELETION id1 A3BC5075 id2 41C6072F
    BI event deletion system state notification channel
  • WNF_BI_PSM_TEST_HOOK_CHANNEL id1 A3BC5875 id2 41C6072F
    PSM policy test hook
  • WNF_BI_QUIET_MODE_UPDATE_CHANNEL id1 A3BC6075 id2 41C6072F
    BI Quiet Mode update system state notification channel
  • WNF_BI_BI_READY id1 A3BC6835 id2 41C6072F
    Indicates that BI is ready and also publish channels list for each session
  • WNF_BI_NOTIFY_NEW_SESSION id1 A3BC7075 id2 41C6072F
    BI notify new session system state notification channel
  • WNF_BI_QUERY_APP_USAGE id1 A3BC7875 id2 41C6072F
    PSM notification to clients for querying application performance usage
  • WNF_BI_NETWORK_LIMITED_CHANNEL id1 A3BC8075 id2 41C6072F
    Notification that the system is entering or exiting a network limited standby
  • WNF_CCTL_BUTTON_REQUESTS id1 A3BC08B5 id2 D920D2E
    A button press has caused a request.
  • WNF_CAM_APPDIAGNOSTICS_ACCESS_CHANGED id1 A3BC0875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_APPOINTMENTS_ACCESS_CHANGED id1 A3BC1075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_BLUETOOTH_ACCESS_CHANGED id1 A3BC1875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_CAMERA_ACCESS_CHANGED id1 A3BC2075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_CELLULARDATA_ACCESS_CHANGED id1 A3BC2875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_CHAT_ACCESS_CHANGED id1 A3BC3075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_CONTACTS_ACCESS_CHANGED id1 A3BC3875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_EMAIL_ACCESS_CHANGED id1 A3BC4075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_HID_ACCESS_CHANGED id1 A3BC4875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_LOCATION_ACCESS_CHANGED id1 A3BC5075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_MICROPHONE_ACCESS_CHANGED id1 A3BC5875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_PHONECALL_ACCESS_CHANGED id1 A3BC6075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_PHONECALLHISTORY_ACCESS_CHANGED id1 A3BC6875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_POS_ACCESS_CHANGED id1 A3BC7075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_RADIOS_ACCESS_CHANGED id1 A3BC7875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_SENSORSCUSTOM_ACCESS_CHANGED id1 A3BC8075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_SERIAL_ACCESS_CHANGED id1 A3BC8875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_USB_ACCESS_CHANGED id1 A3BC9075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_USERACCOUNTINFO_ACCESS_CHANGED id1 A3BC9875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_USERDATATASKS_ACCESS_CHANGED id1 A3BCA075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_USERNOTIFICATIONLISTENER_ACCESS_CHANGED id1 A3BCA875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_DOCUMENTSLIBRARY_ACCESS_CHANGED id1 A3BCB075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_PICTURESLIBRARY_ACCESS_CHANGED id1 A3BCB875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_VIDEOSLIBRARY_ACCESS_CHANGED id1 A3BCC075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_GAZEINPUT_ACCESS_CHANGED id1 A3BCC875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_BROADFILESYSTEMACCESS_ACCESS_CHANGED id1 A3BCD075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_ACTIVITY_ACCESS_CHANGED id1 A3BCD875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_BLUETOOTHSYNC_ACCESS_CHANGED id1 A3BCE075 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CAM_WIFIDIRECT_ACCESS_CHANGED id1 A3BCE875 id2 418B0F2E
    Event fired when access to the corresponding named app capability changes
  • WNF_CDP_CDPSVC_READY id1 A3BC0875 id2 41960A2E
    Indicates CDP Service is ready
  • WNF_CDP_CDPSVC_STOPPING id1 A3BC1075 id2 41960A2E
    Indicates CDP Service is stopping
  • WNF_CDP_CDPUSERSVC_READY id1 A3BC1835 id2 41960A2E
    Indicates CDP User Service is ready
  • WNF_CDP_CDPUSERSVC_STOPPING id1 A3BC2035 id2 41960A2E
    Indicates CDP User Service is stopping
  • WNF_CDP_CDP_MESSAGES_QUEUED id1 A3BC2875 id2 41960A2E
    Indicates CDP service queued the message(s) for designated applications
  • WNF_CDP_CDP_ACTIVITIES_RECIEVED id1 A3BC3075 id2 41960A2E
    Indicates CDP service received new activities
  • WNF_CDP_USERAUTH_POLICY_CHANGE id1 A3BC3875 id2 41960A2E
    Indicates that the user has changed the CDP policy
  • WNF_CDP_CDP_NOTIFICATION_ACTION_FORWARD_FAILURE id1 A3BC4075 id2 41960A2E
    Indicates failure either delivering or invoking a Notification Action on a remote device
  • WNF_CDP_USER_ROME_SETTING_CHANGE id1 A3BC4835 id2 41960A2E
    Indicates that the user has changed Rome SDK authorization setting
  • WNF_CDP_USER_NEAR_SHARE_SETTING_CHANGE id1 A3BC5035 id2 41960A2E
    Indicates that the user has changed Near Share authorization setting
  • WNF_CDP_ENABLE_ACTIVITYFEED_POLICY_CHANGE id1 A3BC5875 id2 41960A2E
    Indicates whether ActivityFeed is enabled. It is responsible for mirroring different activity types (as applicable) across device graph of the user.
  • WNF_CDP_PUBLISH_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC6075 id2 41960A2E
    Indicates the settings policy (enabled/disabled) for 'User Activity' publishing has changed.
  • WNF_CDP_CDP_LOCAL_ACTIVITIES_RECIEVED id1 A3BC6875 id2 41960A2E
    Indicates CDP service received local activities
  • WNF_CDP_USER_RESOURCE_INFO_CHANGED id1 A3BC7075 id2 41960A2E
    Indicates the persisted values associated with a resource has changed.
  • WNF_CDP_UPLOAD_USER_ACTIVITIES_POLICY_CHANGE id1 A3BC7875 id2 41960A2E
    Indicates the settings policy (enabled/disabled) for 'User Activity' upload has changed.
  • WNF_CDP_ALLOW_CLIPBOARDHISTORY_POLICY_CHANGE id1 A3BC8075 id2 41960A2E
    Indicates clipboard history policy has changed.
  • WNF_CDP_ALLOW_CROSSDEVICECLIPBOARD_POLICY_CHANGE id1 A3BC8875 id2 41960A2E
    Indicates cross device clipboard policy has changed.
  • WNF_CELL_POWER_STATE_MODEM0 id1 A3BC0875 id2 D8A0B2E
    Modem power state of the first modem, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_EVERYONE, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SIGNAL_STRENGTH_BARS_CAN0 id1 A3BC1075 id2 D8A0B2E
    Number of bars (0..5) of signal strength for the first cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SYSTEM_TYPE_CAN0 id1 A3BC1875 id2 D8A0B2E
    System type of the first cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_STATUS_CAN0 id1 A3BC2075 id2 D8A0B2E
    Current registration status of the first cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_STATUS_SLOT0 id1 A3BC2875 id2 D8A0B2E
    Status of the UICC in the first slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_AIRPLANEMODE id1 A3BC3075 id2 D8A0B2E
    The current state of airplanemode. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_OPERATOR_NAME_CAN0 id1 A3BC3875 id2 D8A0B2E
    Current serving operator for the first cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CDMA_ACTIVATION_CAN0 id1 A3BC4075 id2 D8A0B2E
    Activation, PRL, and provisioning state for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_NETWORK_TIME_CAN0 id1 A3BC4875 id2 D8A0B2E
    NITZ information for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_AVAILABLE_OPERATORS_CAN0 id1 A3BC5075 id2 D8A0B2E
    List of available operators for the first cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_DEVICE_INFO_CAN0 id1 A3BC5875 id2 D8A0B2E
    Device info (RIL_GetDeviceInfo) for the first cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_DATA_ENABLED_BY_USER_MODEM0 id1 A3BC6475 id2 D8A0B2E
    Cellular data enabled state as set by user. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PHONE_NUMBER_CAN0 id1 A3BC6875 id2 D8A0B2E
    Phone number (MSISDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_VOICEMAIL_NUMBER_CAN0 id1 A3BC7075 id2 D8A0B2E
    Voicemail number (MBDN) for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_PREFERENCES_CAN0 id1 A3BC7C75 id2 D8A0B2E
    Registration preferences for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CAN_STATE_CAN0 id1 A3BC8075 id2 D8A0B2E
    Can state (between CellManager and CellUX) for the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_USER_PREFERRED_POWER_STATE_MODEM0 id1 A3BC8C75 id2 D8A0B2E
    Power state of the modem as last preferred by the user, values defined by MODEMPOWERSTATE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_AIRPLANEMODE_DETAILS id1 A3BC9075 id2 D8A0B2E
    The current state of airplanemode details. SDDL comes from ID_CAP_CELL_WNF, WwanSvc and Airplanemode (service) in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_POSSIBLE_DATA_ACTIVITY_CHANGE_MODEM0 id1 A3BC9875 id2 D8A0B2E
    This is triggered if cellcore suspects that data activity may have been affected. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SYSTEM_CONFIG id1 A3BCA475 id2 D8A0B2E
    Root state describing cellular system configuration (all modems and their cans). SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN0 id1 A3BCA875 id2 D8A0B2E
    Detailed registration status of the first cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_EVERYONE, ID_CAP_ISV_CAMERA, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN0 id1 A3BCB075 id2 D8A0B2E
    bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PERSO_STATUS_CAN0 id1 A3BCB875 id2 D8A0B2E
    bitmask of supported system types by the first cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_HOME_OPERATOR_CAN0 id1 A3BCC075 id2 D8A0B2E
    MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CAMERA, ID_CAP_CELL_WNF, ID_CAP_ISV_CAMERA and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_HOME_PRL_ID_CAN0 id1 A3BCC875 id2 D8A0B2E
    PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UTK_SETUP_MENU_SLOT0 id1 A3BCE875 id2 D8A0B2E
    UICC toolkit setup menu notification for slot 0. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UTK_PROACTIVE_CMD id1 A3BCF075 id2 D8A0B2E
    UICC toolkit proactive command notification for all slots. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CSP_WWAN_PLUS_READYNESS id1 A3BCF875 id2 D8A0B2E
    CM CSPWWAN+ readyness state. SDDL comes from ID_CAP_CMCSPWWAN_PLUS in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_CELL_CALLFORWARDING_STATUS_CAN0 id1 A3BD0075 id2 D8A0B2E
    Call-forwarding status for the first cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_RADIO_TYPE_MODEM0 id1 A3BD0C75 id2 D8A0B2E
    Modem radio type of the first modem, values defined by RILRADIOCONFIGURATIONRADIOTYPE. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SIGNAL_STRENGTH_BARS_CAN1 id1 A3BD1075 id2 D8A0B2E
    Number of bars (0..5) of signal strength for the second cellular can. In the case of dual registration (SVLTE or CDMA) this is the primary signal strength. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SYSTEM_TYPE_CAN1 id1 A3BD1875 id2 D8A0B2E
    System type of the second cellular Can, a bitmask of RIL_SYSTEMTYPE_ values. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_STATUS_CAN1 id1 A3BD2075 id2 D8A0B2E
    Current registration status of the second cellular can, bits defined by RILREGSTAT. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_STATUS_SLOT1 id1 A3BD2875 id2 D8A0B2E
    Status of the UICC in the second slot. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_OPERATOR_NAME_CAN1 id1 A3BD4075 id2 D8A0B2E
    Current serving operator for the second cellular can, name as a Unicode string. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CDMA_ACTIVATION_CAN1 id1 A3BD4875 id2 D8A0B2E
    Activation, PRL, and provisioning state for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_NETWORK_TIME_CAN1 id1 A3BD5075 id2 D8A0B2E
    NITZ information for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, WwanSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_AVAILABLE_OPERATORS_CAN1 id1 A3BD5875 id2 D8A0B2E
    List of available operators for the second cellular can, an array of RILOPERATORINFO. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_DEVICE_INFO_CAN1 id1 A3BD6075 id2 D8A0B2E
    Device info (RIL_GetDeviceInfo) for the second cellular can, as a set of Unicode strings. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PHONE_NUMBER_CAN1 id1 A3BD7075 id2 D8A0B2E
    Phone number (MSISDN) for the second cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_PREFERENCES_CAN1 id1 A3BD8C75 id2 D8A0B2E
    Registration preferences for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CAN_STATE_CAN1 id1 A3BD9075 id2 D8A0B2E
    Can state (between CellManager and CellUX) for the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_STATUS_DETAILS_CAN1 id1 A3BD9875 id2 D8A0B2E
    Detailed registration status of the second cellular can, defined by WNFCELLSTATETYPE(REGISTRATION_STATUS_DETAILS). SDDL comes from ID_CAP_CELL_WNF, ID_CAP_EVERYONE, WwanSvc, ImsSvc and tzautoupdate in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SUPPORTED_SYSTEM_TYPES_CAN1 id1 A3BDA075 id2 D8A0B2E
    bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_HOME_OPERATOR_CAN1 id1 A3BDA875 id2 D8A0B2E
    MCC, MNC (or SID, NID) of the 'home' operator. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_HOME_PRL_ID_CAN1 id1 A3BDB075 id2 D8A0B2E
    PRL ID of 'home' operator. Is Valid only if there is a valid 3GPP2 line available. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UTK_SETUP_MENU_SLOT1 id1 A3BDD075 id2 D8A0B2E
    UICC toolkit setup menu notification for slot 1. SDDL comes from ID_CAP_CELL_WNF_PII and UtkService in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CALLFORWARDING_STATUS_CAN1 id1 A3BDE075 id2 D8A0B2E
    Call-forwarding status for the second cellular can. The same struct is used to indicate the latest state for a given callforwarding-reason. SDDL comes from ID_CAP_CELL_API_TELEPHONY, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PERSO_STATUS_CAN1 id1 A3BDE875 id2 D8A0B2E
    bitmask of supported system types by the second cellular can. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CONFIGURED_LINES_CAN0 id1 A3BDF475 id2 D8A0B2E
    Configured lines for the first cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CONFIGURED_LINES_CAN1 id1 A3BDFC75 id2 D8A0B2E
    Configured lines for the second cellular can. SDDL comes from ID_CAP_CELL_API_COMMON, ID_CAP_CELL_WNF, ImsSvc and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_STATUS_DETAILS_SLOT0 id1 A3BE0075 id2 D8A0B2E
    Status details of the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_STATUS_DETAILS_SLOT1 id1 A3BE0875 id2 D8A0B2E
    Status details of the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PREFERRED_LANGUAGES_SLOT0 id1 A3BE1075 id2 D8A0B2E
    Preferred languages in the first slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PREFERRED_LANGUAGES_SLOT1 id1 A3BE1875 id2 D8A0B2E
    Preferred languages in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IMSI_CAN0 id1 A3BE2075 id2 D8A0B2E
    IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IMSI_CAN1 id1 A3BE2875 id2 D8A0B2E
    IMSI for the first cellular can, as a Unicode string. SDDL comes from ID_CAP_CELL_WNF_PII and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_LEGACY_SETTINGS_MIGRATION id1 A3BE3075 id2 D8A0B2E
    Migration action for legacy cellcore settings. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_ATR_SLOT0 id1 A3BE3875 id2 D8A0B2E
    Answer to reset from the UICC in the first slot. SDDL comes from ID_CAP_CELL_WNF in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_ATR_SLOT1 id1 A3BE4075 id2 D8A0B2E
    Answer to reset from the UICC in the second slot. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_SIMSEC_SLOT0 id1 A3BE4875 id2 D8A0B2E
    Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 0. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_SIMSEC_SLOT1 id1 A3BE5075 id2 D8A0B2E
    Indication for Phone subsystem to show Sim Security (PIN, Perso) related UI for Slot 1. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_CAN_CONFIGURATION_SET_COMPLETE_MODEM0 id1 A3BE5875 id2 D8A0B2E
    Indication that all executors have been configured and that there are no outstanding configurations pending in the modem. SDDL comes from WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_REGISTRATION_CHANGED_TRIGGER_MV id1 A3BE6075 id2 D8A0B2E
    This is published when cellcore needs MV to kick in. SDDL comes from ID_CAP_EVERYONE, ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN0 id1 A3BE7075 id2 D8A0B2E
    Signal-strength details for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_SIGNAL_STRENGTH_DETAILS_CAN1 id1 A3BE7875 id2 D8A0B2E
    Signal-strength details for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_EMERGENCY_CALLBACK_MODE_STATUS id1 A3BE6875 id2 D8A0B2E
    Indication about the current emergency callback mode. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IMS_STATUS_CAN0 id1 A3BE8075 id2 D8A0B2E
    Current IMS registration for Can 0. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IMS_STATUS_CAN1 id1 A3BE8875 id2 D8A0B2E
    Current IMS registration for Can 1. SDDL comes from ID_CAP_EVERYONE and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IWLAN_AVAILABILITY_CAN0 id1 A3BE9075 id2 D8A0B2E
    iWLAN availability for Can 0, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_IWLAN_AVAILABILITY_CAN1 id1 A3BE9875 id2 D8A0B2E
    iWLAN availability for Can 1, value is BOOLEAN. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PS_MEDIA_PREFERENCES_CAN0 id1 A3BEA475 id2 D8A0B2E
    PS Media preferences for Can 0, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_PS_MEDIA_PREFERENCES_CAN1 id1 A3BEAC75 id2 D8A0B2E
    PS Media preferences for Can 1, a DWORD and an array of CellularMediaConfigration. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_WIFI_CALL_SETTINGS_CAN0 id1 A3BEB075 id2 D8A0B2E
    Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_WIFI_CALL_SETTINGS_CAN1 id1 A3BEB875 id2 D8A0B2E
    Reports if executor is capable of Wi-fi calling. SDDL comes from ID_CAP_CELL_WNF and WwanSvc in %SDXROOT%\src\net\Cellcore\packages\Cellcore\Cellcore.pkg.xml
  • WNF_CELL_UICC_PIN_STATE_SLOT0 id1 A3BEC075 id2 D8A0B2E
    Reports detailed states of PIN on slot 0. It is private for Wwansvc access only
  • WNF_CELL_UICC_PIN_STATE_SLOT1 id1 A3BEC875 id2 D8A0B2E
    Reports detailed states of PIN on slot 1. It is private for Wwansvc access only
  • WNF_WWAN_OBJECT_LIST id1 A3BC0875 id2 F87193A
    Table of all modems and executors under it.
  • WNF_WWAN_EUICC_ARRIVAL id1 A3BC1075 id2 F87193A
    This event is published by WwanSvc to indicate the arrival of an eUICC.
  • WNF_WWAN_CELLULAR_STATE_SNAPSHOT_CHANGE id1 A3BC1875 id2 F87193A
    This event is published by WwanSvc to indicate a change in cellular state snapshot.
  • WNF_WWAN_TASK_TRIGGER id1 A3BC2075 id2 F87193A
    State name triggering WiFiTask from WwanSvc.
  • WNF_SMSR_READY id1 A3BC0875 id2 1395033E
    Sms Router Broker is ready.
  • WNF_SMSR_WWAN_READ_DONE id1 A3BC1075 id2 1395033E
    Sms Router Broker is ready.
  • WNF_SMSR_NEW_MESSAGE_RECEIVED id1 A3BC1875 id2 1395033E
    Sms Router received a new incoming SMS message.
  • WNF_IMS_PUSH_NOTIFICATION_RECEIVED id1 A3BC0875 id2 41950324
    Push Notification Received from Entitlement Server
  • WNF_CERT_FLUSH_CACHE_TRIGGER id1 A3BC0875 id2 15940B2E
    This event signals flush cache in all processes where flush is enabled.
  • WNF_CERT_FLUSH_CACHE_STATE id1 A3BC1075 id2 15940B2E
    This event signals when flush cache was started and completed in each process where enabled.
  • WNF_CAPS_CENTRAL_ACCESS_POLICIES_CHANGED id1 A3BC0875 id2 12960F2E
    Central Access Policies have been updated
  • WNF_CLIP_CONTENT_CHANGED id1 A3BC0875 id2 118F022E
    This notification is triggered when contents on the clipboard change
  • WNF_CLIP_HISTORY_CHANGED id1 A3BC1035 id2 118F022E
    This notification is triggered when contents of the clipboard history change
  • WNF_CLIP_ROAMING_CLIPBOARD_ENABLED_CHANGED id1 A3BC1835 id2 118F022E
    This notification is triggered when roaming clipboard enabled/disabled setting value changes
  • WNF_CLIP_CLIPBOARD_HISTORY_ENABLED_CHANGED id1 A3BC2035 id2 118F022E
    This notification is triggered when clipboard history enabled/disabled setting value changes
  • WNF_CXH_WEBAPP_STATUS id1 A3BC0835 id2 418E162E
    Notification of web app status change. Payload is status type plus web app cxid of length 512
  • WNF_CXH_APP_FINISHED id1 A3BC1035 id2 418E162E
    Notification when CloudExperienceHost app is finished. Payload is result plus result string of length 512
  • WNF_CXH_BACK_STATE id1 A3BC1835 id2 418E162E
    Notification of web app back button state. Payload is a boolean for on/off
  • WNF_CXH_BACK id1 A3BC2035 id2 418E162E
    Notification when back command is issued
  • WNF_CXH_OOBE_APP_READY id1 A3BC2875 id2 418E162E
    System-wide signal that the CloudExperienceHost app launched during OOBE is ready with its first webapp visible. Payload is a boolean for true/false
  • WNF_CI_SMODE_CHANGE id1 A3BC0875 id2 41C6072E
    This event signals that change of S mode has occurred.
  • WNF_CSHL_COMPOSER_LAUNCH_READY id1 A3BC0835 id2 D8E1D2E
    Core shell has initialized, including all of its services (e.g. TLAVM), and the Product Composer can be launched. If the event has not been fired, then CoreShell is still initializing and the Composer cannot be launched. Payload is a DWORD to inidicate it has been fired.
  • WNF_CSHL_UI_AUTOMATION id1 A3BC1035 id2 D8E1D2E
    On UI Automation.
  • WNF_CSHL_VIEWHOSTING_READY id1 A3BC2035 id2 D8E1D2E
    Fired every time a Composer registers with TLAVM and inidicates that the composer is ready to host applications. If the event has not been fired, then no composer is ready to host applications. Payload is a DWORD to inidicate it has been fired.
  • WNF_CSHL_PRODUCT_READY id1 A3BC2835 id2 D8E1D2E
    Fired every time a Product Composer has finished initializing and indicates that Shell has entered normal operations (i.e. not in restricted mode or running OOBE/PostUpdateUX). If the event has not been fired, then the Product Composer is still initializing. Payload is a DWORD to inidicate it has been fired.
