# message_table_173_0x00000409

message_identifier: 0x00001052
message_string:
PFX operation failed as SafeBags count doesn't lie in expected range. Maximum permissible value: %1. Erroneous value: %2.


message_identifier: 0x00001050
message_string:
PFX operation failed as AuthSafes count doesn't lie in expected range. Maximum permissible value: %1. Erroneous value: %2.


message_identifier: 0x00001051
message_string:
PFX operation failed as Iteration count doesn't lie in expected range. Maximum permissible value: %1. Erroneous value: %2.


message_identifier: 0x0000100d
message_string:
Successful auto property update of third-party root certificate:: Subject: <%1> Sha1 thumbprint: <%2>.


message_identifier: 0x00000201
message_string:
Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object.%1.


message_identifier: 0x00000101
message_string:
The Cryptographic Services service failed to initialize the Catalog Database. The ESENT error was: %1.


message_identifier: 0x00000100
message_string:
The Cryptographic Services service failed to initialize the Catalog Database. The error was: %1 : %2.


# message_table_174_0x00000409

message_identifier: 0x80041102
message_string:
The propagation configuration file cannot be read.  Check that the same versions of search are used on both the content index and search servers.  If the problem persists, recrawl and repropagate the content index. 


message_identifier: 0x0008092e
message_string:
NOTE:  This dummy error message is necessary to force MC to output
       the above defines inside the FACILITY_WINDOWS guard instead
       of leaving it empty.


message_identifier: 0x00040d2b
message_string:
The update cannot begin without content sources. Add at least one content source that is not used for alerts.


message_identifier: 0x80040d25
message_string:
The requested value was not set by the filter process. This is a recoverable internal error. The document may still succeed.


message_identifier: 0x80040d22
message_string:
The catalog name is invalid. Choose a catalog name that is shorter or does not contain special characters.


message_identifier: 0xc0001b84
message_string:
Propagation stopped because the propagation state for search server <%2> cannot be read. Try propagation again.  If this error persists, delete and recreate the propagated index.%1


message_identifier: 0x80040d2e
message_string:
The document cannot be filtered, because the document and filter versions do not appear to match. Install a matching document filter.


message_identifier: 0x80040d2f
message_string:
The specified account name cannot be used because it contains invalid characters, such as '\'.  Use a valid account name.


message_identifier: 0x80040d2c
message_string:
The specified account information is incorrect or invalid.  Check that the correct account and password are being used.


message_identifier: 0x80043624
message_string:
An object could not be inserted because it was a duplicate of an existing object. The object may be a catalog or other named entity.


message_identifier: 0xc0000bbf
message_string:
Performance monitoring cannot be initialized for the gatherer object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1


message_identifier: 0xc0000bbe
message_string:
Performance monitoring cannot be initialized for the gatherer service, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1


message_identifier: 0x80043645
message_string:
The performance monitor counters cannot be unloaded because they are not loaded in the first place.


message_identifier: 0x80043641
message_string:
The stack for a thread in this process is corrupted due to a programming bug. This may be a security threat and indicate your system has been attacked. The process will be shutdown.


message_identifier: 0x80043640
message_string:
The upgrade interface has already been instantiated. Only one instance of the upgrade interface is allowed.


message_identifier: 0x80041224
message_string:
Accessing this site requires a client certificate.  Specify a client certificate in the site path rules.


message_identifier: 0xc0041734
message_string:
The content index cannot be read. A content scan will be scheduled after chkdsk or autochk is run.


message_identifier: 0xc0001b9a
message_string:
Configuration directory %2 is missing, and disaster recovery must be performed. If there are existing indexes, they must be restored from the last backup. If there is no backup of index data, then delete the catalogs and recreate them.%1


message_identifier: 0xc0001b9c
message_string:
The registry cannot be read, possibly because the registry keys for this index are missing. You may have to delete and recreate the index %1.


