Elastic Windows Event Explorer


Publisher - Microsoft-Windows-BrokerInfrastructure

Event ID 19 v1

Message:

An instance with ID %{InstanceId} of a background task with entry point %{TaskEntryPoint} and name %{TaskName} has been canceled in session %{UserContextId}.

Event Data:

# Name In Type
Out Type
1 EntryPointLength win:UInt16 xs:unsignedShort
2 TaskEntryPoint win:UnicodeString xs:string
3 NameLength win:UInt16 xs:unsignedShort
4 TaskName win:UnicodeString xs:string
5 InstanceId win:GUID xs:GUID
6 UserContextId win:UInt64 xs:unsignedLong

Observed Windows Versions:

Version: 1

Fingerprint: RAMWQ4UTBD7LQ