  • WNF_CSHL_COMPOSER_TEARDOWN id1 A3BC3035 id2 D8E1D2E
    When set to the value 1, it indicates that the current composer has finished unintializing.
  • WNF_CSHL_COMPOSER_CONTEXT_CHANGED id1 A3BC3835 id2 D8E1D2E
    Indicates the composer has changed which updates the registry (ComposerManagerBaseKey) indicating which composer can be restored after a crash
  • WNF_CSHL_SKIP_OOBE_CXH id1 A3BC4035 id2 D8E1D2E
    Fired when a test job wants to skip CXH stage of OOBE
  • WNF_CFCL_SC_CONFIGURATIONS_CHANGED id1 A3BC0875 id2 D85082E
    Triggered each time one or more flight configurations changes.
  • WNF_CFCL_SC_CONFIGURATIONS_DELETED id1 A3BC1075 id2 D85082E
    Triggered each time one or more flight configurations is deleted.
  • WNF_CFCL_SC_CONFIGURATIONS_ADDED id1 A3BC1875 id2 D85082E
    Triggered each time one or more flight configurations is added.
  • WNF_CONT_RESTORE_FROM_SNAPSHOT_COMPLETE id1 A3BC0875 id2 1588012E
    Components blocked waiting for restore from snapshot can now continue
  • WNF_DO_MANAGER_ACTIVE id1 A3BC0875 id2 41C60129
    This event triggers when the Delivery Optimization service manager is active or idle
  • WNF_DO_POLICY_CHANGED id1 A3BC1075 id2 41C60129
    Delivery Optimization system policy has been updated
  • WNF_DBA_DEVICE_ACCESS_CHANGED id1 A3BC0875 id2 41870C29
    This event triggers when the user changes device access for an applocation or the user
  • WNF_SFA_AUTHENTICATION_STAGE_CHANGED id1 A3BC0875 id2 4187083E
    This event signals when authentication stage change.
  • WNF_DSM_DSMAPPINSTALLED id1 A3BC0C75 id2 418B1D29
    Notification for when an app is installed so we can register a device background task if necessary.
  • WNF_DSM_DSMAPPREMOVED id1 A3BC1475 id2 418B1D29
    Notification for when an app is removed so we can clean up any registered device background tasks if necessary.
  • WNF_DMF_MIGRATION_STARTED id1 A3BC0875 id2 41800329
    Signals that Migration started. DWORD[1] = {started flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
  • WNF_DMF_MIGRATION_COMPLETE id1 A3BC1075 id2 41800329
    Signals that Migration completed. DWORD[2] = {completed flag, status}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
  • WNF_DMF_MIGRATION_PROGRESS id1 A3BC1875 id2 41800329
    Current Migration state. DWORD[4] = {Phase, Total Phases, Step, Total Steps}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS and DuMigrationManager in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml
  • WNF_DMF_UX_COMPLETE id1 A3BC2075 id2 41800329
    Signals when data migration is complete after reboot and update results need to be displayed. DWORD[1] = {completed flag}. SDDL comes from ID_CAP_DU_MIGRATION_WNF_EVENTS in %SDXROOT%\src\devmgmt\du\packages\Migration\Migration.pkg.xml and DuPostUpdateUX in %SDXROOT%\src\devmgmt\du\packages\UX\UX.pkg.xml and WINCAP_SHELL_EXPERIENCE_COMPOSER in %SDXROOT%\shellcommon\Composable\Core\dll\microsoft-windows-coreshell.wm.xml
  • WNF_DX_STEREO_CONFIG id1 A3BC0C75 id2 41C61629
    State stores the current stereo cpl setting. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_MODE_CHANGE_NOTIFICATION id1 A3BC1035 id2 41C61629
    Triggered by kernel when mode change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_OCCLUSION_CHANGE_NOTIFICATION id1 A3BC1835 id2 41C61629
    Triggered by kernel when any occlusion related OS state change happens.
  • WNF_DX_NETWORK_DISPLAY_STATE_CHANGE_NOTIFICATION id1 A3BC2035 id2 41C61629
    Triggered by kernel when the state of a network display device is changed.
  • WNF_DX_MONITOR_CHANGE_NOTIFICATION id1 A3BC2835 id2 41C61629
    Triggered by kernel when monitor change happens. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_VIDMM_TRIM_NOTIFICATION id1 A3BC30B5 id2 41C61629
    Triggered by kernel when video memory has to be trimmed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_VIDMM_BUDGETCHANGE_NOTIFICATION id1 A3BC3875 id2 41C61629
    Triggered by kernel when video memory budget for an application changes. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_HARDWARE_CONTENT_PROTECTION_TILT_NOTIFICATION id1 A3BC4075 id2 41C61629
    Triggered by hardware content protection tilt detection. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_INTERNAL_PANEL_DIMENSIONS id1 A3BC4875 id2 41C61629
    Stores information about the physical dimensions (in mm) of the integrated panel if available, and 0's if not.
  • WNF_DX_MODERN_OUTPUTDUPLICATION id1 A3BC5035 id2 41C61629
    Triggered when a lowbox application starts or stops using OutputDuplication.
  • WNF_DX_DISPLAY_CONFIG_CHANGE_NOTIFICATION id1 A3BC5835 id2 41C61629
    Triggered by kernel when a change is made to the display configuration.
  • WNF_DX_DEVICE_REMOVAL id1 A3BC60B5 id2 41C61629
    Triggered when a device has been removed for any reason, not just adapter removal. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_DX_MODERN_OUTPUTDUPLICATION_CONTEXTS id1 A3BC6835 id2 41C61629
    Triggered when a lowbox application starts or stops using OutputDuplication and provides list of active lowbox contexts
  • WNF_DX_COLOR_PROFILE_CHANGE id1 A3BC7035 id2 41C61629
    Triggered when the default color profile for any attached display changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_DX_GPM_TARGET id1 A3BC7875 id2 41C61629
    State is used to indicate the process that should be targeted by GPM.
  • WNF_DX_ADAPTER_START id1 A3BC8075 id2 41C61629
    Triggered by kernel when a GPU is started. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_ADAPTER_STOP id1 A3BC8875 id2 41C61629
    Triggered by kernel when a GPU is stopped. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_DX_SDR_WHITE_LEVEL_CHANGED id1 A3BC9035 id2 41C61629
    Triggered by kernel when SDR white level value is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_DX_COLOR_OVERRIDE_STATE_CHANGE id1 A3BC9875 id2 41C61629
    Triggered when any of the color overrides are changed for any display.
  • WNF_DX_DISPLAY_COLORIMETRY_DATA_CHANGED id1 A3BCA035 id2 41C61629
    Triggered by kernel when colorimetry data is changed for any display. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_DISK_SCRUB_REQUIRED id1 A3BC0875 id2 A950729
    This event signals when a disk that requires scrubbing is brought online
  • WNF_DXGK_ADAPTER_TDR_NOTIFICATION id1 A3BC0875 id2 A811629
    Triggered by the kernel when any adapter receives a TDR or PNP event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_DXGK_PATH_FAILED_OR_INVALIDATED id1 A3BC1075 id2 A811629
    Triggered by the kernel when an active display path asynchronously transitions to either a failed or invalidated state
  • WNF_DNS_ALL_SERVER_TIMEOUT id1 A3BC1075 id2 41950029
    When all the DNS Servers Timeout, this event is notified
  • WNF_DWM_RUNNING id1 A3BC0835 id2 418B1929
    Triggered when the dwm starts/terminates
  • WNF_DWM_HOLOGRAPHIC_COMPOSITOR_EXCLUSIVE_LOW_FRAMERATE id1 A3BC1035 id2 418B1929
    Triggered when exclusive mode apps are presenting at a low framerate to the holographic compositor
  • WNF_DWM_HOLOGRAPHIC_COMPOSITOR_HAS_PROTECTED_CONTENT id1 A3BC1835 id2 418B1929
    Triggered when the compositor toggles between not having and having (any) protected content
  • WNF_DWM_HOLOGRAPHIC_COMPOSITOR_LOW_FRAMERATE id1 A3BC2035 id2 418B1929
    Triggered when 3D compositor is presenting at a low framerate
  • WNF_DWM_COMPOSITIONCAPABILITIES id1 A3BC2835 id2 418B1929
    Triggered when the dwm composition capabilities changes
  • WNF_EAP_APPLICATION_HANDLE id1 A3BC0875 id2 41960F28
    State name for holding application window handle of calling UX
  • WNF_EOA_NARRATOR_FOCUS_CHANGE id1 A3BC08F5 id2 41870128
    Narrator has moved its focused region
  • WNF_EOA_NARRATOR_RUNNING id1 A3BC1075 id2 41870128
    Represents whether Narrator is currently running. A 32-bit unsigned integer with a zero value meaning Narrator is off.
  • WNF_EOA_UISETTINGS_CHANGED id1 A3BC1875 id2 41870128
    UISettings have changed. The payload carries an identifier for the particular setting that has changed, such as TextScaleFactor.
  • WNF_EDGE_LAST_NAVIGATED_HOST id1 A3BC08F5 id2 4810A28
    This event is fired when a top level frame navigation is complete, the payload contains the host name
  • WNF_EDGE_EXTENSION_INSTALLED id1 A3BC10F5 id2 4810A28
    This event is fired when an extension is installed. The payload is the extension id
  • WNF_EDGE_EXTENSION_AVAILABLE id1 A3BC18F5 id2 4810A28
    This event is fired on edge open if any extension is installed
  • WNF_EDGE_INPRIVATE_EXTENSION_AVAILABLE id1 A3BC20F5 id2 4810A28
    This event is fired on edge open if any extension, supported in InPrivate, is installed
  • WNF_EDP_TAGGED_APP_LAUNCHED id1 A3BC0835 id2 41960A28
    The application was launched in the specified mode under the specified Enterprise context.
  • WNF_EDP_IDENTITY_REVOKED id1 A3BC10F5 id2 41960A28
    The keys associated with a data protection identity were removed.
  • WNF_EDP_DPL_KEYS_STATE id1 A3BC1875 id2 41960A28
    Current state of the Data Protection under Lock private keys
  • WNF_EDP_CLIPBOARD_METADATA_CHANGED id1 A3BC2035 id2 41960A28
    Either a copy or override operation occurred, leading to clipboard metadata changes. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
  • WNF_EDP_DIALOG_CANCEL id1 A3BC2835 id2 41960A28
    An EDP blocking dialog has been canceled programmatically.
  • WNF_EDP_APP_UI_ENTERPRISE_CONTEXT_CHANGED id1 A3BC3035 id2 41960A28
    Application UI EDP context has been changed for the process.
  • WNF_EDP_AAD_REAUTH_REQUIRED id1 A3BC3875 id2 41960A28
    The AAD token used by EDP has expired.
  • WNF_EDP_ENTERPRISE_CONTEXTS_UPDATED id1 A3BC4475 id2 41960A28
    The EDP enterprise contexts have been updated.
  • WNF_EDP_PROCESS_UI_ENFORCEMENT id1 A3BC4875 id2 41960A28
    EDP process UI enforcement global state
  • WNF_EDP_PROCESS_TLS_INDEX id1 A3BC50B5 id2 41960A28
    EDP thread UI enforcement. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
  • WNF_EDP_DPL_KEYS_DROPPING id1 A3BC5875 id2 41960A28
    Data Protection under Lock private keys will be dropped from memory shortly.
  • WNF_EDP_MISSING_CREDENTIALS id1 A3BC6075 id2 41960A28
    EDP cred service cannot access credentials required
  • WNF_EDP_PURGE_APP_LEARNING_EVT id1 A3BC6875 id2 41960A28
    Purge application learning events cache
  • WNF_EDP_CREDENTIALS_UPDATING id1 A3BC7075 id2 41960A28
    Cred service is updating user credentials.
  • WNF_EDU_PRINTER_POLICY_CHANGED id1 A3BC0875 id2 41930A28
    This event is triggered when an MDM printer policy is changed.
  • WNF_EFS_SERVICE_START id1 A3BC0875 id2 41950828
    This event trigger-starts EFS service.
  • WNF_EFS_SOFTWARE_HIVE_AVAILABLE id1 A3BC1075 id2 41950828
    EFS service needs to check GP at boot, which requires the SOFTWARE hive in HKLM. This signals its availability when EFS worker thread detects it.
  • WNF_ENTR_DEVICELOCK_POLICY_VALUE_CHANGED id1 A3BC0875 id2 13920028
    Current changed policy values represented as bits for the Device Lock policy area. SDDL comes from NgcctnrSvc in %SDXROOT%\src\baseos\prod\packages\ngc\ngc.pkg.xml and ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml, %sdxroot%\onecoreuap\admin\dm\wap\service\dmwappushservice.wm.xml
  • WNF_ENTR_WIFI_POLICY_VALUE_CHANGED id1 A3BC1075 id2 13920028
    Current changed policy values represented as bits for the Wifi policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_SYSTEM_POLICY_VALUE_CHANGED id1 A3BC1875 id2 13920028
    Current changed policy values represented as bits for the System policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xmlSDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_CONNECTIVITY_POLICY_VALUE_CHANGED id1 A3BC2075 id2 13920028
    Current changed policy values represented as bits for the Connectivity policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_EXPERIENCE_POLICY_VALUE_CHANGED id1 A3BC2875 id2 13920028
    Current changed policy values represented as bits for the Experience policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ACCOUNTS_POLICY_VALUE_CHANGED id1 A3BC3075 id2 13920028
    Current changed policy values represented as bits for the Accounts policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_SECURITY_POLICY_VALUE_CHANGED id1 A3BC3875 id2 13920028
    Current changed policy values represented as bits for the Security policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_BROWSER_POLICY_VALUE_CHANGED id1 A3BC4075 id2 13920028
    Current changed policy values represented as bits for the Browser policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_UPDATE_POLICY_VALUE_CHANGED id1 A3BC4875 id2 13920028
    Current changed policy values represented as bits for the Update policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_CAMERA_POLICY_VALUE_CHANGED id1 A3BC5075 id2 13920028
    Current changed policy values represented as bits for the Camera policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_APPLICATIONMANAGEMENT_POLICY_VALUE_CHANGED id1 A3BC5875 id2 13920028
    Current changed policy values represented as bits for the ApplicationManagement policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_REQUIRE_DEVICE_ENCRYPTION_POLICY_VALUE_CHANGED id1 A3BC6075 id2 13920028
    Current changed security policy RequireDeviceEncryption value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_PUSH_NOTIFICATION_RECEIVED id1 A3BC6875 id2 13920028
    An MDM Push notification has been received. SDDL comes from ID_CAP_CSP_DMCLIENT in %SDXROOT%\src\devmgmt\dm\packages\dmapps\dmapps.pkg.xml
  • WNF_ENTR_SEARCH_POLICY_VALUE_CHANGED id1 A3BC7075 id2 13920028
    Current changed policy values represented as bits for the Search policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ABOVELOCK_POLICY_VALUE_CHANGED id1 A3BC7875 id2 13920028
    Current changed policy values represented as bits for the AboveLock policy area. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ALLOWAPPLICATIONS_POLICY_VALUE_CHANGED id1 A3BC8075 id2 13920028
    A Dataprotection AllowApplications provider policy value has changed.
  • WNF_ENTR_EDPENFORCEMENTLEVEL_POLICY_VALUE_CHANGED id1 A3BC8875 id2 13920028
    A Dataprotection EDPEnforcementLevel provider policy value has changed.
  • WNF_ENTR_WAP_MESSAGE_FOR_DMWAPPUSHSVC_READY id1 A3BC9075 id2 13920028
    A WAP message has been received that dmwappushsvc needs to handle.
  • WNF_ENTR_CONTEXT_STATE_CHANGE id1 A3BC9875 id2 13920028
    An enterprise context has changed it's state
  • WNF_ENTR_PUSH_RECEIVED id1 A3BCA075 id2 13920028
    An enterprise WNS based push was received
  • WNF_ENTR_ALLOWINPUTPANEL_POLICY_VALUE_CHANGED id1 A3BCA875 id2 13920028
    A TextInput AllowInputPanel provider policy value has changed.
  • WNF_ENTR_SEARCH_ALLOW_USING_DIACRITICS id1 A3BCB075 id2 13920028
    Allow use of diacritics for indexing.
  • WNF_ENTR_SEARCH_ALWAYS_USE_AUTO_LANG_DETECTION id1 A3BCB875 id2 13920028
    Always use automatic language detection when indexing content and properties.
  • WNF_ENTR_SEARCH_DISABLE_REMOVABLE_DRIVE_INDEXING id1 A3BCC075 id2 13920028
    Do not allow locations on removable drives to be added to libraries.
  • WNF_ENTR_SEARCH_PREVENT_INDEXING_LOW_DISK_SPACE_MB id1 A3BCC875 id2 13920028
    Stop indexing in the event of limited hard drive space.
  • WNF_ENTR_SEARCH_ALLOW_INDEXING_ENCRYPTED_STORES_OR_ITEMS id1 A3BCD075 id2 13920028
    Allow indexing of encrypted files.
  • WNF_ENTR_BLUETOOTH_POLICY_VALUE_CHANGED id1 A3BCD875 id2 13920028
    Bluetooth policy configuration has changed. SDDL comes from ID_CAP_POLICY_MANAGER in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_EDPNETWORKING_POLICY_VALUE_CHANGED id1 A3BCE075 id2 13920028
    A Dataprotection networking policy value has changed.
  • WNF_ENTR_REQUIRE_DPL_POLICY_VALUE_CHANGED id1 A3BCE875 id2 13920028
    DataProtection Require Protection Under Lock Config policy change.
  • WNF_ENTR_WINDOWS_DEFENDER_POLICY_VALUE_CHANGED id1 A3BCF075 id2 13920028
    Windows Defender policy configuration has changed.
  • WNF_ENTR_ALLOWALLTRUSTEDAPPS_POLICY_VALUE_CHANGED id1 A3BCF875 id2 13920028
    ApplicationManagement AllowAllTrustedApps provider policy value has changed.
  • WNF_ENTR_ALLOWSHAREDUSERDATA_POLICY_VALUE_CHANGED id1 A3BD0075 id2 13920028
    ApplicationManagement AllowSharedUserAppData provider policy value has changed.
  • WNF_ENTR_RESTRICTAPPTOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD0875 id2 13920028
    ApplicationManagement RestrictAppToSystemVolume provider policy value has changed.
  • WNF_ENTR_RESTRICTAPPDATATOSYTEMVOLUME_POLICY_VALUE_CHANGED id1 A3BD1075 id2 13920028
    ApplicationManagement RestrictAppDataToSystemVolume provider policy value has changed.
  • WNF_ENTR_ALLOWDEVELOPERUNLOCK_POLICY_VALUE_CHANGED id1 A3BD1875 id2 13920028
    ApplicationManagement AllowDeveloperUnlock provider policy value has changed.
  • WNF_ENTR_ALLOWUPDATESERVICE_POLICY_VALUE_CHANGED id1 A3BD2075 id2 13920028
    Update AllowUpdateService provider policy value has changed.
  • WNF_ENTR_UPDATESERVICEURL_POLICY_VALUE_CHANGED id1 A3BD2875 id2 13920028
    Update UpdateServiceUrl provider policy value has changed.
  • WNF_ENTR_ALLOWNONMICROSOFTSIGNEDUPDATE_POLICY_VALUE_CHANGED id1 A3BD3075 id2 13920028
    Update AllowNonMicrosoftSignedUpdate provider policy value has changed.
  • WNF_ENTR_ALLOW_WBA_EXECUTION_POLICY_VALUE_CHANGED id1 A3BD3875 id2 13920028
    DisableWBA policy value has changed.
  • WNF_ENTR_DOMAIN_NAMES_FOR_EMAIL_SYNC_POLICY_VALUE_CHANGED id1 A3BD4075 id2 13920028
    The domains for which email is disabled have changed.
  • WNF_ENTR_ALLOWCELLULARDATAROAMING_POLICY_VALUE_CHANGED id1 A3BD4875 id2 13920028
    The AllowCellularDataRoaming policy value has changed.
  • WNF_ENTR_ALLOWCELLULARDATA_POLICY_VALUE_CHANGED id1 A3BD5075 id2 13920028
    The AllowCellularData policy value has changed.
  • WNF_ENTR_EDPENFORCEMENTLEVEL_CACHED_POLICY_VALUE_CHANGED id1 A3BD5C75 id2 13920028
    EDPEnforcementLevel cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
  • WNF_ENTR_PROTECTEDDOMAINNAMES_CACHED_POLICY_VALUE_CHANGED id1 A3BD6475 id2 13920028
    EnterpriseProtectedDomainNames cached policy have changed. CAPABILITY_SID_LpacEnterprisePolicyChangeNotifications - S-1-15-3-1024-126078593-3658686728-1984883306-821399696-3684079960-564038680-3414880098-3435825201.
  • WNF_ENTR_ALLOWMESSAGESYNC_POLICY_VALUE_CHANGED id1 A3BD6875 id2 13920028
    The AllowMessageSync policy value has changed.
  • WNF_ENTR_DISABLEADVERTISINGID_POLICY_VALUE_CHANGED id1 A3BD7075 id2 13920028
    Privacy DisableAdvertisingId policy value has changed.
  • WNF_ENTR_EVALUATE_EDP_CONFIGURATION_STATE id1 A3BD7875 id2 13920028
    EnterpriseDataProtection (EDP) state has changed.
  • WNF_ENTR_APPHVSI_CACHED_POLICY_VALUE_CHANGED id1 A3BD8475 id2 13920028
    AllowAppHVSI cached policy has changed.
  • WNF_ENTR_NETWORKISOLATION_POLICY_VALUE_CHANGED id1 A3BD8875 id2 13920028
    A NetworkIsolation area policy value has changed.
  • WNF_ENTR_EVALUATE_APPHVSI_CONFIGURATION_STATE id1 A3BD9075 id2 13920028
    AppHVSI (Hypervisor-based Virtualized Security Isolation) state has changed.
  • WNF_ENTR_EDPSHOWICONS_CACHED_POLICY_VALUE_CHANGED id1 A3BD9C75 id2 13920028
    EdpShowIcons policy value has changed.
  • WNF_ENTR_ALLOWWIFI_POLICY_VALUE_CHANGED id1 A3BDB075 id2 13920028
    AllowWifi policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ALLOWMANUALWIFICONFIGURATION_POLICY_VALUE_CHANGED id1 A3BDB875 id2 13920028
    AllowManualWifiConfiguration policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_SEARCH_ALLOW_INDEXER id1 A3BDC075 id2 13920028
    Allow windows indexer.