message_identifier: 0x8000232b
message_string:
The Windows Search Service cannot initialize multi-instancing in Jet. If the application is used in a cluster environment, all applications using Jet will fail in the same group.%1


message_identifier: 0x80001b6a
message_string:
There are no search servers selected.  Reconfigure the index to identify a suitable search server.  If the problem persists, delete and recreate the index.%1


message_identifier: 0x00001b68
message_string:
Index propagation to search server <%2> succeeded.  The service is now waiting for the search server to accept the propagation.%1


message_identifier: 0xc00003ee
message_string:
The Windows Search Service has failed to create the new search index. Internal error <%2, %3, %4>. %1


message_identifier: 0xc0001b90
message_string:
The content index server received an "Access Denied"" error while propagating to the <%2> search server. This usually results from an incorrect configuration of the propagation account. Check that the propagation account is valid.%1


message_identifier: 0xc0000c0d
message_string:
The application network access account is invalid.  Update the account with a valid username and password. %1


message_identifier: 0x800411a3
message_string:
The Microsoft Exchange 5.5 server name specified in the address does not match the one specified in the Microsoft Exchange 5.5 configuration. 


message_identifier: 0x800411a2
message_string:
There is insufficient privilege to access the Microsoft Exchange 5.5 server. Check that the Microsoft Exchange 5.5 configuration is valid and that the search service is running in the context of a user having administrative privileges on the Exchange server configuration node.


message_identifier: 0x800411a1
message_string:
The name of the Microsoft Exchange 5.5 server specified in the content source does not match the Exchange server specified in the Microsoft Exchange 5.5 configuration properties. Change the name of the Exchange server in the content source or configuration properties to match, and then try again.


message_identifier: 0x800411a0
message_string:
The configuration properties for Microsoft Exchange 5.5 were not set. Specify these properties, and then try again.


message_identifier: 0x800411a7
message_string:
Outlook is not installed on this machine, or is missing the CDO or MSEMS components.  Please install and configure Outlook, then try again.


message_identifier: 0x800411a6
message_string:
The service cannot access the Exchange 5.5 service. The account used by the search service may not be an Exchange administrator, or the site or organization settings on the search host may be invalid.


message_identifier: 0x800411a5
message_string:
The service cannot access the Exchange 5.5 server. The configured Microsoft Exchange 5.5 server name may be invalid, the Exchange 5.5 server may be temporarily unavailable, or the account used by the search service may not have administrative access to the Exchange 5.5 server. Check all of these properties, and then try again.


message_identifier: 0x800411a4
message_string:
There is insufficient privilege to access the Microsoft Exchange 5.5 Server. Verify that the Microsoft Exchange 5.5 configuration is valid and that the Search Service is running in the context of a user having administrative privileges on the Exchange Server configuration node.


message_identifier: 0x80040d61
message_string:
The specified gatherer application cannot be found. Use the name of an existing application, or reinstall the application.


message_identifier: 0x80040d62
message_string:
The application plug-in manager cannot be removed, because one or more content indexes was configured to use the plug-in.  Remove all indexes, and then remove the plug-in manager.


message_identifier: 0x80040d63
message_string:
The application name is invalid, because it contains special characters. Specify a different application name without special characters.


message_identifier: 0x80044008
message_string:
A zero-length cookie was retrieved at the end of a Dirsync search. The account may not have the appropriate rights.


message_identifier: 0xc0000e12
message_string:
Error ID %2 happened in Windows Search recovery stage, please restart the service. If this error persists, please recreate the index.%1


message_identifier: 0x80040d6b
message_string:
The system attempted to load a filter marked as apartment in a multi-threaded filter daemon. The document will be retried in a single-threaded filter. Since multithreaded filtering is more efficient, try to obtain the version of the filter that is multi-threaded.