  • WNF_ENTR_ALLOWWIFIDIRECT_POLICY_VALUE_CHANGED id1 A3BDC875 id2 13920028
    AllowWifiDirect policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ALLOWPROJECTIONTOPC_POLICY_VALUE_CHANGED id1 A3BDD075 id2 13920028
    AllowProjectionToPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_ALLOWMESSAGE_MMS_POLICY_VALUE_CHANGED id1 A3BDD875 id2 13920028
    The AllowMessageMMS policy value has changed.
  • WNF_ENTR_ALLOWMESSAGE_RCS_POLICY_VALUE_CHANGED id1 A3BDE075 id2 13920028
    The AllowMessageRCS policy value has changed.
  • WNF_ENTR_EDPSMB_POLICY_VALUE_CHANGED id1 A3BDE875 id2 13920028
    SMBAutoEncryptedFileExtensions policy value has changed.
  • WNF_ENTR_APPHVSI_POLICY_VALUE_CHANGED id1 A3BDF075 id2 13920028
    Any AppHVSI policy value is changed
  • WNF_ENTR_ALLOWSET24HOURCLOCK_POLICY_VALUE_CHANGED id1 A3BDF875 id2 13920028
    The AllowSet24HourClock policy value has changed.
  • WNF_ENTR_ALLOWPROJECTIONFROMPC_POLICY_VALUE_CHANGED id1 A3BE0075 id2 13920028
    AllowProjectionFromPC policy value changed. SDDL comes from ID_CAP_POLICY_MANAGER and ID_CAP_POLICY_MANAGER_READONLY in %SDXROOT%\src\devmgmt\enterprise\product\policymanager\packages\policymanager.pkg.xml
  • WNF_ENTR_EXPLOITGUARD_POLICY_VALUE_CHANGED id1 A3BE0875 id2 13920028
    The ExploitGuard policy values have changed.
  • WNF_ENTR_WINDOWSDEFENDERSECURITYCENTER_POLICY_VALUE_CHANGED id1 A3BE1075 id2 13920028
    The WindowsDefenderSecurityCenter policy values have changed.
  • WNF_ENTR_APPPRIVACY_POLICY_VALUE_CHANGED id1 A3BE1875 id2 13920028
    Event fired when app privacy policy values have changed
  • WNF_ENTR_ENABLETOUCHKEYBOARDAUTOINVOKE_POLICY_VALUE_CHANGED id1 A3BE2075 id2 13920028
    A TextInput EnableTouchKeyboardAutoInvokeInDesktopMode policy value has changed.
  • WNF_ENTR_FULLLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE2875 id2 13920028
    A TextInput TouchKeyboardFullModeAvailability policy value has changed.
  • WNF_ENTR_WIDELAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3075 id2 13920028
    A TextInput TouchKeyboardWideModeAvailability policy value has changed.
  • WNF_ENTR_NARROWLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE3875 id2 13920028
    A TextInput TouchKeyboardNarrowModeAvailability policy value has changed.
  • WNF_ENTR_HANDWRITING_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4075 id2 13920028
    A TextInput TouchKeyboardHandwritingModeAvailability policy value has changed.
  • WNF_ENTR_SPLITLAYOUT_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE4875 id2 13920028
    A TextInput TouchKeyboardSplitModeAvailability policy value has changed.
  • WNF_ENTR_EMOJI_AVAILABILITY_POLICY_VALUE_CHANGED id1 A3BE5075 id2 13920028
    A TextInput TouchKeyboardEmojiButtonAvailability policy value has changed.
  • WNF_ENTR_FORCEDOCKED_TOUCHKEYBOARD_POLICY_VALUE_CHANGED id1 A3BE5875 id2 13920028
    A TextInput ForceTouchKeyboardDockedState policy value has changed.
  • WNF_ENTR_TOUCHKEYBOARDDICTATION_POLICY_VALUE_CHANGED id1 A3BE6075 id2 13920028
    A TextInput TouchKeyboardDictationButtonAvailability policy value has changed.
  • WNF_ENTR_BITS_POLICY_VALUE_CHANGED id1 A3BE6875 id2 13920028
    BITS policy area value has changed.
  • WNF_ETW_SUBSYSTEM_INITIALIZED id1 A3BC0875 id2 41911A28
    ETW subsystem initialized
  • WNF_EXEC_OSTASKCOMPLETION_REVOKED id1 A3BC0875 id2 2831628
    This event signal when a task completion has been revoked due to memory pressure
  • WNF_EXEC_THERMAL_LIMITER_CLOSE_APPLICATION_VIEWS id1 A3BC1875 id2 2831628
    This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates all application views should be closed
  • WNF_EXEC_THERMAL_LIMITER_TERMINATE_BACKGROUND_TASKS id1 A3BC2075 id2 2831628
    This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates background tasks should be terminated
  • WNF_EXEC_THERMAL_LIMITER_DISPLAY_WARNING id1 A3BC2875 id2 2831628
    This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates a warning should be displayed to the user
  • WNF_EXEC_THERMAL_LIMITER_STOP_MRC id1 A3BC3075 id2 2831628
    This event is signaled by the thermal limiter when a power or thermal trip point has been reached that indicates MRC should be stopped
  • WNF_WFS_SETTINGS id1 A3BC0875 id2 4195083A
    Family Safety settings have changed in the cloud service but have not been downloaded and committed
  • WNF_WFS_TIMEREMAININGALERTS id1 A3BC1075 id2 4195083A
    Family Safety time remaining alerts to warn the user the allocated time is running out. The data is published as json blob with fileds U.SID for User SID as wide character and TR for time remaining in minutes as int value
  • WNF_WFS_FAMILYMEMBERLOGIN id1 A3BC1875 id2 4195083A
    Family member login event
  • WNF_WFS_SETTINGSREFRESH id1 A3BC2075 id2 4195083A
    Family Safety settings have changed and have downloaded and committed. Clients should refresh Family Safety settings.
  • WNF_FDBK_QUESTION_NOTIFICATION id1 A3BC0875 id2 A840A2B
    This event contains a feedback question for the user. Payload is a JSON string specifying the feedback question.
  • WNF_WFAS_FIREWALL_NETWORK_CHANGE_READY id1 A3BC0875 id2 1287083A
    Free network available or not
  • WNF_FLYT_IDS_CHANGED id1 A3BC0875 id2 159F022B
    Triggered every time there is a change in flight IDs
  • WNF_FLTN_WNF_ARRIVED id1 A3BC0875 id2 F92022B
    Triggered every time upon WNS notification or policy change
  • WNF_FLT_RUNDOWN_WAIT id1 A3BC0875 id2 4192022B
    Wait for rundown release in Filter Manager may be blocked by a suspended Modern application
  • WNF_FOD_STATE_CHANGE id1 A3BC0875 id2 4182012B
    Installation status of Features on demand
  • WNF_FSRL_TIERED_VOLUME_DETECTED id1 A3BC0875 id2 D941D2B
    This event signals when a tiered volume is mounted
  • WNF_FSRL_OPLOCK_BREAK id1 A3BC1075 id2 D941D2B
    Oplock break acknowledgement may be blocked by a suspended Modern application
  • WNF_GC_INITIAL_PRESENT id1 A3BC0875 id2 41C60D2A
    This event is signalled when the graphics driver presents the initial frame.
  • WNF_GIP_ADAPTER_CHANGE id1 A3BC0875 id2 4196072A
    This event is fired for GIP adapter state change, such as connect/disconnect
  • WNF_LOC_DEVICE_BROKER_ACCESS_CHANGED id1 A3BC0875 id2 41850121
    This event triggers when the user changes Geolocation access for an application or the user.
  • WNF_LOC_RESERVED_WNF_EVENT id1 A3BC1075 id2 41850121
    Do not use this WNF event, it is deprecated. Was WIN32_API_ACCESS_CHANGED.
  • WNF_LOC_SHOW_SYSTRAY id1 A3BC1875 id2 41850121
    This event triggers when there is an event that accesses location data -- this trigger starts LocationNotifications.exe which is a systray app.
  • WNF_LFS_STATE id1 A3BC0875 id2 41950821
    This is triggered when an app is making use of the location service. It has two possible data values associated to it: BOOL TRUE: one or more applications are using location. BOOL FALSE: no application is using location.
  • WNF_LFS_RUNNING_STATE id1 A3BC1075 id2 41950821
    This state is used to notify when the location service starts or stops running
  • WNF_LFS_MASTERSWITCH_STATE id1 A3BC1875 id2 41950821
    This state is used to notify when the phone location master switch status changes with BOOL as payload. TRUE indicating master switch is ON and FALSE indicating master switch is OFF
  • WNF_LFS_GEOFENCETRACKING_STATE id1 A3BC2075 id2 41950821
    This state is used to notify Geofence tracking state for the geofences added by the applications. TRUE if atleast one geofence is actively being tracked and FALSE if there are no geofences being tracked.
  • WNF_LFS_RESERVED_WNF_EVENT_2 id1 A3BC2875 id2 41950821
    Do not use this WNF event, it is deprecated. Was WNF_LFS_BACKGROUND_PERMISSIONCHANGE_STATE
  • WNF_LFS_POSITION_AVAILABLE id1 A3BC3075 id2 41950821
    This state is used to notify when a new freely available position can be queried from the location framework.
  • WNF_LFS_CLIENT_RECALCULATE_PERMISSIONS id1 A3BC3875 id2 41950821
    This state is published whenever the permissions of an active client have changed. Every client on the system receives it, and should run domain-specific logic to see what the impact is (e.g., reconnect location session when permission re-allowed).
  • WNF_LFS_PERMISSION_TO_SHOW_ICON_CHANGED id1 A3BC4075 id2 41950821
    This event notifies when the permission regarding the ability to show the location notification icon has changed. The current state needs to be queried for as it is different for each user.
  • WNF_LFS_ACTION_DIALOG_AVAILABLE id1 A3BC4875 id2 41950821
    This event notifies when a new action dialog is available
  • WNF_LFS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5075 id2 41950821
    This event notifies when there's a significant change in the location of the device.
  • WNF_LFS_VISITS_SIGNIFICANT_LOCATION_EVENT id1 A3BC5875 id2 41950821
    This event notifies when there's a visit or a significant change in the location of the device.
  • WNF_LFS_LOCATION_MDM_AREA_POLICY_CHANGED id1 A3BC6075 id2 41950821
    This event is fired when an MDM Location policy change occurs.
  • WNF_LFS_LOCATION_MDM_POLICY_ENABLELOCATION_CHANGED id1 A3BC6875 id2 41950821
    This event is fired when an MDM EnableLocation policy change occurs.
  • WNF_NLS_ACP_CHANGED id1 A3BC0875 id2 41950223
    This state is notified when the ANSI codepage changes - The data value is a UINT that indicates the new ANSI codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_OEMCP_CHANGED id1 A3BC1075 id2 41950223
    This state is notified when the OEM codepage changes - The data value is a UINT that indicates the new OEM codepage. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_USER_DEFAULT_LOCALE_CHANGED id1 A3BC1835 id2 41950223
    This state is notified when the user default locale changes - The data value is an LCID that indicates the new locale. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_USER_UILANG_CHANGED id1 A3BC2035 id2 41950223
    This state is notified when the user default UI language changes - The data value is a LANGID that indicates the new UI language. SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_LOCALE_INFO_CHANGED id1 A3BC2835 id2 41950223
    This state is notified when the locale info changes by means of calling SetLocaleInfo - The data value is a DWORD that indicates the LCTYPE that changed. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_GEOID_CHANGED id1 A3BC3035 id2 41950223
    This state is notified when the user Geo ID changes by means of calling SetUserGeoID - The data value is a DWORD that indicates the new GeoID. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_LANG_UPDATE_LAUNCH id1 A3BC3875 id2 41950223
    Notification indicating lang update launcher needs to be started. SDDL comes from ID_CAP_EVERYONE, ID_CAP_NTSERVICES and ID_CAP_INPUT_LOCALES in %SDXROOT%\src\uxplat\Input\Packages\InputServer\InputServer.pkg.xml
  • WNF_NLS_SETTINGS_REPLICATOR_LAUNCH id1 A3BC4075 id2 41950223
    Notification indicating NLS/MUI user settings replicator needs to be started. - The data value is the replication cookie GUID (binary). SDDL comes from ID_CAP_EVERYONE and ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_NLS_SETTINGS_REPLICATION_COMPLETE id1 A3BC4875 id2 41950223
    Notification indicating NLS/MUI user settings replication has completed. - The data value is an HRESULT. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_GLOB_USERPROFILE_LANGLIST_CHANGED id1 A3BC0875 id2 389022A
    This state is notified when the globalization user profile has changed via SetUserProfileLanguagesWP. There is nothing in the payload - call GetUserProfileLanguagesWP to get the updated user profile language list. SDDL comes from ID_CAP_GLOBALIZATION_SETTINGS in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_GPOL_SYSTEM_CHANGES id1 A3BC0875 id2 D891E2A
    System policy has been updated
  • WNF_GPOL_USER_CHANGES id1 A3BC10F5 id2 D891E2A
    User policy has been updated
  • WNF_HAS_VERIFY_HEALTH_CERT id1 A3BC0875 id2 41950F25
    This event signals a request to get (if needed) and verify Health Certificate with HAS
  • WNF_HOLO_USER_DISPLAY_CONTEXT id1 A3BC0835 id2 E8A0125
    Event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
  • WNF_HOLO_USER_INPUT_CONTEXT id1 A3BC1035 id2 E8A0125
    Event raised when the input context changes (ex. from 3D input to 2D Desktop input). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
  • WNF_HOLO_SHELL_STATE id1 A3BC1835 id2 E8A0125
    Event raised when the Holographic Shell running state changes (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState
  • WNF_HOLO_INPUT_FOCUS_CHANGE id1 A3BC2075 id2 E8A0125
    This event signals when input focus changes to a different window. Data is a MPCInputFocusChange struct.
  • WNF_HOLO_FORCE_ROOM_BOUNDARY id1 A3BC2835 id2 E8A0125
    If payload is non-zero, room boundary is forced to be visible.
  • WNF_HOLO_STREAMING_STATE id1 A3BC3035 id2 E8A0125
    This event signals whether streaming is active. Data contains a bool indicating if streaming is active.
  • WNF_HOLO_ROOM_BOUNDARY_DATA_CHANGED id1 A3BC3835 id2 E8A0125
    This event signals that the persisted room boundary data has changed.
  • WNF_HOLO_ROOM_BOUNDARY_VISIBILITY id1 A3BC4035 id2 E8A0125
    A non-zero payload indicates the room boundary is visible to the user. Writable by DWM and System.
  • WNF_HOLO_SHELL_INPUT_3DSWITCH_DISABLE id1 A3BC4835 id2 E8A0125
    This event signals when various input types should be disabled from natively working in the Windows Holographic shell, useful for apps that simulate GGV via mouse and/or gamepad. Data contains a DWORD of bitflags from Windows::Internal::Shell::Holographic::ShellInput3DSwitchDisableFlags.
  • WNF_HOLO_ENVIRONMENT_AUDIO_ASSET id1 A3BC5075 id2 E8A0125
    This event contains the file path for the environment app's audio asset, which is used by Triton
  • WNF_HOLO_UNINSTALL_PREPARE id1 A3BC5875 id2 E8A0125
    This event signals that it's time for uninstall preparations, which includes shutting down Oasis apps.
  • WNF_HOLO_UNINSTALL_COMPLETE id1 A3BC6075 id2 E8A0125
    This event signals that uninstall has finished. Data contains a HRESULT representing uninstall success.
  • WNF_HOLO_SET_SHELL_SPAWN_POINT id1 A3BC6835 id2 E8A0125
    This event signals that the shell spawn point should be moved. Data is a DWORD indicating the id of the point that should be set.
  • WNF_HOLO_RETAIL_DEMO_TIMER id1 A3BC7035 id2 E8A0125
    Event raised when the Windows Mixed Reality retail demo timer state changes. Data contains a DWORD equivalent to MixedRealityPortal::RetailDemoTimerState.
  • WNF_HOLO_DISPLAY_QUALITY_LEVEL id1 A3BC7835 id2 E8A0125
    Event raised when the benchmarked quality level changes. Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:DisplayQualityState
  • WNF_HOLO_UNINSTALL_PREPARE_COMPLETE id1 A3BC8075 id2 E8A0125
    This event signals that a HoloCoordinator completed uninstall preparation.
  • WNF_HOLO_SYSTEM_DISPLAY_CONTEXT_CHANGE id1 A3BC8875 id2 E8A0125
    System scoped event raised when the display context changes (ex. from physical monitor to HMD). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:UserDisplayContext
  • WNF_HOLO_REQUEST_HMD_USE_STATE id1 A3BC9035 id2 E8A0125
    This event signals the desire to change the HMD use state (the overrideable internal setting, not the physical presence state reported by the HMD). Meant to be used by non-shell inbox applications to trigger the equivalent of the input switch hotkey. Data contains a DWORD equivalent to a bool; true = HmdUseState::InUse, false = HmdUseState::Idle.
  • WNF_HOLO_REQUEST_HOLOGRAPHIC_ACTIVATION_REALM id1 A3BC9835 id2 E8A0125
    This event signals the desire to change the current input foreground to go to the last active 3D window. Meant to be used by non-shell inbox applications to return focus to 3D realm.
  • WNF_HOLO_RESET_IDLE_TIMER id1 A3BCA035 id2 E8A0125
    This event signals a reset of the holographic idle timer. Writable by DWM and System.
  • WNF_HOLO_SHELL_STATE_INTERACTIVE_USER id1 A3BCA875 id2 E8A0125
    Event raised when the Holographic Shell running state changes on the interactive users session (ex. from Running to Suspended). Data contains a DWORD equivalent to Windows::Internal::Shell::Holographic:ShellState
  • WNF_HOLO_SHARING_SESSION_CONTEXT id1 A3BCB035 id2 E8A0125
    This event signals whether sharing session is active. Data contains a name of the data provider.
  • WNF_HOLO_PROJECTION_REQUEST id1 A3BCB835 id2 E8A0125
    This event signals a miracast projection to establish.
  • WNF_HOLO_CAPTURE_STATE id1 A3BCC035 id2 E8A0125
    This event signals whether recording is active. Data contains a bool indicating if recording is active.
  • WNF_HVL_CPU_MGMT_PARTITION id1 A3BC0875 id2 418A1825
    This state signals NTOS has CPU management privileges in the current partition.
  • WNF_HYPV_HOST_WMI_OBJECT_PROVIDER_STATE id1 A3BC0875 id2 17961725
    The state of Hyper-V's host-only WMI object provider.
  • WNF_HYPV_HOST_WMI_EVENT_PROVIDER_STATE id1 A3BC1075 id2 17961725
    The state of Hyper-V's host-only WMI event provider.
  • WNF_IMSN_MONITORMODECHANGED id1 A3BC0835 id2 F950324
    A monitor has changed immersive modes
  • WNF_IMSN_LAUNCHERVISIBILITY id1 A3BC1035 id2 F950324
    The immersive launcher's visibility has changed
  • WNF_IMSN_IMMERSIVEMONITORCHANGED id1 A3BC1835 id2 F950324
    The monitor the immersive environment is running on has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_IMSN_KILL_LOGICAL_FOCUS id1 A3BC3035 id2 F950324
    User-perceived focus has left an edit box.
  • WNF_IMSN_PROJECTIONDISPLAYAVAILABLE id1 A3BC3835 id2 F950324
    Projection display availability has changed
  • WNF_IMSN_TRANSPARENCYPOLICY id1 A3BC4035 id2 F950324
    The user experience transparency policy stores the global system transparency policy as a DWORD which contains 0 for disabled and 1 for enabled.
  • WNF_IMSN_GLOBALLIGHTSINVALIDATED id1 A3BC4835 id2 F950324
    The global/shared lights have changed.
  • WNF_IUIS_SCALE_CHANGED id1 A3BC0835 id2 128F1B24
    The immersive UI scale has changed for the current session.
  • WNF_ISM_LAST_USER_ACTIVITY id1 A3BC0835 id2 418B1D24
    Last recorded user activity
  • WNF_ISM_INPUT_UPDATE_AFTER_TRACK_INTERVAL id1 A3BC1035 id2 418B1D24
    Fires if there is new input after track interval.
  • WNF_ISM_CURSOR_MANAGER_READY id1 A3BC1835 id2 418B1D24
    Cursor Manager is initialized. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_ISM_GAMECONTROLLER_ZEPHYRUS_FAULT id1 A3BC2075 id2 418B1D24
    This event signals when the Zephyrus controller has encountered a fault that requires a shell notification.
  • WNF_IOT_EMBEDDED_MODE_POLICY_VALUE_CHANGED id1 A3BC0875 id2 41920124
    Embedded mode policy value has changed.
  • WNF_IOT_STARTUP_SETTINGS_CHANGED id1 A3BC1075 id2 41920124
    settings for the foreground app and/or iot startup type background tasks have changed
  • WNF_LANG_FOD_INSTALLATION_STARTED id1 A3BC0875 id2 6880F21
    Installation of language features on demand was started (either through Settings or through installation task).
  • WNF_LED_SETTINGSCHANGED id1 A3BC0875 id2 41820B21
    LedAlert settings has changed
  • WNF_LM_PACKAGE_SUSPEND_REQUIRED id1 A3BC0875 id2 41C60321
    A running package's license is now invalid and the package must be suspended or terminated.
  • WNF_LM_CONTENT_LICENSE_CHANGED id1 A3BC1075 id2 41C60321
    A content license's state has been modified.
  • WNF_LM_ROOT_LICENSE_CHANGED id1 A3BC1875 id2 41C60321
    A root license's state has been modified.
  • WNF_LM_OPTIONAL_PACKAGE_SUSPEND_REQUIRED id1 A3BC2075 id2 41C60321
    A running optional package's license is lost.
  • WNF_LM_APP_LICENSE_EVENT id1 A3BC2875 id2 41C60321
    Multi-purpose event for app license notifications.
  • WNF_LM_OFFLINE_PC_CHANGED id1 A3BC3075 id2 41C60321
    A offline pc state has been changed.
  • WNF_LM_LICENSE_REFRESHED id1 A3BC3875 id2 41C60321
    Licenses have been refreshed.