message_identifier: 0xc0000c0f
message_string:
The gatherer files cannot be flushed, and this action cannot be completed. The gatherer will attempt to flush files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1


message_identifier: 0x80040d51
message_string:
The content source is not specified or is invalid. Type a host name that does not contain * or spaces.


message_identifier: 0x80040d50
message_string:
The site name is not specified or is invalid. Specify a site name that does not contain the following characters: [/\\@#|] or spaces.


message_identifier: 0x00040d67
message_string:
The content was not likely to be modified during the adaptive update, so the gatherer is not going to check the document for changes.


message_identifier: 0x00040d68
message_string:
The update will start as soon as all content sources are released by other updates that are already in progress.


message_identifier: 0x00040d69
message_string:
The transaction was ignored as redundant, because another transaction for the same URL was active at the same time.


message_identifier: 0x8004400b
message_string:
The user account name can not be resolved within the Active Directory. You would need to verify whether the user is a real user or just a temporary user object generated for some application purpose. You might be able to refine the LDAP search filter to avoid this error.


message_identifier: 0x8004400c
message_string:
Error (%1) occurred, which may have resulted from the unavailability of directory service server (%2). If the auto discovery option is turned on, import will re-try it with the newly discovered domain controller.  Otherwise, verify your import settings and make sure the server is still available.


message_identifier: 0x8004400d
message_string:
The attempt to discover domain controller for domain (%1) was failed with error (%2). Please make sure whether there is problem in network connectivity or the domain is renamed.


message_identifier: 0x80040c0e
message_string:
The value for the attribute is invalid. The application's configuration was corrupted.  Reinstall the application.


message_identifier: 0x80040c0d
message_string:
The specified column name already exists. The application's configuration was corrupted.  Reinstall the application.


message_identifier: 0x80040c0f
message_string:
The property set GUID is invalid. The application's configuration was corrupted.  Reinstall the application.


message_identifier: 0x80040c0a
message_string:
The configuration file column data type for the application is not recognized. Reinstall the application.


message_identifier: 0x80040c0c
message_string:
There was an error writing to the temporary noise word file. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80040c0b
message_string:
The noise word file cannot be created. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x00041225
message_string:
The item should be accessed while impersonating a user. Protocol handler is expected to implement IUrlAccessor3.


message_identifier: 0x80000bcf
message_string:
The update cannot be started because all of the content sources were excluded by site path rules, or removed from the index configuration.%1


message_identifier: 0x00041180
message_string:
The content index server detected a previously crawled document with the same content. This is an internal error code and should not be reported to users.  Call Microsoft Product Support.


message_identifier: 0x80040c07
message_string:
Data cannot be written to the output configuration file. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80040c06
message_string:
The output configuration file cannot be created. Stop and restart the system, and then reinstall the application.


message_identifier: 0x80040c01
message_string:
The configuration file attempted to load a reserved column. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80043634
message_string:
The plug-in specified is not known likely because it isn't loaded, so the operation can't succeed. Only specify plug-ins that are loaded.


message_identifier: 0x80040c08
message_string:
The configuration file for the application contains invalid information. Reinstall the application.


message_identifier: 0xc00003f8
message_string:
The Windows Search Service failed to move Index files from %2 to %3 with the following error: <%4,%5>. This might be because the target directory is not empty, or because the SYSTEM account doesn't have write access to the target directory. %1


message_identifier: 0x8000041d
message_string:
The system exception %1 occurred, and will be handled. 
If this causes problems, contact Microsoft Product Support Services and include the stack trace in the event. %2.


message_identifier: 0x8000041c
message_string:
The account used to start the Windows Search Service does not have the 
rights to operate the service.  The account must be either the LocalSystem 
account or a member of the Administrators group.  Use the Services tab in the 
Control Panel to change the startup account for the search service.%1


message_identifier: 0x80040424
message_string:
The registry data cannot be written. Check that the search service is running with administrator privileges.


message_identifier: 0x80040426
message_string:
The content index cannot be created because an index with the same name already exists on the search server. Create the content index using a different name.


message_identifier: 0x80040427
message_string:
The content index cannot be enabled because its propagation version cannot be verified against the dedicated index server.  This can occur when either the dedicated index server is offline or the content index is out-of-date.  


message_identifier: 0x80040422
message_string:
The operation cannot be completed, because one or more queries failed to terminate in a timely manner. 


message_identifier: 0x800003fa
message_string:
While rolling back the index, the Windows Search Service encountered the following error: <%4,%5>. Index files were not moved from %2 to %3. %1


message_identifier: 0x80040daa
message_string:
The security descriptor for this document only contained built-in access control entries. The built-in ACEs have to be removed because they won't be valid for this document during queries.


message_identifier: 0x80040dae
message_string:
The checkpoint cannot be enabled, because the content index is not idle.  Wait until the index is idle, and then try again.


message_identifier: 0xc004365a
message_string:
Property Store is not found in the indexer. The possible causes are that the call came during a catalog reset or that the property store plug-in failed to load during indexer initialization.


message_identifier: 0x40001043
message_string:
%1A master merge has been paused for catalog %2 due to low disk space.
The merge will be rescheduled later.  Please free some disk space for indexing to continue.


message_identifier: 0x00043622
message_string:
The Full Text Engine's input queue is full.  This batch has been accepted for processing; however, the Full Text Engine will soon go into a forced paused state until the queue is less full.


message_identifier: 0x80041403
message_string:
The search service is running as a local System service. To access Exchange documents, check that the search service is running in a user account with administrative privileges on the Exchange server.


message_identifier: 0xc0001ba5
message_string:
Index propagation failed to commit to any of the search servers.  The Windows Search Service is now trying to revert the search servers to the previous index. %1


message_identifier: 0x80040d7b
message_string:
Document filtering cannot be completed because the document server did not respond within the specified timeout. Try crawling the server later, or increase the timeout values.


message_identifier: 0xc00003fb
message_string:
Windows Search Service failed to process the list of included and excluded locations with the error <%2, %3, "%4">. %1


message_identifier: 0x80040da1
message_string:
There were not enough keywords in the sample documents to train the Topic Assistant.  Try again when more sample documents are available.


message_identifier: 0x80040da0
message_string:
The operation could not be completed because the specified path is invalid.  Try again using a valid path.


message_identifier: 0x80040da3
message_string:
There were not enough sample documents to train the Topic Assistant.  Try again when more sample documents are available.


message_identifier: 0x80040da2
message_string:
The Topic Assistant requires sample documents from at least two categories.  Try again when sample documents for more categories are available.


message_identifier: 0x80040da5
message_string:
The system attempted to load a filter marked as apartment from an embedded component in a multi-threaded filter daemon. The document will be retried in a single-threaded filter. Since multithreaded filtering is more efficient, try to obtain the version of the filter that is multi-threaded.


message_identifier: 0x80040d60
message_string:
The path specification for the content source cannot contain wildcard characters, such as [?*]. Remove all wildcards from the path specification.


message_identifier: 0x80040d32
message_string:
The server is unavailable and cannot be accessed. The server is probably  disconnected from the network. Access attempts will be delayed for ten minutes.


message_identifier: 0x80040d35
message_string:
The document cannot be filtered, because the required code page is not installed.  Install the code page for this document.


message_identifier: 0x80040d34
message_string:
This path does not correspond to the selected site. Use a path name that matches the site, or use a wildcard (*).


message_identifier: 0x80040d39
message_string:
The filter process cannot be started. The system is most likely low on resources, or the filter process binary was modified. If the resources are available, check the search binaries with an antivirus program.


message_identifier: 0x80002725
message_string:
Could not get performance counter registry info for %1 for instance %2 %3 due to the following error: %4.


message_identifier: 0x80002724
message_string:
Performance Counters could not be loaded for %1 for instance %2 %3 due to the following error: %4.