  • WNF_LIC_NO_APPLICABLE_LICENSES_FOUND id1 A3BC0875 id2 41850721
    Failed to launch the modern app because no valid licenses and leases were found
  • WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_OUT_OF_TOLERANCE id1 A3BC1075 id2 41850721
    The device license hardware ID is out of tolerance with the device's hardware ID
  • WNF_LIC_HARDWAREID_IN_DEVICE_LICENSE_IN_TOLERANCE id1 A3BC1875 id2 41850721
    The hardware ID has changed but is still with in tolerance with the device's hardware ID
  • WNF_LIC_DEVICE_LICENSE_UPDATED id1 A3BC2075 id2 41850721
    A new device license with a different device ID was installed
  • WNF_LIC_DEVICE_LICENSE_REMOVED id1 A3BC2875 id2 41850721
    The device license was uninstalled
  • WNF_LIC_DEVICE_LICENSE_MISSING id1 A3BC3075 id2 41850721
    The required device license was nout found
  • WNF_LIC_INT_DEVICE_LICENSE_EXPIRED id1 A3BC3875 id2 41850721
    The integration device license has expired and can no longer be used to verify or decrypt modern app licenses.
  • WNF_LIC_LOCAL_MIGRATED_LICENSES_FOUND id1 A3BC4075 id2 41850721
    Found a local migrated license which needs to be refereshed with a store signed license.
  • WNF_LIC_MANAGE_DEVICE_REGISTRATION_AND_REACTIVATION id1 A3BC4875 id2 41850721
    The MDM Licensing Device Registration Policy has been refreshed.
  • WNF_OLIC_OS_EDITION_CHANGE id1 A3BC5075 id2 28F0222
    OS Edition has changed.
  • WNF_OLIC_OS_LICENSE_POLICY_CHANGE id1 A3BC5875 id2 28F0222
    OS Policy has changed.
  • WNF_OLIC_OS_LICENSE_TERMS_ACCEPTED id1 A3BC6075 id2 28F0222
    The License Terms can be considered as accepted on this device.
  • WNF_OLIC_OS_LICENSE_NON_GENUINE id1 A3BC6875 id2 28F0222
    OS will soon notify user of non-genuine state.
  • WNF_LOGN_EOA_FLYOUT_POSITION id1 A3BC0835 id2 F810121
    Indicates where the ease of access flyout should appear in LogonUI and User Oobe, the data type is RECT. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
  • WNF_LOGN_SLIDE_TO_SHUTDOWN id1 A3BC1035 id2 F810121
    Indicates that a shutdown has been triggered via Slide-to-shutdown. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts
  • WNF_LOGN_RETURN_TO_LOCK id1 A3BC1835 id2 F810121
    Indicates that user intends to interact with the lock screen (e.g. for Projection or Cortana) and LogonUI should return to the lock screen.
  • WNF_LOGN_PINPAD_VISIBLE id1 A3BC2035 id2 F810121
    Indicates that the mobile pinpad is visible.
  • WNF_LOGN_LOCAL_SIGNON id1 A3BC2875 id2 F810121
    Indicates logon from local console happened, the data type is a GUID which represents the logged-on credential provider CLSID. The sddl string grants subscribe and publish permission to System
  • WNF_LOGN_CREDENTIAL_TILE_SELECTION_CHANGED id1 A3BC3075 id2 F810121
    This event signals when a credential tile has been selected or deselected.
  • WNF_LOGN_SUPPRESS_FINGERPRINT_WAKE id1 A3BC3835 id2 F810121
    Indicates that device wake via fingerprint sensor should be disabled. The sddl string grants subscribe and publish permission to both System and Authenticated user accounts, and to App Containers with the userSignInSupport Capability
  • WNF_MAPS_MAPLOADER_PROGRESS id1 A3BC1075 id2 12960F20
    Current progress of the MapLoader background engine.
  • WNF_MAPS_MAPLOADER_STATUS_CHANGE id1 A3BC1875 id2 12960F20
    The new status of ODML.
  • WNF_MAPS_MAPLOADER_PACKAGE_CHANGE id1 A3BC2075 id2 12960F20
    A map package has been added or removed or repositioned in the list.
  • WNF_SYNC_REQUEST_PROBE id1 A3BC0875 id2 288173E
    Sync sets this value to request a wifi probe due to SSL error. SDDL comes from ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_MUR_MEDIA_UI_REQUEST_WLAN id1 A3BC0875 id2 41941B20
    Interface to Media-UI-request-State mapping for WLAN (802.1x) interfaces
  • WNF_MUR_MEDIA_UI_REQUEST_LAN id1 A3BC1075 id2 41941B20
    Interface to Media-UI-request-State mapping for LAN (802.3) interfaces
  • WNF_MSA_ACCOUNTSTATECHANGE id1 A3BC0835 id2 41871D20
    Notification for alerting client apps that the connected account ticketing state has changed
  • WNF_MSA_TPM_AVAILABLE id1 A3BC1475 id2 41871D20
    Notification for alerting client apps that the server has reported TPM claims are available in new tickets. Payload is DWORD (enum TpmKeyStateServer) and permanent since it represents device capability needed across reboot.
  • WNF_MSA_TPM_SERVER_CLIENT_KEY_STATE_UPDATED id1 A3BC1875 id2 41871D20
    Notification for alerting client apps about the current client and server TPM state for logging and retry logic. Payload is a struct of two DWORDs (enum TpmKeyStateServer, enum TpmKeyStateClient).
  • WNF_MM_BAD_MEMORY_PENDING_REMOVAL id1 A3BC0875 id2 41C60320
    This notification is raised when the memory manager is unable to automatically offline a bad memory page
  • WNF_MON_THERMAL_CAP_CHANGED id1 A3BC0875 id2 41880120
    Triggered by a monitor device when the thermal limit on brightness is changed. Payload is a MONITOR_THERMAL_BRIGHTNESS_LIMIT_LIST.
  • WNF_MRT_QUALIFIER_CONTRAST_CHANGED id1 A3BC0875 id2 41921C20
    This state is notified when the constrast qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
  • WNF_MRT_QUALIFIER_THEME_CHANGED id1 A3BC1075 id2 41921C20
    This state is notified when the theme qualifier changed its value. There is nothing in the payload. Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml
  • WNF_MRT_PERSISTENT_QUALIFIER_CHANGED id1 A3BC1C75 id2 41921C20
    This state is notified when some persistent qualifier changed its value. Payload is qualifier@package_name with a max length of 512 bytes (256 WCHARs including null terminator). Subscribers will need to query the qualifier value provider for the latest value. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
  • WNF_MRT_MERGE_SYSTEM_PRI_FILES id1 A3BC2075 id2 41921C20
    This state is notified when system PRI files are merged. Payload has a max length of 128 bytes (64 WCHARs including null terminator) and consists of 'start [starting timestamp]' or 'done [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers
  • WNF_MRT_SYSTEM_PRI_MERGE id1 A3BC2875 id2 41921C20
    This state is notified when a system PRI file is merged. Payload has a max length of 512 bytes (256 WCHARs including null terminator) and consists of either 'start [path] [starting timestamp]' or '{done,skipped} [path] [starting timestamp] [ending timestamp]'. SDDL comes from ID_CAP_EVERYONE and ID_CAP_PM_1ST_PARTY in %SDXMAPROOT%\src\appplat\packages\appplatform\appplatform.pkg.xml, plus all rights for all containers. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_NASV_USER_PRESENT id1 A3BC0835 id2 17950F23
    NaAuth User Presence Status
  • WNF_NASV_SERVICE_RUNNING id1 A3BC1075 id2 17950F23
    NaAuth Service Running
  • WNF_NASV_USER_AUTHENTICATION id1 A3BC1835 id2 17950F23
    NaAuth User Authentication Status
  • WNF_NASV_DYNAMIC_LOCK_BLUETOOTH_STATUS id1 A3BC2075 id2 17950F23
    NaAuth Extended Dynamic Lock Status for Bluetooth plugin
  • WNF_NCB_APP_AVAILABLE id1 A3BC0875 id2 41840D23
    NCB indication of CCT or Socket Broker Based App availability.
  • WNF_NDIS_ADAPTER_ARRIVAL id1 A3BC0875 id2 128F0A23
    NDIS finds a network adapter that needs to be configured by NetSetupSvc.
  • WNF_NDIS_CORRUPTED_STORE id1 A3BC1075 id2 128F0A23
    NDIS detects corruption in the binding store.
  • WNF_NLM_VPN_RECONNECT_CHANGE id1 A3BC0875 id2 418B0223
    This event is signalled by rasman about reconnect VPN state change and is used by NLM
  • WNF_NLM_INTERNET_PRESENT id1 A3BC1075 id2 418B0223
    This event is signalled by NLM when the aggregated network conditions indicate that a connection to the internet is present
  • WNF_NFC_SE_CARD_EMULATION_STATE_CHANGED id1 A3BC0875 id2 41850823
    This state is used to notify that the NFC CE policy changed.
  • WNF_PAY_CANMAKEPAYMENT_BROKER_READY id1 A3BC0875 id2 419F0F3D
    This state is used to notify that the CanMakePayment background broker is initialized and ready.
  • WNF_NGC_PREGEN_TRIGGER id1 A3BC0875 id2 41850923
    This event signals when an caller wants to trigger KeyPregenTask.
  • WNF_NGC_AIKCERT_TRIGGER id1 A3BC1075 id2 41850923
    This event signals when an caller wants to trigger AikCertEnrollTask.
  • WNF_NGC_PRO_CSP_POLICY_CHANGED id1 A3BC1875 id2 41850923
    This event is fired when a policy change occurs in the NGC Pro CSP.
  • WNF_NGC_PREGEN_DELAY_TRIGGER id1 A3BC2075 id2 41850923
    This event signals when an caller wants to trigger KeyPregenTask with some delay.
  • WNF_NGC_GESTURE_AUTHENTICATED id1 A3BC2875 id2 41850923
    This event signals when NGC container service (ngcctnrsvc) authenticates a gesture.
  • WNF_NGC_CRYPTO_MDM_POLICY_CHANGED id1 A3BC3075 id2 41850923
    This event is fired when an MDM cryptographic policy change occurs.
  • WNF_NGC_CREDENTIAL_REFRESH_REQUIRED id1 A3BC3875 id2 41850923
    This event is fired when an activity occurs that requires the NGC PIN cred prov to refresh its credential state.
  • WNF_NGC_PIN_RESET_SCENARIO_STATE_CHANGE id1 A3BC4035 id2 41850923
    This event is fired when the state has changed during the PIN reset scenario.
  • WNF_NGC_LAUNCH_PIN_RESET_SCENARIO id1 A3BC4875 id2 41850923
    This event is fired from the NGC PIN cred prov to signal that the PIN reset scenario should be launched.
  • WNF_NGC_CREDENTIAL_RESET_EXPERIENCE_ACTIVE id1 A3BC5075 id2 41850923
    Boolean state representing whether or not the Credential Reset User Experience is active.
  • WNF_NGC_CONTAINER_CREATED_OR_DELETED id1 A3BC5875 id2 41850923
    This event is fired from NGC container service (ngcctnrsvc) when containers are created or deleted.
  • WNF_NGC_LAUNCH_NTH_USER_SCENARIO id1 A3BC6075 id2 41850923
    This event is fired from the NGC PIN cred prov to signal that an Nth user scenario should be launched.
  • WNF_NGC_PREGEN_NGCISOCTNR_TRIGGER id1 A3BC6875 id2 41850923
    This event triggers the NgcIsoCtnr key pre-gen pool to start generating a key.
  • WNF_NLA_CAPABILITY_CHANGE id1 A3BC0875 id2 41870223
    This event is notified when NCSI detects a capability change
  • WNF_NLA_TASK_TRIGGER id1 A3BC1875 id2 41870223
    State name triggering WiFiTask from NlaSvc
  • WNF_WPN_USER_PLATFORM_READY id1 A3BC08F5 id2 41881E3A
    This WNF state indicates to users of WPN endpoints (except AppEndpoint) that platform is ready to use. This state can also be used to know if WPN platform restarted.
  • WNF_WPN_PLATFORM_INITIALIZED id1 A3BC10F5 id2 41881E3A
    This WNF state can be used by first party Apps / Services to determine when WPN platform is ready to handle app related requests like posting toast / tile and getting channel uri.
  • WNF_WPN_SYSTEM_PLATFORM_READY id1 A3BC1875 id2 41881E3A
    State indicating that system notification platform has been registered and ready to user.
  • WNF_WPN_USER_IN_SESSION_PLATFORM_READY id1 A3BC2035 id2 41881E3A
    This WNF state indicates that USER_PLATFORM_READY was fired for a user in the current session. This is intended to provide a workaround for the inability to use RtlSubscribeWnfStateChangeNotification for a user other than the current process token. A process can register for this WNF and then poll the per-user WNF states under impersonation.
  • WNF_NPSM_SERVICE_STARTED id1 A3BC0875 id2 C951E23
    This notification is to indicate that the NPSM service has started up.
  • WNF_NSI_SERVICE_STATUS id1 A3BC0875 id2 418F1D23
    NSI service status. The SDDL grants subscribe access to all who have access to NSI RPC interface and subcribe + publish access to NSI service.
  • WNF_CSC_SERVICE_START id1 A3BC0875 id2 41851D2E
    CSC Service start trigger
  • WNF_WOSC_ML_MODELS_CHANGED id1 A3BC0875 id2 295013A
    Triggered every time there is a change in the OneSettings configuration for machine learning model configurations
  • WNF_WOSC_FEATURE_CONFIGURATION_CHANGED id1 A3BC1075 id2 295013A
    Triggered every time there is a change in the OneSettings configuration for Velocity feature configurations
  • WNF_OOBE_SHL_MAGNIFIER_QUERY id1 A3BC0835 id2 4840122
    Notification from ISM to OOBE to query the user whether to activate the always-on Magnifier in OOBE
  • WNF_OOBE_SHL_MAGNIFIER_CONFIRM id1 A3BC1035 id2 4840122
    Notification from OOBE to ISM whether the user confirms to activate the always-on Magnifier in OOBE
  • WNF_OOBE_SHL_MONITOR_STATE id1 A3BC1875 id2 4840122
    Notification to User OOBE monitor on where the progress is
  • WNF_OOBE_SHL_SPEECH_CONTROLLER id1 A3BC2035 id2 4840122
    Notification of speech controller state change. Payload is state type plus string of length 512
  • WNF_OVRD_OVERRIDESCALEUPDATED id1 A3BC0875 id2 5941822
    The window's override scale has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_PFG_PEN_FIRST_TAP id1 A3BC0875 id2 4181083D
    First Pen Tap Gesture
  • WNF_PFG_PEN_FIRST_DRAG id1 A3BC1075 id2 4181083D
    First Pen Drag Gesture
  • WNF_PO_SCENARIO_CHANGE id1 A3BC0875 id2 41C6013D
    Sent when the WDI session corresponding to a power scenario changes
  • WNF_PO_COMPOSITE_BATTERY id1 A3BC1075 id2 41C6013D
    Sent when the composite battery is updated
  • WNF_PO_POWER_STATE_CHANGE id1 A3BC1875 id2 41C6013D
    Sent after WNF_PO_COMPOSITE_BATTERY when batteries are added or removed and when one or more batteries' AC, charging, or discharging states changes
  • WNF_PO_ENERGY_SAVER_STATE id1 A3BC2075 id2 41C6013D
    Triggered when Energy Saver state changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_PO_ENERGY_SAVER_SETTING id1 A3BC2875 id2 41C6013D
    Triggered when Energy Saver setting changes
  • WNF_PO_ENERGY_SAVER_OVERRIDE id1 A3BC3075 id2 41C6013D
    Triggered to indicate Energy Saver override settings
  • WNF_PO_THERMAL_STANDBY id1 A3BC3875 id2 41C6013D
    Triggered to indicate CR3 condition
  • WNF_PO_THERMAL_SHUTDOWN_OCCURRED id1 A3BC4075 id2 41C6013D
    Sent when the previous shutdown was due to a thermal trip
  • WNF_PO_THERMAL_HIBERNATE_OCCURRED id1 A3BC4875 id2 41C6013D
    Sent when the previous hibernate was due to a thermal trip
  • WNF_PO_DISCHARGE_ESTIMATE id1 A3BC5075 id2 41C6013D
    Estimated time until full discharge in seconds
  • WNF_PO_DISCHARGE_START_FILETIME id1 A3BC5C75 id2 41C6013D
    Filetime of last known start of discharge
  • WNF_PO_CHARGE_ESTIMATE id1 A3BC6075 id2 41C6013D
    Estimated time until full charge in seconds
  • WNF_PO_THERMAL_OVERTHROTTLE id1 A3BC6875 id2 41C6013D
    Triggered to indicate excessive thermal throttling
  • WNF_PO_USER_AWAY_PREDICTION id1 A3BC7075 id2 41C6013D
    Sent to indicate whenever user-away prediction is updated.
  • WNF_PO_DISPLAY_REQUEST_ACTIVE id1 A3BC7835 id2 41C6013D
    Sent to indicate whether a display request is active in the current session.
  • WNF_PO_BATTERY_CHARGE_LEVEL id1 A3BC8075 id2 41C6013D
    Triggered when battery charge crosses well-known charge level boundaries.
  • WNF_PO_SLEEP_STUDY_USER_PRESENCE_CHANGED id1 A3BC8875 id2 41C6013D
    Sent when the global user presence changes.
  • WNF_PO_BACKGROUND_ACTIVITY_POLICY id1 A3BC9075 id2 41C6013D
    Sent when the background activity policy changes.
  • WNF_PO_BATTERY_DISCHARGING id1 A3BC9875 id2 41C6013D
    Triggered when battery is being discharged, irrespective of AC/DC state of the system.
  • WNF_PO_PRIMARY_DISPLAY_VISIBLE_STATE id1 A3BCA075 id2 41C6013D
    Visible state of the primary display as MONITOR_DISPLAY_STATE
  • WNF_PO_PRIMARY_DISPLAY_LOGICAL_STATE id1 A3BCA875 id2 41C6013D
    Logical state of the primary display as MONITOR_LOGICAL_DISPLAY_STATE
  • WNF_PO_PREVIOUS_SHUTDOWN_STATE id1 A3BCB075 id2 41C6013D
    Sent on every boot to notify previous shutdown state
  • WNF_PO_MODERN_STANDBY_EXIT_INITIATED id1 A3BCB875 id2 41C6013D
    Triggered at the start of a transition to exit modern standby
  • WNF_PO_SW_HW_DRIPS_DIVERGENCE id1 A3BCC075 id2 41C6013D
    Sent when SW DRIPS is more than HW DRIPS by a specific threshold
  • WNF_PO_DRIPS_DEVICE_CONSTRAINTS_REGISTERED id1 A3BCC875 id2 41C6013D
    Sent once platform idle states and associated device constraints have been registered
  • WNF_PO_BASIC_BRIGHTNESS_ENGINE_DISABLED id1 A3BCD075 id2 41C6013D
    One time system-wide transition to switch from the basic brightness engine to the high-precision brightness engine.
  • WNF_PO_BRIGHTNESS_ALS_OFFSET id1 A3BCD875 id2 41C6013D
    ALS brightness offset consumed by the basic brightness engine.
  • WNF_PO_VIDEO_INITIALIALIZED id1 A3BCE075 id2 41C6013D
    Set to TRUE when the video system is initialized.
  • WNF_PO_OVERLAY_POWER_SCHEME_UPDATE id1 A3BCE875 id2 41C6013D
    Notification for power-setting overlay scheme change.
  • WNF_PO_CAD_STICKY_DISABLE_CHARGING id1 A3BCF075 id2 41C6013D
    Set when an you want IOCTL_CAD_DISABLE_CHARGING to behave in a sticky manner
  • WNF_PO_POWER_BUTTON_STATE id1 A3BCF875 id2 41C6013D
    Describes the current state of the power button.
  • WNF_PO_SYSTEM_TIME_CHANGED id1 A3BD0075 id2 41C6013D
    Supplies the notification about system time changed. Payload has 2 ULONGLONG for new time and old time.
  • WNF_PO_WEAK_CHARGER id1 A3BD0875 id2 41C6013D
    Triggered when a weak charger is detected. Note that there may be several minute delay between when charger is plugged in and when the notification is produced.
  • WNF_PO_PRESLEEP_NOTIFICATION id1 A3BD1075 id2 41C6013D
    Triggered several minutes prior to idling to sleep.
  • WNF_PO_INPUT_SUPPRESS_NOTIFICATION id1 A3BD1875 id2 41C6013D
    Triggered when device is sourced from battery(DC) with lid closed and no external monitor connected.
  • WNF_PO_WAKE_ON_VOICE_STATE id1 A3BD2075 id2 41C6013D
    Sent when wake on voice state changes.
  • WNF_PO_OPPORTUNISTIC_CS id1 A3BD2875 id2 41C6013D
    Sent to indicate period of opportunistic connectivity in standby.
  • WNF_PO_INPUT_SUPPRESS_NOTIFICATION_EX id1 A3BD3075 id2 41C6013D
    Describes the input suppression state for modern standby system based on power source, lid state, monitor state, external monitor state and system opted-in policy.
  • WNF_PO_BATTERY_CHARGE_LIMITING_MODE id1 A3BD3875 id2 41C6013D
    Set to TRUE when one of the battery is in charge limiting mode and FALSE when none of the battery is in charge limiting mode.
  • WNF_PNPA_DEVNODES_CHANGED id1 A3BC0875 id2 96003D
    This corresponds to a DBT_DEVNODES_CHANGED message
  • WNF_PNPA_DEVNODES_CHANGED_SESSION id1 A3BC1035 id2 96003D
    This corresponds to a DBT_DEVNODES_CHANGED message
  • WNF_PNPA_VOLUMES_CHANGED id1 A3BC1875 id2 96003D
    This corresponds to a drive letter arrival/removal message
  • WNF_PNPA_VOLUMES_CHANGED_SESSION id1 A3BC2035 id2 96003D
    This corresponds to a drive letter arrival/removal message
  • WNF_PNPA_HARDWAREPROFILES_CHANGED id1 A3BC2875 id2 96003D
    This corresponds to a hardware profiles changed message
  • WNF_PNPA_HARDWAREPROFILES_CHANGED_SESSION id1 A3BC3035 id2 96003D
    This corresponds to a hardware profiles changed message
  • WNF_PNPA_PORTS_CHANGED id1 A3BC3875 id2 96003D
    This corresponds to a ports changes message
  • WNF_PNPA_PORTS_CHANGED_SESSION id1 A3BC4035 id2 96003D
    This corresponds to a ports changes message
  • WNF_PNPB_AWAITING_RESPONSE id1 A3BC0875 id2 396003D
    This corresponds to kernel PNP waiting synchronously for user-mode clients
  • WNF_PNPC_REBOOT_REQUIRED id1 A3BC0875 id2 296003D
    This corresponds to a reboot of the system needs to be performed due to a device installation
  • WNF_PNPC_DEVICE_INSTALL_REQUESTED id1 A3BC1075 id2 296003D
    Device installation is requested.