message_identifier: 0x80002727
message_string:
The protocol host process %2 did not respond and is being forcibly terminated {filter host process %3}. %1


message_identifier: 0x80002726
message_string:
Performance counters will not be loaded because the named objects (shared memory or events) are in use for %1 for instance %2 %3.


message_identifier: 0x00040da7
message_string:
This is a success code that indicates that the MIME filter should be used to filter the document stream. This is an internal error code and should not be reported to users.  Call Microsoft Product Support.


message_identifier: 0x00040d30
message_string:
Failed to load document into IFilter. Possibly caused by unrecognized document format or document corruption. Only metadata obtained from the document storage was indexed.


message_identifier: 0x80041211
message_string:
The item will not be crawled because the Access Control List allows no one to read the item. Check that this is intended.


message_identifier: 0x80041212
message_string:
Search cannot crawl the item, because its Access Control List exceeded 64 KB. Check that the item has a valid Access Control List.


message_identifier: 0x80041213
message_string:
The item cannot be processed further because search failed to find one of its properties. Check that the item is valid in the store.


message_identifier: 0x80041216
message_string:
Filtering was interrupted because of a sharing conflict with another process. Crawl the file again when it is not in use.


message_identifier: 0x40000be7
message_string:
The incremental update is complete. The gatherer successfully processed %2 documents totaling %3K. It failed to filter %4 documents. %5 documents were modified. %6 URLs were not found or denied access.%1


message_identifier: 0x8004fd00
message_string:
The IPersistStream and IPersistFile interfaces were unavailable from an IFilter filter DLL to load data for indexing.


message_identifier: 0x80042105
message_string:
This file is shorter than 2 bytes. Unicode text file must begin with a wide character that indicates byte order.


message_identifier: 0x8004fd02
message_string:
The filter daemon MSFTEFD failed to load an IFilter interface for document, so it can't be indexed.


message_identifier: 0x8004117f
message_string:
The content index server cannot update or access information because of a database error.  Stop and restart the search service.  If the problem persists, reset and recrawl the content index.  In some cases it may be necessary to delete and recreate the content index.


message_identifier: 0x80043638
message_string:
The property type specified is incorrect for this property. Please see the product documentation for the correct data type for this property.


message_identifier: 0x8004fd05
message_string:
The filter daemon process MSFTEFD exited unexpectedly because of document %1.
Batch Id: %2
Locale Id: %3
Property Id: %4
Stack Trace:
%5


message_identifier: 0x8004fd07
message_string:
The system failed to load noise words stream into text filter because text filter does not support IPersistStream.


message_identifier: 0x80040d7a
message_string:
Schema/schema cache error (%1) occurred. Schema collection ref: %2, content class: %3. This error is internal, for debugging.


message_identifier: 0xc0000be8
message_string:
No documents were accessed because no e-mail address is specified in the content index server properties. Specify the e-mail address in the service configuration.%1


message_identifier: 0x8004fd09
message_string:
The system failed to load noise words stream into text filter because IFilter::Init() function failed.


message_identifier: 0x00040d8f
message_string:
Annotations/Shortcut is not crawled by this content index because it is included in a shadow index.


message_identifier: 0x80000bd0
message_string:
The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.%1


message_identifier: 0x80040d79
message_string:
Crawling cannot continue because the local server is not responding. Restart Microsoft SQL Server 2000.


message_identifier: 0x80040d77
message_string:
The property list for the content class of this document cannot be loaded, and the schema cannot be accessed. Check that the schema is correctly configured.


message_identifier: 0x80040d76
message_string:
The function is unavailable, because it was called while the word breaker was attempting to fill the text buffer. Download and install an update for the word breaker.


message_identifier: 0x80042103
message_string:
The specified content index was not found. Check to see if it was deleted, or if there are errors in your application code.


message_identifier: 0x80040d74
message_string:
Read access to the Exchange store is temporarily unavailable. If this message persists, restart the Exchange store.


message_identifier: 0x80040d72
message_string:
A duplicate of this document was detected, and the document will be retried. If this problem persists, recreate the content index.


message_identifier: 0x80044011
message_string:
You do not have sufficient permissions for incremental import, or the DirSync cookie stored in the user profile database is corrupt. If you are importing from a Windows 2000 domain, check that the import account has the Replicate Changes permission for Active Directory directory services. If the import account has the permission, start a full import to refresh the cookie.


message_identifier: 0x80044010
message_string:
Access was denied on domain: (%1), and user information from the domain was not imported. Check the user name and password of the access account specified on the Configure Profile Import page. If incremental import is enabled and you are importing from a Windows 2000 domain, check that the access account has the Replicate Changes permission for Active Directory directory services.


message_identifier: 0x80040d05
message_string:
Performance monitoring cannot be initialized. This affects performance counters only. Try restarting the service or restarting the server.


message_identifier: 0x80000bdf
message_string:
A request to start the update has been ignored because the update is already in progress or is scheduled on one or more content sources.%1


message_identifier: 0x00043619
message_string:
The Full Text Engine's input queue is getting full.  This batch has been accepted for processing.  This success code is intended to help pause input until the queue is less full.


message_identifier: 0x80040d11
message_string:
The filtering process ended and is now unavailable. The address will be retried, but it is possible that the system is low in resources. Free some system resources, or restart the update when resources are available.


message_identifier: 0x80040d10
message_string:
The plug-in did not provide a filter sink object. You may have installed a custom plug-in that is not supported. 


message_identifier: 0x80040d12
message_string:
An unexpected message was received from the filtering process. The address will be retried, but if this occurs frequently, your system is low on resources. Free some system resources, or restart the update when resources are available.


message_identifier: 0x80040d03
message_string:
The registry value cannot be read because the configuration is invalid. Recreate the content index configuration by removing the content index.


message_identifier: 0x40001045
message_string:
%1Catalog: %2.
A master merge was started because the catalog reached the maximum number of indexes on the last level (%3).


message_identifier: 0x40001046
message_string:
%1Catalog: %2.
A master merge was started because the expected number of documents in the catalog (%3) were indexed.


message_identifier: 0xc0000bff
message_string:
Performance monitoring cannot be initialized for the topic assistant object, because the counters are not loaded or the shared memory object cannot be opened. This only affects availability of the perfmon counters. Restart the computer.%1


message_identifier: 0x8004110d
message_string:
Index propagation was stopped.  This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x8004110e
message_string:
The disk is full. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x8004110f
message_string:
The index data is invalid. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x8004110a
message_string:
A word breaker was not found for the given language. Check your current language settings and ensure that search supports the current language.  If the problem persists, reinstall search.


message_identifier: 0x8004110b
message_string:
A noise word list was not found for the given language. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x8004110c
message_string:
A stemmer was not found for the given language. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80042406
message_string:
The password for the content access account cannot be decrypted because it was stored with different credentials.  Re-type the password for the account used to crawl this content.


message_identifier: 0x80040d45
message_string:
The extension string is not specified or is invalid. Specify an extension string that does not contain the following characters: [./?*:\#] or spaces.


message_identifier: 0x80041108
message_string:
One or more files required for content index creation were not found. Stop and restart the search service.  If the problem persists, delete and recreate the content index.


message_identifier: 0x80041109
message_string:
The search server was not found. Stop and restart the search service.  If propagation is being used, stop and restart the search service on the remote computers.


message_identifier: 0x80040d0b
message_string:
A duplicate extension entry exists in the registry. The duplicate extension should be deleted, but all other extensions are unaffected.


message_identifier: 0xc0000c02
message_string:
The application restore failed. This can be caused by system errors (indicated by previously logged events), or a corrupt backup image (retry restore with valid backup image). %1


message_identifier: 0x80040d0a
message_string:
A duplicate index entry exists in the registry. No other indexes are affected, but it is recommended that the duplicate entry be deleted. 