  • WNF_PNPC_CONTAINER_CONFIG_REQUESTED id1 A3BC1875 id2 296003D
    A change that requires a device container to be updated has occured.
  • WNF_PROV_TURN_COMPLETE id1 A3BC0875 id2 17891C3D
    Fired when a full set of packages are processed.
  • WNF_PROV_TPM_ATTEST_COMPLETE id1 A3BC1075 id2 17891C3D
    Fired when TPM, NGC, and MSA all report ready for new tickets to contain the TPM claim. Event contains the HRESULT for the operation.
  • WNF_PROV_AUTOPILOT_PROFILE_AVAILABLE id1 A3BC1875 id2 17891C3D
    Fired when an AutoPilot profile is available locally and is non-empty. Event contains the HRESULT for the operation.
  • WNF_PROV_AUTOPILOT_ASYNC_COMPLETE id1 A3BC2075 id2 17891C3D
    Fired when the AutoPilot profile manager completes and is ready to unload.
  • WNF_PROV_AUTOPILOT_TPM_MSA_TRIGGER id1 A3BC2875 id2 17891C3D
    Fired when the AutoPilot profile manager determines that the MSA client may need to update TPM state
  • WNF_PROV_DEVICE_BOOTSTRAP_COMPLETE id1 A3BC3075 id2 17891C3D
    Fired when the Server provisioning in the blocking Device Bootstrap page of commercial OOBE is complete. Data passed in is a DWORD. 0x1, if Bootstrap is complete.
  • WNF_DEVM_PROVISIONING_COMPLETE id1 A3BC0875 id2 C900B29
    State of boot provisioning tasks. Set to 1 when provisioning is complete. SDDL comes from ID_CAP_PHONEPROVISIONER_EVENTS and PhoneProvisioner in %SDXROOT%\src\devmgmt\dm\packages\provisioning\provisioning.pkg.xml and MvProvisionHost in %SDXROOT%\src\devmgmt\dm\packages\multivariant\multivariant.pkg.xml
  • WNF_DEVM_DMWAPPUSHSVC_READY id1 A3BC1875 id2 C900B29
    Multivariant is ready to deliver SMS messages to RILAdaptation (or any registered recipient)
  • WNF_DEVM_MULTIVARIANT_PROVISIONING_SESSIONS id1 A3BC3075 id2 C900B29
    Multivariant provisioning session status (per slot). Everyone (WD) can subscribe, but just Local System and Admin can publish (SY, BA).
  • WNF_PS_WAKE_CHARGE_RESOURCE_POLICY id1 A3BC0875 id2 41C61D3D
    This corresponds to an application that has eclipsed job wake charge resource policy
  • WNF_PTI_WNS_RECEIVED id1 A3BC0875 id2 418F1A3D
    A WNS notification has been received and the Push To Install service should process it.
  • WNF_SRC_SYSTEM_RADIO_CHANGED id1 A3BC0875 id2 41851C3E
    This event signals when system radio is changed
  • WNF_RDR_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC0875 id2 41940A3F
    This event signals when the client didn't discover SMB1 usage for a specific period
  • WNF_RM_MEMORY_MONITOR_USAGE_LEVEL id1 A3BC0875 id2 41C6033F
    Supplies the current RM memory monitor memory usage level. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_RM_GAME_MODE_ACTIVE id1 A3BC1075 id2 41C6033F
    Supplies the process ID of the current game mode recipient, or 0 if no recipient is active
  • WNF_RM_QUIET_MODE id1 A3BC1875 id2 41C6033F
    Supplies the current quiet mode state as recorded by central resource manager
  • WNF_HAM_SYSTEM_STATE_CHANGED id1 A3BC0875 id2 418B0F25
    Supplies the current state of the system as recorded by the system state tracker
  • WNF_RPCF_FWMAN_RUNNING id1 A3BC0875 id2 7851E3F
    This event signals when the RPC firewall manager is initialized
  • WNF_RTDS_RPC_INTERFACE_TRIGGER_CHANGED id1 A3BC0875 id2 12821A3F
    An RPC service trigger has been added or removed
  • WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED id1 A3BC1875 id2 12821A3F
    A named pipe service trigger has been added or removed
  • WNF_SCM_AUTOSTART_STATE id1 A3BC0875 id2 418B0D3E
    This event triggers to indicate SCM autostart state
  • WNF_SBS_UPDATE_AVAILABLE id1 A3BC0875 id2 41950C3E
    This event signals that there is an update available to the Secure Boot variables.
  • WNF_WSC_SECURITY_CENTER_USER_NOTIFICATION id1 A3BC0875 id2 41851D3A
    A notification dialog should be shown to the user.
  • WNF_SDO_ORIENTATION_CHANGE id1 A3BC0875 id2 41890A3E
    This event triggers when there is a simple device orientation change. It's data value is one of the SimpleDeviceOrientation enum values. Rights: SensorService can publish, Everyone can subscribe.
  • WNF_DEP_OOBE_COMPLETE id1 A3BC0C75 id2 41960B29
    This event triggers when the system has completed OOBE (Windows Welcome)
  • WNF_DEP_UNINSTALL_DISABLED id1 A3BC1475 id2 41960B29
    This event triggers when the Uninstall of the system has been disabled
  • WNF_SHEL_IMMERSIVE_SHELL_RUNNING id1 A3BC0875 id2 D83063E
    This event signals when the Immersive Shell is started
  • WNF_SHEL_NOTIFICATIONS id1 A3BC1035 id2 D83063E
    Set to 0 or more to indicate whether there are any unseen notifications in the notification center. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable the notification on OneCore
  • WNF_SHEL_LOGON_COMPLETE id1 A3BC1875 id2 D83063E
    This system-scope event is signaled each time a user's desktop becomes ready. Consider using WNF_SHEL_SESSION_LOGON_COMPLETE for a session-scoped version.
  • WNF_SHEL_OOBE_USER_LOGON_COMPLETE id1 A3BC2475 id2 D83063E
    This event signals when logon of the first user after OOBE is complete. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed access.
  • WNF_SHEL_VEEVENT_DISPATCHER_CLIENT_PIPE_CLOSED id1 A3BC2875 id2 D83063E
    TDL dispatcher pipe has been closed
  • WNF_SHEL_TILECHANGE id1 A3BC3075 id2 D83063E
    This event is signalled when there is a tile change to a background task
  • WNF_SHEL_NOTIFICATION_SETTINGS_CHANGED id1 A3BC3835 id2 D83063E
    Event signals when toast notification settings have changed.
  • WNF_SHEL_SOFTLANDING_RULE_TRIGGERED id1 A3BC4075 id2 D83063E
    This event signals when a SoftLanding rule is triggered
  • WNF_SHEL_START_LAYOUT_READY id1 A3BC4875 id2 D83063E
    This event signals when Start Experience Host completes loading the Start menu layout
  • WNF_SHEL_APPRESOLVER_SCAN id1 A3BC5075 id2 D83063E
    Event signals a full app resolver scan has been invoked.
  • WNF_SHEL_LOCKSCREEN_ACTIVE id1 A3BC5835 id2 D83063E
    Set to 0 or 1 to indicate whether the lock screen is active. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and system can write. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
  • WNF_SHEL_START_APPLIFECYCLE_INSTALL_FINISHED id1 A3BC6075 id2 D83063E
    This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_INSTALL_FINISHED event from TDL
  • WNF_SHEL_START_APPLIFECYCLE_DOWNLOAD_STARTED id1 A3BC6875 id2 D83063E
    This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_DOWNLOAD_STARTED event from TDL
  • WNF_SHEL_APPLICATION_STATE_UPDATE id1 A3BC7075 id2 D83063E
    Event is for the shell to notify when app layout state is changed. Payload is ShellApplicationStateWnf struct.
  • WNF_SHEL_FOCUS_CHANGE id1 A3BC7875 id2 D83063E
    This event signals when focus changes to a different process, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
  • WNF_SHEL_GAMECONTROLLER_LISTENER_INFO id1 A3BC8075 id2 D83063E
    This event signals to toggle exclusive gamepad listening on and off, scoped to System, DWM SID and ID_CAP_INPUT_CORE appcontainer capability and DEFAPPS_CAPABILITY_GROUP SID on Mobile.
  • WNF_SHEL_GAMECONTROLLER_FOCUS_INFO id1 A3BC8875 id2 D83063E
    This event signals to toggle exclusive gamepad input on and off
  • WNF_SHEL_ENTERPRISE_START_LAYOUT_POLICY_VALUE_CHANGED id1 A3BC9475 id2 D83063E
    This even signals when Start layout MDM policy has been applied
  • WNF_SHEL_CORTANA_APPINDEX_UPDATED id1 A3BC9875 id2 D83063E
    Event signals when the apps have been pushed to the indexer has completed
  • WNF_SHEL_SOFTLANDING_RULES_UPDATED id1 A3BCA075 id2 D83063E
    This event signals when SoftLanding rules folder is updated
  • WNF_SHEL_NOTIFICATIONS_CRITICAL id1 A3BCA835 id2 D83063E
    This event signals that a critical notification such as an incoming call was posted. Original SDDL comes from dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml, updated to enable notification on OneCore
  • WNF_SHEL_START_VISIBILITY_CHANGED id1 A3BCB035 id2 D83063E
    This event signals when Start visibility changes
  • WNF_SHEL_TRAY_SEARCHBOX_VISIBILITY_CHANGED id1 A3BCB875 id2 D83063E
    Set to 0 or 1 to indicate whether the searchbox is visibile in the tray. SDDL follows DEVICE_LOCK_STATE SDDL on skus that don't have multiple sessions, otherwise anyone can read and only system can write.
  • WNF_SHEL_DEVICE_UNLOCKED id1 A3BCC075 id2 D83063E
    This event signals that the device is unlocked in the current session
  • WNF_SHEL_PLACES_CHANGED id1 A3BCC875 id2 D83063E
    This event signals the changes in places' database (clientgraph)
  • WNF_SHEL_SUSPEND_APP_BACKGROUND_ACTIVITY id1 A3BCD075 id2 D83063E
    Event is for the shell to notify when app background activity should be suspended. Payload is DWORD set to 1 or 0.
  • WNF_SHEL_CREATIVE_EVENT_TRIGGERED id1 A3BCD875 id2 D83063E
    This event signals a creative event has been triggered
  • WNF_SHEL_JUMPLIST_CHANGED id1 A3BCE075 id2 D83063E
    Event signals that the jumplist for an app has changed. Payload is a struct containing the current sessionId as well as a string representing the aumid of the app whose jumplist was updated.
  • WNF_SHEL_START_APPLIFECYCLE_UNINSTALL_FINISHED id1 A3BCE875 id2 D83063E
    This event signals when Start Experience Host receives an VISUALELEMENT_EVENT_APPLIFECYCLE_UNINSTALL_FINISHED event from TDL
  • WNF_SHEL_GAMECONTROLLER_NEXUS_INFO id1 A3BCF075 id2 D83063E
    This event signals whenever the nexus button policy changes.
  • WNF_SHEL_SETTINGS_CHANGED id1 A3BCF875 id2 D83063E
    This event signals when a settings toggle has changed
  • WNF_SHEL_TOAST_PUBLISHED id1 A3BD0035 id2 D83063E
    This event signals when a new toast is published
  • WNF_SHEL_SOFTLANDING_PUBLISHED id1 A3BD0835 id2 D83063E
    This event signals when a new soft landing tip is published
  • WNF_SHEL_REQUEST_CORTANA_SETTINGSCONSTRAINTINDEX_BUILD id1 A3BD1075 id2 D83063E
    Event signals when an app requests cortana to build the settings constraint index
  • WNF_SHEL_DICTATION_RUNNING id1 A3BD1835 id2 D83063E
    This is the state of dictation. SDDL comes from dwm.exe in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml and WPNarrator in %SDXROOT%\src\media\apps\packages\Apps\WPNarrator.pkg.xml. And Phone DefApps group is required too.
  • WNF_SHEL_DDC_COMMAND_AVAILABLE id1 A3BD2075 id2 D83063E
    This event signals when a parsed command is ready for processing
  • WNF_SHEL_DDC_WNS_COMMAND id1 A3BD2875 id2 D83063E
    This event signals when a command has been delivered via WNS
  • WNF_SHEL_DDC_SMS_COMMAND id1 A3BD3075 id2 D83063E
    This event signals when a command has been delivered via SMS
  • WNF_SHEL_DEVICE_LOCKED id1 A3BD3875 id2 D83063E
    This event signals that the device is locked in the current session
  • WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_ACTIVATED id1 A3BD4075 id2 D83063E
    This event signals a subscription has been activated.
  • WNF_SHEL_TARGETED_CONTENT_SUBSCRIPTION_UPDATED id1 A3BD4875 id2 D83063E
    This event signals the content of one or more subscriptions has been updated.
  • WNF_SHEL_LOCKSCREEN_IMAGE_CHANGED id1 A3BD5075 id2 D83063E
    This event signals that lock screen image had changed. It contains the user sid whose image was changed
  • WNF_SHEL_SCREEN_COVERED id1 A3BD5875 id2 D83063E
    Set to 0 (uncovered or unknown) or 1 (covered).
  • WNF_SHEL_DDC_CONNECTED_ACCOUNTS_CHANGED id1 A3BD6075 id2 D83063E
    This event signals when connected accounts have changed and register device should be called
  • WNF_SHEL_OOBE_ENABLE_PROVISIONING id1 A3BD6835 id2 D83063E
    This event signals when OOBE in a Shell should enable its provisioning flow
  • WNF_SHEL_LOCK_APP_SHOWN id1 A3BD7035 id2 D83063E
    This event signals that the Lock application has been presented to the user. It contains an instance cookie as specified from LogonUI.
  • WNF_SHEL_LOCK_APP_REQUESTING_UNLOCK id1 A3BD7835 id2 D83063E
    This event signals that the Lock application is requesting to unlock so the user can enter credentials.
  • WNF_SHEL_TILEINSTALL id1 A3BD8075 id2 D83063E
    This event is signalled when there is a tile install to a background task
  • WNF_SHEL_TILEUPDATE id1 A3BD8875 id2 D83063E
    This event is signalled when there is a tile update to a background task
  • WNF_SHEL_TILEUNINSTALL id1 A3BD9075 id2 D83063E
    This event is signalled when there is a tile uninstall to a background task
  • WNF_SHEL_ABOVE_LOCK_APP_ACTIVE id1 A3BD9835 id2 D83063E
    This event is signalled when there is an app launched (1) or terminated (0) above lock. Processes with the WINCAP_SHELL_EXPERIENCE_COMPOSER capability are allowed full access, while all other app containers have read access.
  • WNF_SHEL_RADIALCONTROLLER_EXPERIENCE_RESTART id1 A3BDA035 id2 D83063E
    This event is signalled when the RadialController Experience has restarted to allow registered API component to re-establish connection and repopulate state
  • WNF_SHEL_ABOVE_LOCK_BIO_ACTIVE id1 A3BDA835 id2 D83063E
    This event is signalled when there is bio feedback active (1) or inactive (0) above lock
  • WNF_SHEL_CORTANA_SPEECH_CANCELHANDSFREE_REQUESTED id1 A3BDB035 id2 D83063E
    This event can be signalled when a handsfree device needs to request Cortana to cancel speech activity.
  • WNF_SHEL_CALM_DISPLAY_ACTIVE id1 A3BDB875 id2 D83063E
    Set to 0 (inactive) or 1 (active).
  • WNF_SHEL_INSTALL_PLACEHOLDER_TILES id1 A3BDC075 id2 D83063E
    This event signals a start layout change to a background task so that assets can be retrieved if necessary. Payload is PlaceholderTileWnf.
  • WNF_SHEL_PEOPLE_PINNED_LIST_CHANGED id1 A3BDC835 id2 D83063E
    This event is signalled when there is a change to the Pinned People list
  • WNF_SHEL_LOCKSTATE id1 A3BDD075 id2 D83063E
    Current lock state of the device. Payload is DEVICE_LOCKSTATE. On multisession SKUs, everyone can read while only SYSTEM can write. On single session SKUs, everyone can read while only DefaultAccount can write. On single session SKUs, also include allow list from the SDDL for DEVICE_LOCK_STATE. Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
  • WNF_SHEL_APPLICATION_SPATIAL_INFO_UPDATE id1 A3BDD875 id2 D83063E
    Event is for the shell to notify when app spatial information has changed. Payload is ApplicationSpatialInformationWnf struct.
  • WNF_SHEL_CORTANA_AUDIO_ACTIVE id1 A3BDE075 id2 D83063E
    Indicates the state of Cortana speech input and output.
  • WNF_SHEL_LOCKSCREEN_INFO_UPDATED id1 A3BDE835 id2 D83063E
    This event signals that the LockScreen info is updated.
  • WNF_SHEL_CDM_FEATURE_CONFIG_FIRST_USAGE id1 A3BDF875 id2 D83063E
    This event notifies the CDM when a new feature configuration is first used. The SDDL is scoped to AuthenticatedUsers, AppContainers and LPACs (CAPABILITY_SID_LpacAppExperience)
  • WNF_SHEL_APPLICATION_STARTED id1 A3BE0075 id2 D83063E
    This event is signals when an application launches. The Payload is the appID.
  • WNF_SHEL_APPLICATION_TERMINATED id1 A3BE0875 id2 D83063E
    This event is signals when an application is terminated. The Payload is the appID.
  • WNF_SHEL_WINDOWSTIP_CONTENT_PUBLISHED id1 A3BE10F5 id2 D83063E
    This event is signals when a request is made to show a Windows Tip bubble. The Payload is the content id(String).
  • WNF_SHEL_USER_IDLE id1 A3BE1875 id2 D83063E
    This event signals when the first time a user is idle after logon. The payload is the time the user has been idled for
  • WNF_SHEL_PEOPLE_PANE_VIEW_CHANGED id1 A3BE2035 id2 D83063E
    This event is signalled when there is a change to the People Pane Views
  • WNF_SHEL_LOCK_APP_RELOCK id1 A3BE2835 id2 D83063E
    This event signals that the lock screen should be reset due to a re-lock request.
  • WNF_SHEL_LOCK_APP_READY id1 A3BE3035 id2 D83063E
    This event signals that the lock screen is ready after a reset was requested.
  • WNF_SHEL_SESSION_LOGON_COMPLETE id1 A3BE3835 id2 D83063E
    This event is scoped to the user session and signaled when the desktop is ready after a logon
  • WNF_SHEL_HEALTH_STATE_CHANGED id1 A3BE4075 id2 D83063E
    This event signals when the health state of the device changes
  • WNF_SHEL_CONTENT_DELIVERY_MANAGER_NEEDS_REMEDIATION id1 A3BE4875 id2 D83063E
    This event signals that Content Delivery Manager content needs remediation
  • WNF_SHEL_DESKTOP_APPLICATION_STARTED id1 A3BE5075 id2 D83063E
    This event is signals when a desktop application launches. The Payload is the executable name.
  • WNF_SHEL_DESKTOP_APPLICATION_TERMINATED id1 A3BE5875 id2 D83063E
    This event is signals when a desktop application is terminated. The Payload is the executable name.
  • WNF_SHEL_SUGGESTED_APP_READY id1 A3BE60F5 id2 D83063E
    This event signals that the app launched by sign in suggestions is ready.
  • WNF_SHEL_CDM_REGISTRATION_COMPLETE id1 A3BE6835 id2 D83063E
    This event is scoped to the user session and signaled when the CDM registration is complete
  • WNF_SHEL_CONTENT_DELIVERY_MANAGER_MONITORING id1 A3BE70F5 id2 D83063E
    This event signals that Content Delivery Manager Cache Monitoring is Enabled or not.
  • WNF_SHEL_SIGNAL_LOGONUI id1 A3BE7835 id2 D83063E
    Used to signal logon controller across the desktop boundary. Only local system or the composer can read and write. Currently payload is present but ignored.
  • WNF_SHEL_ENTERPRISE_HIDE_PEOPLE_BAR_POLICY_VALUE_CHANGED id1 A3BE8075 id2 D83063E
    This event signals when the HidePeopleBar MDM policy has been updated
  • WNF_SHEL_CORTANA_MIC_TRAINING_COMPLETE id1 A3BE88F5 id2 D83063E
    This event signals when cortana speech training for 'Respond only to me' is complete
  • WNF_SHEL_CDM_FEATURE_USAGE id1 A3BE9075 id2 D83063E
    This event notifies the CDM when a feature configuration is used
  • WNF_SHEL_OOBE_PROVISIONING_COMPLETE id1 A3BE9C75 id2 D83063E
    This event signals when OOBE in a Shell has completed its provisioning flow. It is permanent since provisioning is only supported during first user OOBE.
  • WNF_SHEL_SIGNAL_MANAGER_SIGNAL_TRIGGERED id1 A3BEA075 id2 D83063E
    This event signals when the signal manager fires a signal
  • WNF_SHEL_CLOUD_FILE_INDEXED_CHANGE id1 A3BEA875 id2 D83063E
    Notification is incremented / signaled when a cloudfile state change is detected by the indexer service. Payload is count of changes. User can subscribe, but only service (indexer) can publish
  • WNF_SHEL_CLOUD_FILE_PROGRESS_CHANGE id1 A3BEB075 id2 D83063E
    Notification when a sync client or shell session updates in-memory progress within the indexer service. Payload is the tick count when the last change occurred. User can subscribe, but only service (indexer) can publish
  • WNF_SHEL_START_LAYOUT_MIGRATED id1 A3BEB8F5 id2 D83063E
    This event signals when Start Experience Host completes a layout migration
  • WNF_SHEL_ENTERPRISE_START_PLACES_POLICY_VALUE_CHANGED id1 A3BEC075 id2 D83063E
    This event signals when a Start place MDM policy (AllowPinnedFolder*) has been applied
  • WNF_SHEL_SIGNAL_MANAGER_FEATURE_TRIGGERED id1 A3BEC875 id2 D83063E
    This event is used by the Signal Manager for WIL Feature Usage subscriptions required by registered signal triggers.
  • WNF_SHEL_ACTIONCENTER_VIEWSTATE_CHANGED id1 A3BED035 id2 D83063E
    This event signals the current view state of action center.