message_identifier: 0x80040d0f
message_string:
The function is not implemented in this context, and cannot be called.  This error is internal, and cannot normally occur. Reinstall the application.


message_identifier: 0x80040d0d
message_string:
The URL was already processed during this update. If you received this message while processing alerts, then the alerts are redundant, or else Modify should be used instead of Add.


message_identifier: 0x80040d0e
message_string:
The gatherer attempted to create more gatherer plug-in objects than are allowed. Remove another plug-in before adding this one.


message_identifier: 0x800003f7
message_string:
Event ID %2 for the Windows Search Service has been suppressed %3 time(s) since %4. This event is used to suppress Windows Search Service events that have occurred frequently within a short period of time.  See Event ID %2 for further details on this event.%1


message_identifier: 0x800003f6
message_string:
The Windows Search Service has failed to create one or more path rules. 
The service will continue creating the SystemIndex search index. 
Debug information: <%2>. %1


message_identifier: 0x800003f0
message_string:
The Windows Search Service is starting up and attempting to remove the old search index {Reason: %2}. %1


message_identifier: 0x8004fd03
message_string:
The document being indexed timed out for an unknown reason. This may be due to a bug in a filter or wordbreaker.


message_identifier: 0x80042100
message_string:
The specified application name is not valid. Check to see whether a search application with that name already exists.


message_identifier: 0x80043628
message_string:
This is an internal error: This request cannot be completed because the Filter Daemon has been shutdown.


message_identifier: 0x40000bf4
message_string:
An update cannot begin because the content source <%2> is in use by another update already in progress. The update will start as soon as all its content sources are released by updates already in progress.%1


message_identifier: 0x80040d73
message_string:
The administrative data from the Exchange store or registry cannot be read. Check that the Exchange store is started, and that it was properly restored.


message_identifier: 0x80042104
message_string:
The content index cannot be deleted while the search service is stopped. Restart the search service and try again.


message_identifier: 0x80001b97
message_string:
Search server <%2> cannot be contacted. However, <%2> was successfully added as a propagation recipient.%1


message_identifier: 0x8004362d
message_string:
A status change is active on another thread. Since only one status change is allowed at a time this request can't be handled.


message_identifier: 0x00043658
message_string:
The property requested from the catalog blob received doesn't match the current value of the catalog property.
The property value used by the catalog was successfully returned.
The caller should either call SetProperty with the value returned or dismount the catalog and mount it back with the blob.


message_identifier: 0x00043657
message_string:
Internal Success Code.  Crawl is done.  Chunk buffers can be flushed; there is no additional input data.


message_identifier: 0x40000bfb
message_string:
The adaptive update is complete. The gatherer successfully processed %2 documents totaling %3K. It failed to filter %4 documents. %5 documents were modified. %6 URLs were not found or denied access.%1


message_identifier: 0x8004181d
message_string:
The index does not exist or is currently unavailable. Try again later. If this problem persists, contact the system administrator.


message_identifier: 0x8004181e
message_string:
Page size is not an integral multiple of the sector size of the volume where the index is located.


message_identifier: 0x80040db6
message_string:
The backup image cannot be verified because the image may be corrupted. To preserve your data, it is recommended that you run Data Backup and Restore again.


message_identifier: 0x80040db7
message_string:
The filter host process cannot be started. The system is most likely low on resources, or the filter host process binary was modified. If the resources are available, check the search binaries with an antivirus program.


message_identifier: 0x80040db0
message_string:
Maximum number of properties per document has been reached. The document is most likely corrupt, or it represents a denial of service threat, the indexing of this document has been aborted.


message_identifier: 0x80040d46
message_string:
The specified maximum grow factor is invalid. Set the maximum grow factor to be greater than or equal to zero.