  • WNF_SHEL_CACHED_CLOUD_NETWORK_STATE id1 A3BED875 id2 D83063E
    State of the network as reflected by shell32 listeners. Subscribed to, and published from, explorer.exe, a user process.
  • WNF_SHEL_SIGNAL_MANAGER_TESTING id1 A3BEE075 id2 D83063E
    This wnf is used for testing purposes.
  • WNF_SHEL_APPLIFECYCLE_INSTALL_STATE id1 A3BEE875 id2 D83063E
    This event signals for different app install state from the Store. The Payload is the aumId and app state.
  • WNF_SHEL_RESTORE_PAYLOAD_COMPLETE id1 A3BEF075 id2 D83063E
    CDS restore payload data is downloaded during OOBE
  • WNF_SHEL_LATEST_CONNECTED_AUTOPLAY_DEVICE id1 A3BEF875 id2 D83063E
    This wnf is signaled everytime the user connects an autoplay device. The payload is the device id (VID and PID).
  • WNF_SHEL_CORTANA_QUIET_MOMENT_AT_HOME id1 A3BF0475 id2 D83063E
    This wnf is signaled when Cortana's QuietMoment @Home inferred that the user has arrived of left home .
  • WNF_SHEL_CORTANA_BEACON_STATE_CHANGED id1 A3BF1075 id2 D83063E
    This wnf is signaled everytime the Action Center/Cortana beacon state changes. Payload is an int mapping to an enum representing the new state.
  • WNF_SHEL_QUIETHOURS_ACTIVE_PROFILE_CHANGED id1 A3BF1C75 id2 D83063E
    This wnf is signaled whenever active quiet hours profile/mode changes. The value is the restrictive level of an active profile and the restrictive level is unique per profile
  • WNF_SHEL_LOCK_ON_LOGON id1 A3BF2035 id2 D83063E
    This wnf is signaled when WinLogon detects an automatic lock on logon sequence to optimize displaying the user lock screen when the shell is ready.
  • WNF_SHEL_DEVICE_OPEN id1 A3BF2875 id2 D83063E
    This wnf indicates for some types of devices if a lid, cover or enclosure around it is closed (zero value) or open (non-zero value).
  • WNF_SHEL_CREATIVE_EVENT_BATTERY_SAVER_OVERRIDE_TRIGGERED id1 A3BF3075 id2 D83063E
    This event signals a creative event has been triggered that will allow to run during battery saver
  • WNF_SHEL_START_PROCESS_SUSPENDED_INTERNAL id1 A3BF3835 id2 D83063E
    This event allows user-mode services such as Windows Notification Platform to determine when Start is suspended
  • WNF_SHEL_SYSTEMDIALOG_PUBLISHED id1 A3BF4035 id2 D83063E
    This event signals when a new System Dialog toast is published
  • WNF_SHEL_SETTINGS_ENVIRONMENT_CHANGED id1 A3BF4875 id2 D83063E
    This wnf indicates that a variable in the settings environment has changed. The payload is the current sessionId.
  • WNF_SHEL_QUIET_MOMENT_GAME_MODE_CHANGED id1 A3BF5075 id2 D83063E
    This event signals when Quiet Hours game mode state changes
  • WNF_SHEL_NEXT_NOTIFICATION_SINK_SESSION_ID id1 A3BF5875 id2 D83063E
    A system-wide unique rolling id for notification controller sink sessions
  • WNF_SHEL_TAB_SHELL_INIT_COMPLETE id1 A3BF6035 id2 D83063E
    Event signals Tab Shell component initialization is complete, potentially after an explorer crash. Payload is an incrementing DWORD that can be used to poll if the current objects are new.
  • WNF_SHEL_LOCKAPPHOST_ACTIVE id1 A3BF6835 id2 D83063E
    Set to 0 or 1 to indicate whether lockapphost is currently active. Anyone (including apps) can read, system has write access (but on multi-session skus authenticated users also have write access). Additionally, processes with the WINCAP_CORE_SHELL or WINCAP_SHELL_EXPERIENCE_COMPOSER capability can write.
  • WNF_SHEL_CORTANA_CAPABILTIES_CHANGED id1 A3BF7035 id2 D83063E
    This wnf indicates that a cortana capabilties have changed. The payload will be the changed capabilties. The below sids are the cortana app and test app sids
  • WNF_SHEL_TASKBAR_PINS_UPDATED id1 A3BF7875 id2 D83063E
    This event indicates taskbar pins were updated. The SDDL is scoped to AuthenticatedUsers.
  • WNF_SHEL_WCOS_SESSION_ID id1 A3BF8075 id2 D83063E
    This system-scope event is signaled each time the shell attempts to start a local session on WCOS-based SKUs. It carries the latest session ID. Everyone can read from it. Authenticated users can write to it. Apps in general can read from it. Apps with WINCAP_SHELL_EXPERIENCE_COMPOSER can write to it.
  • WNF_SHEL_ASSISTANT_STATE_CHANGE id1 A3BF8875 id2 D83063E
    This wnf indicates that the assistant state has changed, e.g Talking, idle, thinking, notification pending etc
  • WNF_SIO_PIN_ENROLLED id1 A3BC0875 id2 4189073E
    Used to notify the PIN list that a PIN has been enrolled and that it should refresh.
  • WNF_SIO_BIO_ENROLLED id1 A3BC1075 id2 4189073E
    Used to notify the Delay Lock settings that Biometric enrollment has been modified.
  • WNF_SKYD_FILE_SYNC id1 A3BC0875 id2 59F053E
    A file has changed on storage and a request is received to sync.
  • WNF_SKYD_QUOTA_CHANGE id1 A3BC1075 id2 59F053E
    A user's quota has changed.
  • WNF_SMS_CHECK_ACCESS id1 A3BC0875 id2 4195033E
    This event triggers when the user revokes SMS access.
  • WNF_SMSS_MEMORY_COOLING_COMPATIBLE id1 A3BC0875 id2 1295033E
    This event triggers when the system has multiple memory channels and memory cooling can be started
  • WNF_SPAC_SPACEPORT_PROPERTY_CHANGED id1 A3BC0875 id2 2871E3E
    This notification is issued when a property of an object changes
  • WNF_SPAC_SPACEPORT_WORK_REQUESTED id1 A3BC1075 id2 2871E3E
    This notification is issued to request work in user-mode
  • WNF_SPCH_INPUT_STATE_UPDATE id1 A3BC0835 id2 9851E3E
    Indicates the state of the shared recognizer.
  • WNF_SPCH_REMOTE_SESSION_REQUEST id1 A3BC1075 id2 9851E3E
    Indicates the data pertaining to a remote request to start/stop a speech recognition session. Published by BTAGService and HidSrv
  • WNF_SPCH_DISABLE_KWS_REQUEST id1 A3BC1875 id2 9851E3E
    Indicates the KWS request from a remote device. Certain peripherals that support in-built KWS may request the system to disable the KWS runnning on Windows. Published by BTAGService
  • WNF_SRUM_SCREENONSTUDY_SESSION id1 A3BC0875 id2 C931C3E
    Sent when a screen on study session starts or ends
  • WNF_SRV_SRV2_STATE_CHANGE id1 A3BC0875 id2 41901C3E
    This event signals when the server (SRV2) start/stop
  • WNF_SRV_SMB1_NOT_IN_USE_STATE_CHANGE id1 A3BC1075 id2 41901C3E
    This event signals when the server didn't discover SMB1 usage for a specific period
  • WNF_OSWN_STORAGE_PRESENCE_CHANGE id1 A3BC6075 id2 F911D22
    This event indicates a change in the mount state of an SD card.
  • WNF_OSWN_STORAGE_VOLUME_STATUS_CHANGE id1 A3BC6875 id2 F911D22
    This event indicates a change in the volume status of an SD card.
  • WNF_OSWN_STORAGE_FREE_SPACE_CHANGE id1 A3BC7075 id2 F911D22
    This event indicates a change in the free space state of storage.
  • WNF_OSWN_STORAGE_TEMP_CLEANUP_CHANGE id1 A3BC7875 id2 F911D22
    This event indicates a change in the temp file cleanup state of storage.
  • WNF_OSWN_STORAGE_FINISHED_USAGE_CATEGORY_UPDATE id1 A3BCB875 id2 F911D22
    This event indicates completion of an update of storage usage categories.
  • WNF_OSWN_SYSTEM_CLOCK_CHANGED id1 A3BC5875 id2 F911D22
    This event informs the system tray that the date-time has changed
  • WNF_OSWN_STORAGE_SHELLHWD_EVENT id1 A3BCC075 id2 F911D22
    This event informs StorSvc that SHSVCS received a device handle event.
  • WNF_OSWN_STORAGE_APP_PAIRING_CHANGE id1 A3BC8075 id2 F911D22
    This event indicates a change in the app pairing state of an SD card.
  • WNF_SUPP_ENABLE_ERROR_DETAILS_CACHE id1 A3BC0875 id2 11961B3E
    Enable the Error Details Cache
  • WNF_SYS_SHUTDOWN_IN_PROGRESS id1 A3BC0875 id2 4195173E
    The state is published when the system has begun the shutdown or reboot process.
  • WNF_SEB_INTERNET_PRESENT id1 A3BC0875 id2 41840B3E
    Internet available or not
  • WNF_SEB_FREE_NETWORK_PRESENT id1 A3BC1075 id2 41840B3E
    Free network available or not
  • WNF_SEB_SMS_RECEIVED id1 A3BC1875 id2 41840B3E
    SMS has been received
  • WNF_SEB_NETWORK_STATE_CHANGES id1 A3BC2075 id2 41840B3E
    Network state has changed
  • WNF_SEB_MBAE_NOTIFICATION_RECEIVED id1 A3BC2875 id2 41840B3E
    Radio Operator Message received
  • WNF_SEB_NETWORK_CONTROL_CHANNEL_TRIGGER_RESET id1 A3BC3075 id2 41840B3E
    Network control channel triggers have been reset
  • WNF_SEB_TIME_ZONE_CHANGE id1 A3BC3875 id2 41840B3E
    Time zone change
  • WNF_SEB_ONLINE_ID_CONNECTED_STATE_CHANGE id1 A3BC4075 id2 41840B3E
    Online ID connected state changed. SDDL comes from ID_CAP_EVERYONE in %SDXROOT%\src\baseos\prod\packages\WLId\WLId.pkg.xml
  • WNF_SEB_SYSTEM_IDLE id1 A3BC4875 id2 41840B3E
    system is idle or not
  • WNF_SEB_BATTERY_LEVEL id1 A3BC5075 id2 41840B3E
    System is idle or not
  • WNF_SEB_DOMAIN_JOINED id1 A3BC5875 id2 41840B3E
    System is domain joined or not
  • WNF_SEB_BOOT id1 A3BC6075 id2 41840B3E
    System has booted
  • WNF_SEB_USER_PRESENT id1 A3BC6875 id2 41840B3E
    System has at least 1 user present
  • WNF_SEB_SYSTEM_AC id1 A3BC7075 id2 41840B3E
    System is AC or DC
  • WNF_SEB_MONITOR_ON id1 A3BC7875 id2 41840B3E
    Monitor is ON or OFF
  • WNF_SEB_IP_ADDRESS_AVAILABLE id1 A3BC8075 id2 41840B3E
    IP address is available or not
  • WNF_SEB_BACKGROUND_WORK_COST_CHANGE id1 A3BC8875 id2 41840B3E
    Indicate a change in the background work cost
  • WNF_SEB_BACKGROUND_WORK_COST_HIGH id1 A3BC9075 id2 41840B3E
    Background work cost is high or not
  • WNF_SEB_SYSTEM_LPE id1 A3BC9875 id2 41840B3E
    System is in Low Power Epoch or not
  • WNF_SEB_SMART_CARD_TRANSACTION_NOTIFICATION id1 A3BCA075 id2 41840B3E
    Smart card transaction notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
  • WNF_SEB_SYSTEM_MAINTENANCE id1 A3BCA875 id2 41840B3E
    System is in good state for maintenance
  • WNF_SEB_GEOLOCATION id1 A3BCB075 id2 41840B3E
    Geolocation service should be started
  • WNF_SEB_DEV_MNF_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCB875 id2 41840B3E
    OEM custom notification received
  • WNF_SEB_MOB_OPERATOR_CUSTOM_NOTIFICATION_RECEIVED id1 A3BCC075 id2 41840B3E
    MO custom notification received
  • WNF_SEB_CACHED_FILE_UPDATED id1 A3BCC875 id2 41840B3E
    Cached file has updated
  • WNF_SEB_SMART_CARD_FIELD_INFO_NOTIFICATION id1 A3BCD075 id2 41840B3E
    Smart card field entry/exit notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
  • WNF_SEB_SMART_CARD_HCE_APPLICATION_ACTIVATION_NOTIFICATION id1 A3BCD875 id2 41840B3E
    Smart card HCE application activation notification. SDDL comes from ID_CAP_NFC_ADMIN in %SDXROOT%\src\net\NFC\packages\product\NFC\NFC.pkg.xml
  • WNF_SEB_DEPRECATED7 id1 A3BCE075 id2 41840B3E
    Unused notification
  • WNF_SEB_DEPRECATED8 id1 A3BCE875 id2 41840B3E
    Unused notification
  • WNF_SEB_LOW_LATENCY_POWER_REQUEST id1 A3BCF075 id2 41840B3E
    Low-latency power request notification
  • WNF_SEB_RESILIENCY_NOTIFICATION_PHASE id1 A3BCF875 id2 41840B3E
    Resiliency phase notification
  • WNF_SEB_FULL_SCREEN_VIDEO_PLAYBACK id1 A3BD0075 id2 41840B3E
    Fullscreen video playback notification
  • WNF_SEB_NFC_PERF_BOOST id1 A3BD0875 id2 41840B3E
    Indicates high-performance boost mode for critical NFC background activity
  • WNF_SEB_APP_LAUNCH_PREFETCH id1 A3BD1075 id2 41840B3E
    Indicates app launch pre-fetch phase
  • WNF_SEB_DEPRECATED1 id1 A3BD1875 id2 41840B3E
    Unused notification
  • WNF_SEB_APP_RESUME id1 A3BD2075 id2 41840B3E
    Indicates app resume phase
  • WNF_SEB_DEPRECATED2 id1 A3BD2875 id2 41840B3E
    Unused notification
  • WNF_SEB_DEPRECATED3 id1 A3BD3075 id2 41840B3E
    Unused notification
  • WNF_SEB_DEPRECATED4 id1 A3BD3875 id2 41840B3E
    Unused notification
  • WNF_SEB_DEPRECATED5 id1 A3BD4075 id2 41840B3E
    Unused notification
  • WNF_SEB_DEPRECATED6 id1 A3BD4875 id2 41840B3E
    Unused notification
  • WNF_SEB_CALL_STATE_CHANGED id1 A3BD5075 id2 41840B3E
    Call state change notification
  • WNF_SEB_VOICEMAIL_CHANGED id1 A3BD5875 id2 41840B3E
    Voicemail change notification
  • WNF_SEB_CALL_HISTORY_CHANGED id1 A3BD6075 id2 41840B3E
    Call history change notification
  • WNF_SEB_LINE_CHANGED id1 A3BD6875 id2 41840B3E
    Phone line change notification
  • WNF_SEB_AIRPLANE_MODE_DISABLED_FOR_EMERGENCY_CALL id1 A3BD7075 id2 41840B3E
    Airplane mode disabled for emergency call notification
  • WNF_SEB_MOBILE_BROADBAND_REGISTRATION_STATE_CHANGE id1 A3BD7875 id2 41840B3E
    Registration state has changed
  • WNF_SEB_MOBILE_BROADBAND_RADIO_STATE_CHANGE id1 A3BD8075 id2 41840B3E
    Radio state has changed
  • WNF_SEB_MOBILE_BROADBAND_PIN_LOCK_STATE_CHANGE id1 A3BD8875 id2 41840B3E
    Pin lock state has changed
  • WNF_SEB_MOBILE_BROADBAND_DEVICE_SERVICE_NOTIFICATION id1 A3BD9075 id2 41840B3E
    Device service command has been received
  • WNF_SEB_DEFAULT_SIGN_IN_ACCOUNT_CHANGE id1 A3BD9875 id2 41840B3E
    Default Sign In account has changed
  • WNF_SEB_NETWORK_CONNECTIVITY_IN_STANDBY id1 A3BDA075 id2 41840B3E
    Network connectivity in Standby
  • WNF_SEB_USER_PRESENCE_CHANGED id1 A3BDA875 id2 41840B3E
    User presence changed
  • WNF_SEB_AUDIO_ACTIVITY id1 A3BDB075 id2 41840B3E
    Audio activity in progress
  • WNF_SEB_FULL_SCREEN_HDR_VIDEO_PLAYBACK id1 A3BDB875 id2 41840B3E
    Fullscreen HDR video playback notification
  • WNF_SEB_UWP_APP_LAUNCH id1 A3BDC075 id2 41840B3E
    Indicates UWP app launch phase
  • WNF_SEB_MOBILE_BROADBAND_PCO_VALUE_CHANGE id1 A3BDC875 id2 41840B3E
    Pco data has been received
  • WNF_SEB_MIXED_REALITY id1 A3BDD075 id2 41840B3E
    Mixed reality notification
  • WNF_SEB_GAME_MODE id1 A3BDD875 id2 41840B3E
    Game mode scenario
  • WNF_SPI_LOGICALDPIOVERRIDE id1 A3BC0835 id2 418F1E3E
    Signals a change caused by SystemParametersInfo(SPI_SETLOGICALDPIOVERRIDE). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_SPI_PRIMARY_MONITOR_DPI_CHANGED id1 A3BC1035 id2 418F1E3E
    This is triggered when the Primary monitor's DPI is different than the session's DPI.
  • WNF_TMCN_ISTABLETMODE id1 A3BC0835 id2 F850339
    The computer has changed density mode. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TEAM_SHELL_HOTKEY_PRESSED id1 A3BC0875 id2 C870B39
    Indicates a hotkey was pressed
  • WNF_TEL_STORAGE_CAPACITY id1 A3BE0875 id2 418A0B39
    This is fired every time an SENSE's storage fullness crosses into a new tier or is reset. struct { DWORD PercentageFull[4]; }
  • WNF_TEL_DAILY_UPLOAD_QUOTA id1 A3BE1075 id2 418A0B39
    This is fired every time an SENSE's daily upload quota crosses into a new tier or is reset. struct { DWORD PercentageFull; }
  • WNF_TEL_ONESETTINGS_UPDATED id1 A3BE1875 id2 418A0B39
    This is fired every time a onesettings namespace is updated. {UINT64 SettingsCount; struct {UINT64 NamespaceHash; UINT64 TimeLastChanged;}[16]}
  • WNF_TEL_SETTINGS_PUSH_NOTIFICATION_RECEIVED id1 A3BE2075 id2 418A0B39
    This is fired every time a push notification is received from the OneSettings service. UTF8 string.
  • WNF_TEL_TIMER_RECONFIGURED id1 A3BE2875 id2 418A0B39
    This is fired every time a UTC service timer changes its configuration values so subscribers can call GetTimerConfiguration to check any new values.
  • WNF_PHN_CALL_STATUS id1 A3BC2875 id2 4188063D
    Bitmask containing the current relevant call states. Any 3rd party app is allowed to listen to this. See PhoneWnf.h for valid values. SID referenced below is that of the Phone service.
  • WNF_PHN_CALLFORWARDING_STATUS_LINE0 id1 A3BC3075 id2 4188063D
    Bitmask containing the call forwarding state for phone line 0. See PhoneWnf.h for valid values. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_PHNP_SERVICE_INITIALIZED id1 A3BC3875 id2 1188063D
    BOOL indicating whether the Phone service has been initialized. SDDL comes from phoneCall and ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and PhoneSvc in %SDXROOT%%\src\src\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_PHNP_SIMSEC_READY id1 A3BC4075 id2 1188063D
    BOOL indicating whether SimSec is ready to receive requests. SDDL comes from ID_CAP_PHONE_2ND_PARTY, ID_CAP_PHONE_INTERNAL and dwm in %SDXROOT%\src\uxplat\MobileUI\Packages\MobileUI\MobileUI.pkg.xml
  • WNF_PHNP_ANNOTATION_ENDPOINT id1 A3BC4875 id2 1188063D
    Wide string indicating the call annotation provider's RPC endpoint name. SDDL comes from ID_CAP_CALLMESSAGING_FILTER and PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_PHNL_LINE1_READY id1 A3BC4075 id2 D88063D
    BOOL indicating whether the line is ready. SDDL comes from PhoneSvc in %SDXROOT%\src\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_TETH_TETHERING_STATE id1 A3BC0875 id2 9920B39
    State name for the Tethering service notification of all state changes
  • WNF_TETH_AUTOSTART_BLUETOOTH id1 A3BC1075 id2 9920B39
    State name for starting Tethering service over Bluetooth
  • WNF_IME_INPUT_MODE_LABEL id1 A3BC0875 id2 41830324
    Input Mode Indicator label IME want to show on systray. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_IME_EXPLICIT_PRIVATE_MODE id1 A3BC1035 id2 41830324
    Explicit IME private mode status. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622
  • WNF_IME_AUTOMATIC_PRIVATE_MODE id1 A3BC1835 id2 41830324
    Automatic IME private mode status.
  • WNF_THME_THEME_CHANGED id1 A3BC0875 id2 48B0639
    Notifies when the theme of the system changes. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TZ_LEGACY_STORE_CHANGED id1 A3BC0875 id2 41C61439
    Time Zone Legacy store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TZ_STORE_CHANGED id1 A3BC1075 id2 41C61439
    Time Zone store is updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TZ_TIMEZONE_CHANGED id1 A3BC1875 id2 41C61439
    This state is notified when the timezone is changed via SetTimeZoneInformationByID - The data value is a UINT that indicates the new TZID. SDDL comes from ID_CAP_BUILTIN_SETTIME, ID_CAP_EVERYONE and tzautoupdate in %SDXROOT%\src\globplat\product\packages\winnls\winnls.pkg.xml
  • WNF_TZ_LAST_TIME_SYNC_INFO id1 A3BC2075 id2 41C61439
    This event has information about last time sync. SDDL comes from autotimesvc's account.
  • WNF_TZ_NETWORK_TIME_SYNC_TRIGGER id1 A3BC2875 id2 41C61439
    This event is used to trigger Network Sync. SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml
  • WNF_TZ_AUTOTIMEUPDATE_STATE_CHANGED id1 A3BC3075 id2 41C61439
    This state is notified when autotimeupdate state changed. The data value is a DWORD that indicates if autotimeupdate is enabled (1) or disabled (0). SDDL comes from autotimesvc's account and ID_CAP_BUILTIN_SETTIME in %SDXROOT%\src\media\shell\packages\settings\Settings.pkg.xml
  • WNF_TOPE_INP_POINTER_DEVICE_ACTIVITY id1 A3BC0875 id2 4960139
    Touch Event
  • WNF_TKBN_KEYBOARD_VISIBILITY id1 A3BC0835 id2 F840539
    The touch keyboard's appearance on the screen has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_RESTRICTED_KEYBOARD_VISIBILITY id1 A3BC1035 id2 F840539
    The restricted mode touch keyboard's appearance on the screen has changed.
  • WNF_TKBN_IMMERSIVE_FOCUS_TRACKING id1 A3BC1835 id2 F840539
    An immersive application has encountered a focus change. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_TOUCH_EVENT id1 A3BC2035 id2 F840539
    An application encountered a touch down/up event. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_RESTRICTED_TOUCH_EVENT id1 A3BC2835 id2 F840539
    An application encountered a touch down/up event
  • WNF_TKBN_LANGUAGE id1 A3BC3035 id2 F840539
    The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_FOREGROUND_WINDOW id1 A3BC3835 id2 F840539
    The active keyboard layout has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_CARET_TRACKING id1 A3BC4035 id2 F840539
    Caret tracking has updated on the desktop. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_AUTOCOMPLETE id1 A3BC4835 id2 F840539
    The autocomplete window has been updated. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_MODERN_KEYBOARD_FOCUS_TRACKING id1 A3BC5035 id2 F840539
    Determines whether focus is in an editable field for the purposes of the modern keyboard. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_KEYBOARD_VIEW_CHANGE id1 A3BC5835 id2 F840539
    The view being shown by the touch keyboard has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_RESTRICTED_KEYBOARD_VIEW_CHANGE id1 A3BC6035 id2 F840539
    The view being shown by the restricted mode touch keyboard has changed.
  • WNF_TKBN_KEYBOARD_GESTURE id1 A3BC6835 id2 F840539
    The keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_RESTRICTED_KEYBOARD_GESTURE id1 A3BC7035 id2 F840539
    The restricted keyboard has recognized a gesture. State is not relevant for this notification and it should not be queried after the fact.
  • WNF_TKBN_CANDIDATE_WINDOW_STATE id1 A3BC7835 id2 F840539
    The candidate window state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_KEYBOARD_LAYOUT_CHANGE id1 A3BC8035 id2 F840539
    The layout being shown by the touch keyboard has changed.
  • WNF_TKBN_RESTRICTED_KEYBOARD_LAYOUT_CHANGE id1 A3BC8835 id2 F840539
    The layout being shown by the restricted mode touch keyboard has changed.
  • WNF_TKBN_COMPOSITION_STATE id1 A3BC9035 id2 F840539
    The composition state has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_SYSTEM_IMMERSIVE_FOCUS_TRACKING id1 A3BC9835 id2 F840539
    A System Mode Application(Logon/OOBE) has encountered a focus change
  • WNF_TKBN_SYSTEM_TOUCH_EVENT id1 A3BCA035 id2 F840539
    A System Mode application(Logon/OOBE) encountered a touch down/up event
  • WNF_TKBN_INPUT_PANE_DISPLAY_POLICY id1 A3BCA835 id2 F840539
    The edit control in focus has changed the input pane display policy (manual/automatic). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_DESKTOP_MODE_AUTO_IHM id1 A3BCB035 id2 F840539
    The system is in desktop mode but the user prefers tablet-mode IHM behavior. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_KEYBOARD_SET_VISIBLE id1 A3BCB835 id2 F840539
    The touch keyboard should show or hide. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBN_KEYBOARD_SET_VISIBLE_NOTIFICATION id1 A3BCC035 id2 F840539
    Update the show/hide status of touch keyboard that is being tracked in tabtip. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_TKBR_CHANGE_SYSTEM id1 A3BC08F5 id2 13840539
    This state name is used to notify system components about state changes in the Token Broker
  • WNF_TKBR_CHANGE_APP id1 A3BC1075 id2 13840539
    This state name is used to notify apps about state changes in the Token Broker
  • WNF_TKBR_CHANGE_APP_INTERNAL id1 A3BC18F5 id2 13840539
    This state name is used to notify apps about state changes in the Token Broker
  • WNF_TPM_OWNERSHIP_TAKEN id1 A3BC0875 id2 418B1E39
    This event signals when the Win32_TPM provider has completed taking ownership of the TPM.
  • WNF_TPM_DEVICEID_STATE id1 A3BC1075 id2 418B1E39
    This event signals the state of the TPM-based DeviceID.
  • WNF_TPM_PROVISION_TRIGGER id1 A3BC1875 id2 418B1E39
    This event triggers the TPM provisioning/status check to run.
  • WNF_TPM_CLEAR_PENDING id1 A3BC2075 id2 418B1E39
    This event signals a TPM Clear will be attempted.
  • WNF_TPM_CLEAR_RESULT id1 A3BC2875 id2 418B1E39
    This event signals if ownership was taken during TPM Provisioning and the result of TPM Clear on last reboot.
  • WNF_TPM_DISABLE_DEACTIVATE_PENDING id1 A3BC3075 id2 418B1E39
    This event signals a TPM Disable or TPM Deactivate will be attempted.
  • WNF_TPM_ENABLE_ACTIVATE_COMPLETED id1 A3BC3875 id2 418B1E39
    This event signals after the TPM is Enabled or Activated.
  • WNF_TPM_MAINTENANCE_TASK_STATUS id1 A3BC4075 id2 418B1E39
    This event signals the TPM maintenance task status.
  • WNF_UBPM_POWER_SOURCE id1 A3BC0875 id2 C960C38
    The machine power source state
  • WNF_UBPM_CONSOLE_MONITOR id1 A3BC1075 id2 C960C38
    The machine console monitor on/off state
  • WNF_UBPM_FRMU_ALLOWED id1 A3BC1875 id2 C960C38
    The user is present and machine is on batteries and the battery level is above firmware update thershold
  • WNF_UBPM_PRESHUTDOWN_PHASE id1 A3BC2075 id2 C960C38
    The machine entered pre shutdown phase
  • WNF_UMDF_WUDFSVC_START id1 A3BC0875 id2 7820338
    Trigger the Driver Manager service start
  • WNF_UMDF_DRVMGR_STATUS id1 A3BC1075 id2 7820338
    State name indicating the status of the UMDF driver manager
  • WNF_USO_STATE_CHANGE id1 A3BC0875 id2 41891D38
    Signals that a state transition occurred for an update session.
  • WNF_USO_STATE_ATTENTION_REQUIRED id1 A3BC1075 id2 41891D38
    Signals that a state encounter a condition that requires attention.
  • WNF_USO_UPDATE_PROGRESS id1 A3BC1875 id2 41891D38
    Signals the a change in progess of an update session.
  • WNF_USO_REBOOT_REQUIRED id1 A3BC2075 id2 41891D38
    Signals that a reboot is required to complete the update session.
  • WNF_USO_ACTIVE_SESSION id1 A3BC2875 id2 41891D38
    Signals that the current active session is changed.
  • WNF_USO_UPDATE_SUCCEEDED id1 A3BC3075 id2 41891D38
    Signals that updates have installed successfully on lite servicing stack.
  • WNF_USO_UPTODATE_STATUS_CHANGED id1 A3BC3875 id2 41891D38
    Signals that the machine's up to date status has changed.
  • WNF_USO_REBOOT_BLOCK_REQUESTED id1 A3BC4075 id2 41891D38
    Signals that USO should not reboot the system.
  • WNF_USO_DOWNLOAD_STARTED id1 A3BC4875 id2 41891D38
    Signals that update download has started on lite servicing stack.
  • WNF_USO_INSTALL_STARTED id1 A3BC5075 id2 41891D38
    Signals that update install has started on lite servicing stack.
  • WNF_USO_INSTALL_STATE id1 A3BC5875 id2 41891D38
    Signals various install states on lite servicing stack.
  • WNF_USO_SERVICE_STOPPING id1 A3BC6075 id2 41891D38
    Signals that USO is stopping.
  • WNF_USO_SETTINGS_REFRESHED id1 A3BC6875 id2 41891D38
    Signals that USO settings have been refreshed.
  • WNF_USO_ACTIVEHOURS_STARTED id1 A3BC7075 id2 41891D38
    Signals that USO active hours have started.
  • WNF_DICT_CONTENT_CHANGED id1 A3BC0875 id2 15850729
    The content of a user dictionary has changed (word either added or removed). SDDL SID's come from capability ID_CAP_INPUT_CORE (both application and service SID's), and DefAppsCapabilitiesGroup
  • WNF_UMGR_SIHOST_READY id1 A3BC0835 id2 13810338
    Shell Infrastructure host is ready.
  • WNF_UMGR_USER_LOGIN id1 A3BC1075 id2 13810338
    The user was logged in to the system.
  • WNF_UMGR_USER_LOGOUT id1 A3BC1875 id2 13810338
    The user was logged out of the system.
  • WNF_UMGR_SYSTEM_USER_CONTEXT_CHANGED id1 A3BC2075 id2 13810338
    Default system user, as defined by start view, has changed.
  • WNF_UMGR_SESSIONUSER_TOKEN_CHANGE id1 A3BC2875 id2 13810338
    Token for the session user changed.
  • WNF_UMGR_SESSION_ACTIVE_SHELL_USER_CHANGE id1 A3BC3035 id2 13810338
    Session active shell user changed.
  • WNF_UMGR_USER_TILE_CHANGED id1 A3BC3875 id2 13810338
    The user tile for the specified SID was changed. The payload is the String user sid and the datasize is the byte count of MAX_PATH.
  • WNF_VAN_VANUI_STATUS id1 A3BC0875 id2 41880F3B
    The VAN UI open close status
  • WNF_VTSV_CDS_SYNC id1 A3BC0875 id2 17951A3B
    Notification for syncing CDS WebCredential store
  • WNF_VPN_CLIENT_CONNECTIVITY_STATUS id1 A3BC0875 id2 41881E3B
    The VPN Client connectivity status. SDDL gives RasMan read/write permissions, rescap:networkingVpnProvider read permissions, and Authenticated User read permissions.
  • WNF_WAAS_QUALITY_IMPACT id1 A3BC0875 id2 12870F3A
    WaaS Assessment Impact level for quality update
  • WNF_WAAS_FEATURE_IMPACT id1 A3BC1075 id2 12870F3A
    WaaS Assessment Impact level for feature update
  • WNF_WCM_INTERFACE_LIST id1 A3BC0875 id2 418B0D3A
    This event signals when a WCM-managed network interface has been added or removed
  • WNF_WCM_SERVICE_STATUS id1 A3BC1075 id2 418B0D3A
    Connection Manager service restart
  • WNF_WCM_MAPPING_POLICY_UPDATED id1 A3BC1875 id2 418B0D3A
    WNF state for refreshing WCM service mapping policies cache
  • WNF_WCM_PROFILE_CONFIG_UPDATED id1 A3BC2075 id2 418B0D3A
    WNF state for refreshing WCM's selection multiplex table and selectable connection list
  • WNF_WCM_INTERFACE_CONNECTION_STATE id1 A3BC2875 id2 418B0D3A
    This event signals when a WCM-managed network interface has changed its connection quality state
  • WNF_CNET_DPU_GLOBAL_STATE_OVER_LIMIT id1 A3BC1075 id2 1583002E
    the data of this state is 1 when the global data usage state is less than or equal to OVER_LIMIT, otherwise it is 0
  • WNF_CNET_DPU_GLOBAL_STATE_OFF_TRACK id1 A3BC1875 id2 1583002E
    the data of this state is 1 when the global data usage state is less than or equal to OFF_TRACK, otherwise it is 0
  • WNF_CNET_DPU_GLOBAL_STATE_ON_TRACK id1 A3BC2075 id2 1583002E
    the data of this state is 1 when the global data usage state is less than or equal to ON_TRACK, otherwise it is 0
  • WNF_CNET_DPU_GLOBAL_STATE_UNDER_TRACK id1 A3BC2875 id2 1583002E
    the data of this state is 1 when the global data usage state is less than or equal to UNDER_TRACK, otherwise it is 0
  • WNF_CNET_DPU_GLOBAL_STATE_NOT_TRACKED id1 A3BC3075 id2 1583002E
    the data of this state is 1 when the global data usage state is less than or equal to NOT_TRACKED, otherwise it is 0
  • WNF_CNET_CELLULAR_CONNECTIONS_AVAILABLE id1 A3BC4875 id2 1583002E
    State name for Cellular connections available State. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_CNET_NON_CELLULAR_CONNECTED id1 A3BC6875 id2 1583002E
    The state is 1 when a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_CNET_RADIO_ACTIVITY_OR_NON_CELLULAR_CONNECTED id1 A3BC7075 id2 1583002E
    The state is 1 when Radio is active or a non cellular connection is in connected state, otherwise it is 0. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_CNET_RADIO_ACTIVITY id1 A3BC7875 id2 1583002E
    The state is 1 when Cellular data is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System
  • WNF_CNET_WIFI_ACTIVITY id1 A3BC8075 id2 1583002E
    The state is 1 when WiFi is active, otherwise it is 0. SDDL grants read access for everyone, including AppContainers, and write access for System
  • WNF_DUSM_TASK_TOAST id1 A3BC0875 id2 C951B29
    Trigger task scheduler to launch task for toast
  • WNF_DUSM_IS_CELLULAR_BACKGROUND_RESTRICTED id1 A3BC1075 id2 C951B29
    The state is 1 when cellular internet connection is not allowed to any UWP Application running in background, the state is 0 when cellular internet connection is allowed to any applications running in foreground or background.
  • WNF_WDAG_SETTINGS_CHANGED_USER id1 A3BC0875 id2 6870A3A
    A Settings for WDAG requiring the user context has changed.
  • WNF_WDAG_SETTINGS_CHANGED_SYSTEM id1 A3BC1075 id2 6870A3A
    A Settings for WDAG requiring system context has changed.
  • WNF_WDSC_ACCOUNT_PROTECTION_REFRESH id1 A3BC0875 id2 2950A3A
    This event triggers a refresh for the account pillar state
  • WNF_WEBA_CTAP_DEVICE_STATE id1 A3BC0875 id2 840B3A
    This event signals CTAP device state changes.
  • WNF_WEBA_CTAP_DEVICE_CHANGE_NOTIFY id1 A3BC1075 id2 840B3A
    This event signals CTAP device was inserted or tapped.
  • WNF_WER_SERVICE_START id1 A3BC0875 id2 41940B3A
    The WER service needs to start. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
  • WNF_WER_QUEUED_REPORTS id1 A3BC1075 id2 41940B3A
    The number of reports queued to the machine store. CAPABILITY_SID_LpacInstrumentation - S-1-15-3-1024-3153509613-960666767-3724611135-2725662640-12138253-543910227-1950414635-4190290187
  • WNF_WER_CRASH_STATE id1 A3BC1875 id2 41940B3A
    Information about applications currently crashing.
  • WNF_WIFI_CONNECTION_STATUS id1 A3BC0875 id2 880073A
    State name for Wifi radio and connection status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_CPL_STATUS id1 A3BC1075 id2 880073A
    State name for Wifi CPL status flags
  • WNF_WIFI_SERVICE_NOTIFICATIONS id1 A3BC2075 id2 880073A
    Notifications received from the WiFi Conn Svc. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_HOTSPOT_HOST_READY id1 A3BC2875 id2 880073A
    State name for Wifi Hotspot Host ready flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_AOAC_STATUS id1 A3BC4875 id2 880073A
    State name for Wifi power status flags. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_CONNECTION_SCORE id1 A3BC5875 id2 880073A
    State name for Wifi connection status and connection score updates
  • WNF_WIFI_TILE_UPDATE id1 A3BC6075 id2 880073A
    State name for Wifi network tiles updated. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_AVERAGE_TRANSMIT id1 A3BC6875 id2 880073A
    Average peak transmitted traffic seen by NCSI
  • WNF_WIFI_MEDIA_STREAMING_MODE id1 A3BC7075 id2 880073A
    Last media streaming mode state change
  • WNF_WIFI_TASK_TRIGGER id1 A3BC7875 id2 880073A
    State name triggering WiFiNetworkManager background task. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_L3_AUTH_STATE id1 A3BC8075 id2 880073A
    State for triggering browser UI when a network is hijacked. SDDL comes from WcmSvc service in %SDXROOT%\src\net\NetCore\Packages\NetCore\NetCore.pkg.xml
  • WNF_WIFI_WLANSVC_NOTIFICATION id1 A3BC8875 id2 880073A
    This event sends notifications from wlansvc
  • WNF_WIFI_HOTSPOT2_REGISTRATION_STATUS id1 A3BC9075 id2 880073A
    State name for triggering hotspot2 registration status from online signup server
  • WNF_WIFI_PROTECTED_SCENARIO id1 A3BC9875 id2 880073A
    Signals that the Wi-Fi stack is handling an important scenario which must be protected from disruptive activity such as unexpected scans, or activity on a shared radio.
  • WNF_WIFI_MOVEMENT_DETECTED id1 A3BCA075 id2 880073A
    Event indicating that the user may have moved to a different location based on nearby AP RSSI and other signals. Value is a counter indicating how many times movement has been detected.
  • WNF_WCDS_SYNC_WLAN id1 A3BC0875 id2 12820D3A
    State name for starting the WLAN scheduled task.
  • WNF_WFDN_WFD_DISCONNECTION_PROPERTIES id1 A3BC0875 id2 F82083A
    Reports properties about a Wi-Fi Display disconnect
  • WNF_WFDN_MOVEMENT_DETECTED id1 A3BC1075 id2 F82083A
    Event indicating that the user may have moved to a different location during the Infracast session. Value is a counter indicating how many times movement has been detected.
  • WNF_WFDN_STAY_CONNECTED_TRIGGER id1 A3BC1875 id2 F82083A
    Event indicating the current state of the infra walk-away listener. 0: Listening, 1: User elected to stay connected, 2: Auto Disconnect was triggered, 3: Session ended without triggering movement detection.
  • WNF_WIL_FEATURE_STORE id1 A3BC0C75 id2 418A073A
    Event indicating the Normal feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
  • WNF_WIL_BOOT_FEATURE_STORE id1 A3BC1475 id2 418A073A
    Event indicating the Boot feature store has been modified. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml
  • WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_1 id1 A3BC1C75 id2 418A073A
    Event to indicate the first use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_2 id1 A3BC2475 id2 418A073A
    Event to indicate the first use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_DEVICE_USAGE_TRACKING_3 id1 A3BC2C75 id2 418A073A
    Event to indicate the first use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_USAGE_TRACKING_1 id1 A3BC3475 id2 418A073A
    Event to indicate unique use of a feature on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_USAGE_TRACKING_2 id1 A3BC3C75 id2 418A073A
    Event to indicate unique use of a feature on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_USAGE_TRACKING_3 id1 A3BC4475 id2 418A073A
    Event to indicate unique use of a feature on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_1 id1 A3BC4C75 id2 418A073A
    Event to indicate uniquely observed code failures on this device (1). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_2 id1 A3BC5475 id2 418A073A
    Event to indicate uniquely observed code failures on this device (2). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_3 id1 A3BC5C75 id2 418A073A
    Event to indicate uniquely observed code failures on this device (3). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_4 id1 A3BC6475 id2 418A073A
    Event to indicate uniquely observed code failures on this device (4). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_5 id1 A3BC6C75 id2 418A073A
    Event to indicate uniquely observed code failures on this device (5). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_HEALTH_TRACKING_6 id1 A3BC7475 id2 418A073A
    Event to indicate uniquely observed code failures on this device (6). CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_MACHINE_FEATURE_STORE id1 A3BC7C75 id2 418A073A
    Event indicates modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_MACHINE_FEATURE_STORE_MODIFIED id1 A3BC8075 id2 418A073A
    Event fires once per boot on modification of the WIL Machine feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_USER_FEATURE_STORE id1 A3BC88F5 id2 418A073A
    Event indicates modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_USER_FEATURE_STORE_MODIFIED id1 A3BC90F5 id2 418A073A
    Event fires once per user session on modification of the WIL User feature store. SDDL comes from featureStagingInfo in %SDXROOT%\onecore\base\wil\mbs\Microsoft-Windows-Internal-Libraries-Capabilities\wil.wm.xml. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582.
  • WNF_WIL_FEATURE_USAGE_FOR_SRUM id1 A3BC9835 id2 418A073A
    Event indicates there is unique and custom usage of a feature. This is for SRUM consumption. DPS service SID: S-1-5-80-2970612574-78537857-698502321-558674196-1451644582
  • WNF_WBIO_ENROLLMENT_FINISHED id1 A3BC0875 id2 E8F0C3A
    This event is fired when an enrollment completes, either successfully, or unsuccessfully.
  • WNF_SRT_WINRE_CONFIGURATION_CHANGE id1 A3BC0875 id2 41921C3E
    Triggered each time there is a configuration change in WinRE
  • WNF_STOR_CONFIGURATION_DEVICE_INFO_UPDATED id1 A3BC0875 id2 13891A3E
    This WNF event fires when the OEM, MO, and Device Hardware values change in the registry.
  • WNF_STOR_CONFIGURATION_MO_TASK_RUNNING id1 A3BC1075 id2 13891A3E
    This WNF event fires when the MO discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
  • WNF_STOR_CONFIGURATION_OEM_TASK_RUNNING id1 A3BC1875 id2 13891A3E
    This WNF event fires when the OEM discovery task state changes. It will send an 0x00000000 if not running and 0x00000001 if running.
  • WNF_WUA_NUM_PER_USER_UPDATES id1 A3BC08F5 id2 41871B3A
    State stores the number of per-user updates for the current user
  • WNF_WUA_AU_SCAN_COMPLETE id1 A3BC1075 id2 41871B3A
    Triggered each time an AU scan is completed
  • WNF_WUA_CALL_HANG id1 A3BC1875 id2 41871B3A
    State stores information regarding WU call hangs
  • WNF_WUA_SERVICE_HANG id1 A3BC2075 id2 41871B3A
    State stores information regarding WU service hangs
  • WNF_WUA_STAGEUPDATE_DETAILS id1 A3BC2875 id2 41871B3A
    Triggered when a StageUpdate call has completed for a phone update installation.
  • WNF_WUA_UPDATE_EXPIRING id1 A3BC3075 id2 41871B3A
    Indicates an update will expire on the next WU service scavenge task. The data type is a GUID which represents the update ID.
  • WNF_WHTP_WINHTTP_PROXY_DISCOVERED id1 A3BC0875 id2 1192063A
    A network proxy has been discovered. WinHttpAutoProxySvc can write, NlaSvc can read.
  • WNF_WHTP_WINHTTP_PROXY_AUTHENTICATION_REQUIRED id1 A3BC1075 id2 1192063A
    A proxy has returned a 407 status code.
  • WNF_WSQM_IS_OPTED_IN id1 A3BC0875 id2 C971D3A
    Mirrors the state of CEIPEnable and CEIPSampledIn registry settings.
  • WNF_WNS_CONNECTIVITY_STATUS id1 A3BC0875 id2 4195003A
    The WNS Connection Provider connectivity status
  • WNF_WOF_OVERLAY_CONFIGURATION_CHANGE id1 A3BC0875 id2 4180013A
    Overlay configuration change
  • WNF_SHR_SHARING_CHANGED id1 A3BC0835 id2 4194063E
    System sharing status changed
  • WNF_SHR_DHCP_IPv4_LEASE_LIST id1 A3BC1075 id2 4194063E
    ICS DHCP IPv4 lease list changed
  • WNF_SHR_DHCP_IPv4_FASTIP_ADDRS id1 A3BC1875 id2 4194063E
    New assigned Fast-IP Address(es)
  • WNF_KSV_STREAMSTATE id1 A3BC0875 id2 41901D26
    This is the current stream state of a camera for a process in a given session
  • WNF_KSV_DEVICESTATE id1 A3BC1075 id2 41901D26
    This is the current device state
  • WNF_KSV_FSSTREAMACTIVITY id1 A3BC1875 id2 41901D26
    This is stream activity indicator
  • WNF_KSV_KSSTREAMACTIVITY id1 A3BC2075 id2 41901D26
    This is stream activity indicator
  • WNF_KSV_CAMERAPRIVACY id1 A3BC2875 id2 41901D26
    This is user global camera privacy state indicator when switched via physical button
  • WNF_TB_SYSTEM_TIME_CHANGED id1 A3BC0875 id2 41C60C39
    Time Broker has finished processing a change ot time
  • WNF_UDM_SERVICE_INITIALIZED id1 A3BC0835 id2 418B0A38
    BOOL + UserContextToken indicating whether the UserDataService service has been initialized for the specified user. On OneCore, SDDL gives read access to callers with userDataSystem/userDataSystem capablity group and all access to IU/AU/System. On phone, SDDL comes from ID_CAP_APPOINTMENTS, ID_CAP_COMMS_COMMON, ID_CAP_CONTACTS, ID_CAP_EVERYONE, ID_CAP_PLATFORM_EXTENSIBILITY, UserDataSvc and ID_CAP_SMS in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_UDA_CONTACT_SORT_CHANGED id1 A3BC2835 id2 41870A38
    State name for aggregate sort and display order changes. SDDL comes from ID_CAP_COMMS_APPLICATIONS and ID_CAP_COMMS_SERVICES in %SDXROOT%\comms\Packages\CommsPlat\Comms.pkg.xml
  • WNF_XBOX_APPLICATION_CONTEXT_CHANGED id1 A3BC0875 id2 19890C35
    The application specific context has changed in steady state. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_XBOX_APPLICATION_FOCUS_CHANGED id1 A3BC1075 id2 19890C35
    The currently focused application has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_XBOX_APPLICATION_ACTIVATING id1 A3BC1875 id2 19890C35
    An application is activating.
  • WNF_XBOX_APPLICATION_COMPONENT_FOCUS id1 A3BC2075 id2 19890C35
    The currently focused application component has changed.
  • WNF_XBOX_SHELL_TOAST_NOTIFICATION id1 A3BC2875 id2 19890C35
    A new toast notification has been delivered to the shell.
  • WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_LAUNCH id1 A3BC3075 id2 19890C35
    A package is about to be unmounted from the System OS ready to launch it on the Title OS.
  • WNF_XBOX_PACKAGE_INSTALL_STATE_CHANGED id1 A3BC3875 id2 19890C35
    A new application package has been added or an existing one has been removed.
  • WNF_XBOX_IDLE_DIMMER_CHANGED id1 A3BC4075 id2 19890C35
    Idle dimmer has changed state.
  • WNF_XBOX_GLOBALIZATION_SETTING_CHANGED id1 A3BC4875 id2 19890C35
    An application package has been removed.
  • WNF_XBOX_APPLICATION_NO_LONGER_RUNNING id1 A3BC5075 id2 19890C35
    An application is no longer running.
  • WNF_XBOX_AUTOPLAY_CONTENT_DETECTED id1 A3BC5875 id2 19890C35
    An optical disc or other media has been detected with content.
  • WNF_XBOX_APPLICATION_ERROR id1 A3BC6075 id2 19890C35
    Application error handler
  • WNF_XBOX_STORAGE_ERROR id1 A3BC6875 id2 19890C35
    Handler for achievement cache and game save storage
  • WNF_XBOX_LIVE_CONNECTIVITY_CHANGED id1 A3BC7075 id2 19890C35
    Connectivity to the Xbox LIVE service has changed.
  • WNF_XBOX_SYSTEM_TITLE_AUTH_STATUS_CHANGED id1 A3BC7875 id2 19890C35
    System Title Authentication status has changed.
  • WNF_XBOX_ACHIEVEMENTS_RAW_NOTIFICATION_RECEIVED id1 A3BC8075 id2 19890C35
    A new achievements-related raw notifications was received.
  • WNF_XBOX_ERA_VM_STATUS_CHANGED id1 A3BC8875 id2 19890C35
    ERA VM status has changed.
  • WNF_XBOX_APPLICATION_LAYOUT_CHANGED id1 A3BC9075 id2 19890C35
    One or more application layouts changed.
  • WNF_XBOX_SYSTEM_IDLE_TIMEOUT_CHANGED id1 A3BC9875 id2 19890C35
    System Idle Timeout has changed.
  • WNF_XBOX_SYSTEM_CONSTRAINED_MODE_STATUS_CHANGED id1 A3BCA075 id2 19890C35
    System constrained status has changed. CAPABILITY_SID_LpacMedia - S-1-15-3-1024-1692970155-4054893335-185714091-3362601943-3526593181-1159816984-2199008581-497492991.
  • WNF_XBOX_APPLICATION_COM_RESILIENCY_STATUS_CHANGED id1 A3BCD875 id2 19890C35
    Application's COM resiliency status has changed.
  • WNF_XBOX_SYSTEM_USER_CONTEXT_CHANGED id1 A3BCE075 id2 19890C35
    Default system user, as defined by start view, has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_XBOX_HOST_STORAGE_CONFIGURATION_CHANGED id1 A3BCF075 id2 19890C35
    A storage device was either plugged or unplugged.
  • WNF_XBOX_EXIT_SILENT_BOOT_MODE id1 A3BCF875 id2 19890C35
    The system is exiting silent boot mode.
  • WNF_XBOX_APPLICATION_LICENSE_CHANGED id1 A3BD0075 id2 19890C35
    The license used by the application has changed.
  • WNF_XBOX_SHELL_INITIALIZED id1 A3BD0875 id2 19890C35
    The system shell is initialized and ready.
  • WNF_XBOX_PASS3_UPDATE_NOTIFICATION id1 A3BD1875 id2 19890C35
    Pass 3 system update has progressed and is sending a notification.
  • WNF_XBOX_MSA_ENVIRONMENT_CONFIGURED id1 A3BD2075 id2 19890C35
    The MSA and WNS environments have been configured to match the XBL environment.
  • WNF_XBOX_SIP_VISIBILITY_CHANGED id1 A3BD2875 id2 19890C35
    The visibility of the Software Input Pane has changed. CAPABILITY_SID_LpacAppExperience - S-1-15-3-1024-1502825166-1963708345-2616377461-2562897074-4192028372-3968301570-1997628692-1435953622.
  • WNF_XBOX_SYSTEM_GAME_STREAMING_STATE_CHANGED id1 A3BD3075 id2 19890C35
    Game streaming state has changed.
  • WNF_XBOX_SIP_FOCUS_TRANSFER_NOTIFICATION id1 A3BD3875 id2 19890C35
    It is possible to transfer focus away from the Software Input Pane.
  • WNF_XBOX_XAM_SMB_SHARES_INIT_ALLOW_SYSTEM_READY id1 A3BD4075 id2 19890C35
    SMB shares have been launched.
  • WNF_XBOX_XBBLACKBOX_SNAP_NOTIFICATION id1 A3BD4875 id2 19890C35
    A snap of XBBlackbox has occurred
  • WNF_XBOX_SYSTEM_LOW_POWER_MAINTENANCE_WORK_ALLOWED id1 A3BD5075 id2 19890C35
    Maintenance work is allowed in low power mode
  • WNF_XBOX_ERA_TITLE_LAUNCH_NOTIFICATION id1 A3BD5875 id2 19890C35
    ERA launch notification with XBL title info
  • WNF_XBOX_STORAGE_STATUS id1 A3BD6075 id2 19890C35
    Status of attached storage devices
  • WNF_XBOX_STORAGE_CHANGED id1 A3BD6875 id2 19890C35
    A storage device, or its contents, have changed
  • WNF_XBOX_PACKAGE_STREAMING_STATE id1 A3BD7075 id2 19890C35
    Current state of the streaming package
  • WNF_XBOX_STREAMING_QUEUE_CHANGED id1 A3BD7875 id2 19890C35
    The install streaming queue contents have changed
  • WNF_XBOX_QUERY_UPDATE_NOTIFICATION id1 A3BD8075 id2 19890C35
    An update is available for installing content.
  • WNF_XBOX_REPOSITORY_CHANGED id1 A3BD8875 id2 19890C35
    A change has been made to the pre-indexed state repository.
  • WNF_XBOX_LIVETV_TUNER_COUNT_CHANGED id1 A3BD9075 id2 19890C35
    The number of LiveTV tuners connected to the system has changed
  • WNF_XBOX_PACKAGECACHE_CHANGED id1 A3BD9875 id2 19890C35
    A change has been made to the package cache.
  • WNF_XBOX_WPN_PLATFORM_HOST_INITIALIZED id1 A3BDA075 id2 19890C35
    The WPN platform host is initialized and ready.
  • WNF_XBOX_NARRATOR_RECT_CHANGED id1 A3BDA875 id2 19890C35
    The rectangle visual of the Narrator has changed.
  • WNF_XBOX_PACKAGE_UNMOUNTED_FROM_SYSTEM_FOR_UNINSTALL id1 A3BDB075 id2 19890C35
    A package is about to be unmounted from the System OS for uninstall.
  • WNF_XBOX_SEND_LTV_COMMAND_REQUESTED id1 A3BDB875 id2 19890C35
    A module requested for an ltv command to be issued.
  • WNF_XBOX_SHELL_DATACACHE_ENTITY_CHANGED id1 A3BDC075 id2 19890C35
    An entity has changed in the shell data cache.
  • WNF_XBOX_CORTANAOVERLAY_VISIBILITY_CHANGED id1 A3BDC875 id2 19890C35
    The visibility of the Cortana Overlay view has changed.
  • WNF_XBOX_NOTIFICATION_UNREAD_COUNT id1 A3BDD075 id2 19890C35
    Number of unread notifications for the current system user.
  • WNF_XBOX_EXTENDED_RESOURCE_MODE_CHANGED id1 A3BDD875 id2 19890C35
    Extended resource mode has been toggled
  • WNF_XBOX_AUTO_SIGNIN_IN_PROGRESS id1 A3BDE075 id2 19890C35
    Indicates whether the shell is in the process of auto-signin. Payload is UINT32 with a 1 or 0.
  • WNF_XBOX_REMOTE_SIGNOUT id1 A3BDE875 id2 19890C35
    A local user has signed out remotely via SPOP.
  • WNF_XBOX_ACCESSIBILITY_NARRATOR_ENABLED id1 A3BDF075 id2 19890C35
    Indicates whether the Narrator is enabled. Payload is UINt32 with 1 (enabled) or 0 (disabled).
  • WNF_XBOX_GLOBAL_SPEECH_INPUT_NOTIFICATION id1 A3BDF875 id2 19890C35
    A global speech command was recognized that translates to a controller button press.
  • WNF_XBOX_APPLICATION_CURRENT_USER_CHANGED id1 A3BE0075 id2 19890C35
    The current user of the application has changed.
  • WNF_XBOX_ERA_VM_INSTANCE_CHANGED id1 A3BE0875 id2 19890C35
    ERA VM Instance has come up or gone down
  • WNF_XBOX_RESET_IDLE_TIMER id1 A3BE1075 id2 19890C35
    Idle monitor timer should be reset due to user activity.
  • WNF_XBOX_CORTANA_TV_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE1875 id2 19890C35
    Notification for when TV grammars for cortana needs rebuilding
  • WNF_XBOX_CORTANA_SIGNEDIN_USERS_GRAMMAR_UPDATE_NOTIFICATION id1 A3BE2075 id2 19890C35
    Notification for when signed in users change results in rebuilding grammars for cortana
  • WNF_XBOX_KINECT_IS_REQUIRED id1 A3BE2875 id2 19890C35
    An application that requires Kinect has connected to the NuiService.
  • WNF_XBOX_ADJUST_SNAP_CPU_AFFINITY id1 A3BE3075 id2 19890C35
    Adjust an app's CPU affinity if in constrained mode
  • WNF_XBOX_VIDEOPLAYER_ACTIVEPLAYER id1 A3BE3875 id2 19890C35
    The active shared video player host has changed.
  • WNF_XBOX_VIDEOPLAYER_PLAYERSTATE id1 A3BE4075 id2 19890C35
    The video player app has changed internal state.
  • WNF_XBOX_VIDEOPLAYER_PLAYBACKPROGRESS id1 A3BE4875 id2 19890C35
    The video player app has changed playback progress.
  • WNF_XBOX_SAFEAREA_SETTING_CHANGED id1 A3BE5075 id2 19890C35
    Indicates whether the safe area setting is enabled. Payload is UINT32 with a 1 or 0.
  • WNF_XBOX_ACTIVE_BACKGROUNDAUDIO_APPLICATION_CHANGED id1 A3BE5875 id2 19890C35
    The application providing audio from the background has changed.
  • WNF_XBOX_KEYBOARD_LOCALE_CHANGED id1 A3BE6075 id2 19890C35
    Indicates that the desired keyboard locale has changed.
  • WNF_XBOX_GAMER_ACCOUNT_CHANGED id1 A3BE6875 id2 19890C35
    The local gamer account has signed in or out. Payload is uint32 representing sessionid
  • WNF_XBOX_ERA_VM_IOPRIORITY_CHANGED id1 A3BE7075 id2 19890C35
    ERA VM IO priority has been changed
  • WNF_XBOX_SPEECH_INPUT_DEVICE id1 A3BE7875 id2 19890C35
    Input device changed for OneCore speech
  • WNF_XBOX_CORTANA_USER_CHANGED_UPDATE_NOTIFICATION id1 A3BE8875 id2 19890C35
    Notification for when the active user of Cortana changes from signing in/out/switching user
  • WNF_XBOX_ACCESSIBILITY_EXCLUSIVE_INPUT_MODE_CHANGED id1 A3BE9075 id2 19890C35
    The exclusive input modality for an accessibility component changed
  • WNF_XBOX_PROACTIVE_NOTIFICATION_TRIGGERED id1 A3BE9875 id2 19890C35
    Proactive notification service is triggered
  • WNF_XBOX_ACHIEVEMENT_TRACKER_STATE_CHANGED id1 A3BEA075 id2 19890C35
    Notification for when the Achievement Tracker's state should change
  • WNF_XBOX_GUIDE_DIRECT_ACTIVATION id1 A3BEA875 id2 19890C35
    Event to trigger direct activation of xbox guide when nexus is pressed
  • WNF_XBOX_TITLE_SPOP_VETO_RECEIVED id1 A3BEB075 id2 19890C35
    A title SPOP veto has been received.
  • WNF_XBOX_LIBRARY_RAW_NOTIFICATION_RECEIVED id1 A3BEB875 id2 19890C35
    A new library-related raw notifications was received.
  • WNF_XBOX_MESSAGING_RAW_NOTIFICATION_RECEIVED id1 A3BEC075 id2 19890C35
    A new messaging-related raw notifications was received.
  • WNF_XBOX_PEOPLE_RAW_NOTIFICATION_RECEIVED id1 A3BEC875 id2 19890C35
    A new people-related raw notifications was received.
  • WNF_XBOX_MULTIPLAYER_RAW_NOTIFICATION_RECEIVED id1 A3BED075 id2 19890C35
    A new multiplayer-related raw notifications was received.
  • WNF_XBOX_LIVETV_RAW_NOTIFICATION_RECEIVED id1 A3BED875 id2 19890C35
    A new live tv-related raw notifications was received.
  • WNF_XBOX_SYSTEMUI_RAW_NOTIFICATION_RECEIVED id1 A3BEE075 id2 19890C35
    A new SystemUI-related raw notifications was received.
  • WNF_XBOX_CLUB_RAW_NOTIFICATION_RECEIVED id1 A3BEE875 id2 19890C35
    A new club-related raw notifications was received.
  • WNF_XBOX_CLUBCHAT_RAW_NOTIFICATION_RECEIVED id1 A3BEF075 id2 19890C35
    A new club chat-related raw notifications was received.
  • WNF_XBOX_SETTINGS_RAW_NOTIFICATION_RECEIVED id1 A3BEF875 id2 19890C35
    A new settings-related raw notifications was received.
  • WNF_XBOX_MEDIA_IS_PLAYING_CHANGED id1 A3BF0075 id2 19890C35
    Notification of whether any media is playing.
  • WNF_XBOX_EXPANDED_RESOURCES_INACTIVE id1 A3BF0875 id2 19890C35
    An expandedResources app has gone inactive.
  • WNF_XBOX_PARENTAL_RESTRICTIONS_CHANGED id1 A3BF1075 id2 19890C35
    The maximum age rating currently permissable has changed.
  • WNF_XBOX_PARTY_OVERLAY_STATE_CHANGED id1 A3BF1875 id2 19890C35
    Notification for when the Party Overlay's state should change
  • WNF_XBOX_CLOUD_SETTINGS_UPDATED id1 A3BF2075 id2 19890C35
    A cloud settings collection was updated
  • WNF_XBOX_ERA_FAST_ITERATION_STATUS_CHANGED id1 A3BF2875 id2 19890C35
    ERA Fast Iteration Mode has changed.
  • WNF_XBOX_NTM_CONSTRAINED_MODE_CHANGED id1 A3BF3075 id2 19890C35
    The Network Transfer Manager's constrained mode changed.
  • WNF_XBOX_NARRATOR_INPUT_LEARNING_MODE_CHANGED id1 A3BF3875 id2 19890C35
    Narrator input learning mode changed.
  • WNF_XBOX_SUSPEND_SKELETAL_TRACKING_INITIALIZATION id1 A3BF4075 id2 19890C35
    Initialization of the skeletal tracking pipeline should be suspended / resumed.
  • WNF_XBOX_NEON_SETTING_CHANGED id1 A3BF4875 id2 19890C35
    Immersive background or connected animation setting changed.
  • WNF_XBOX_COPYONLAN_UPLOAD_STATE_CHANGED id1 A3BF5075 id2 19890C35
    Copy on LAN upload state has changed.
  • WNF_XBOX_DASHBOARD_DIRECT_ACTIVATION id1 A3BF5875 id2 19890C35
    Event to trigger direct activation of xbox dashboard.
  • WNF_XBOX_COMMANDSERVICE_RAW_NOTIFICATION_RECEIVED id1 A3BF6075 id2 19890C35
    A new Command Service raw notification was received.
  • WNF_XBOX_NOTIFICATION_SETTING_CHANGED id1 A3BF6875 id2 19890C35
    A notification settings was updated
  • WNF_UTS_USERS_ENROLLED id1 A3BC0C75 id2 41951A38
    Indicates whether there are any enrolled users.
  • WNF_UTS_LOCKSCREEN_DISMISSAL_TRIGGERED id1 A3BC1475 id2 41951A38
    Triggered when the lock screen is dismissed to kick-off trusted signals.
  • WNF_USB_TYPE_C_PARTNER_STATE id1 A3BC0875 id2 41841D38
    This event indicates the state of a USB Type-C connector's partner device.
  • WNF_USB_BILLBOARD_CHANGE id1 A3BC1075 id2 41841D38
    This event indicates that the number of Billboard devices in the system has changed.
  • WNF_USB_PEER_DEVICE_STATE id1 A3BC1875 id2 41841D38
    This is the state of a peer device.
  • WNF_USB_CHARGING_STATE id1 A3BC2075 id2 41841D38
    This event indicates the USB charging state for this Windows device.
  • WNF_USB_FUNCTION_CONTROLLER_STATE id1 A3BC2875 id2 41841D38
    This event indicates the state of a USB function controller, such as detached, or attached, and successfully enumerated with host PC.
  • WNF_USB_ERROR_NOTIFICATION id1 A3BC3075 id2 41841D38
    This event indicates that a USB error notification needs to be published.
  • WNF_USB_POLICY_MANAGER_HUB_COLLECTION_STATE id1 A3BC3875 id2 41841D38
    This indicates that the hub collection in USB Policy Manager has changed.
  • WNF_USB_XHCI_AUDIO_OFFLOAD_STATE id1 A3BC4075 id2 41841D38
    This event indicates the state of a USB XHCI controller's audio offload state.
  • 4 комментария:

    1. How are you parsing perf_nt_c.dll?
      Data is in a bastard xml compressed format, and I can't associate the WNF_ with the ids (like 7540BCA3381D8441) - it's out of order and values don't seem to match

      ОтветитьУдалить
    2. in perf_nt_c.dll version 10.0.17692.1000 all this data stored in .rdata section in simple format, see addresses below XPerfAddIn::CWnfDumper::_Etw_EventDumper_GetMap
      so you can wtite simple idc/python script for ida pro to dump it on disk

      ОтветитьУдалить
    3. Thanks for response!

      I'm noob at disassembling. But I've managed to grab about ~80% verified names by using ollydbg to dump the data from your wincheck.exe instead then cut it via SynWrite text editor. Don't laugh.

      Will try your suggestion (no idea yet where to start in python, but I'm very tenacious :D)

      ОтветитьУдалить
      Ответы
      1. Success! IDA is great, it even outputs id1 and id2 automatically. No need for script, just File - Produce file - LST, then Hex View to grab corresponding statenames in hex, and finally put it together via text editor.
        I've exported it as csv here: pastebin . com / shYMfi2J
        Thanks again!

        Удалить