message_identifier: 0x80040d47
message_string:
The specified time out value is invalid. Set the time out value to be greater than or equal to zero.


message_identifier: 0x8004fd08
message_string:
The system failed to load noise words stream into text filter because the IPersistStream::Load() function failed.


message_identifier: 0x80040d40
message_string:
The specified URL mapping is invalid. The "from"" mapping is empty, or the ""from"" mapping is the same as the ""to"" mapping. Specify a valid ""from"" mapping that differs from the ""to"" mapping.


message_identifier: 0x80040d41
message_string:
The user agent string was not specified or contains invalid characters. Specify a user agent which is not empty and does not contain double quotation marks.


message_identifier: 0x80040d48
message_string:
The specified retry limit value is invalid. Set the retry limit value to be greater than or equal to zero.


message_identifier: 0x80043403
message_string:
Parallel vectors for property mapping information on the content source have different dimensions.


message_identifier: 0x80042605
message_string:
The Notes data cannot be accessed. Check that the server is properly configured for accessing Notes data.


message_identifier: 0x80041617
message_string:
Coalesce is either not used properly or this form is not currently supported. Check for possible mixing of grouping with coalesce


message_identifier: 0x80041610
message_string:
No relevant information is found in the relevant documents with the specified properties for this query.


message_identifier: 0x80041119
message_string:
The index is a mismatch in the minor version number. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041118
message_string:
There is a mismatch in the major version number. Check that the same versions of search are used on both the content index and search servers.  If necessary, crawl the index again and repropagate the index. 


message_identifier: 0x8004361c
message_string:
Signature validation cannot be performed on modules loaded by COM, so the object will not be created. The object is likely a filter, wordbreaker, stemmer, or protocol handler.


message_identifier: 0xc0000bda
message_string:
The registry version does not match with the expected <%2>, or the registry cannot be accessed because the service account does not have the correct permissions.  Uninstall the previous version before installing the new one.%1


message_identifier: 0x80041207
message_string:
You have been redirected to an address that does not exist. Check that the source address is redirecting to an accessible address.


message_identifier: 0x80041205
message_string:
Access is denied. Check that the Default Content Access Account in Windows Search Central Administration is correct, or follow the "Exclude and Include Content" link to add a rule to specify the proper crawling account to access this URL.


message_identifier: 0x80041204
message_string:
An unrecognized HTTP status was received. Check that the address can be accessed using Internet Explorer.


message_identifier: 0x80000bef
message_string:
The gatherer property mapping file cannot be opened. The default values are being used. You may have to copy the property mapping file from the setup CD, or reinstall the application.%1


message_identifier: 0x80000bee
message_string:
The update has been delayed because a disk is full. Check the system default temp location and the drive on which search catalog is created. The system default temp location is used for creation of temporary files during crawling. If it is full, crawling pauses. If the system default temp location is full, change the location to a disk with more free space and restart the computer. Changes to the system temp location do not take effect for system services until the computer is restarted.%1


message_identifier: 0x80000bed
message_string:
The previous update was reset, or was otherwise interrupted. A full update of all content sources will be automatically started. %1


message_identifier: 0x8004120f
message_string:
An object cannot be processed because search cannot convert a Notes Access-Denied entry in the Access Control List into a Windows NT identity. Check the Notes to Windows NT identity mapping.


message_identifier: 0x8004120e
message_string:
Search was unable to convert the Access Control List of the crawled store into a Windows NT Access Control List. Check that local information is not used in the store.


message_identifier: 0x80043613
message_string:
A status change is occurring or the project is in a force paused state, so MSFTESQL cannot accept input at this time.


message_identifier: 0x80043611
message_string:
This is an internal error: Document IDs should be greater than 0 and less than or equal to 0x7fffffff.


message_identifier: 0x80043616
message_string:
This is an internal error: Initialization of the datasink is incorrect.  At least one protocol handler PROGID is required.


message_identifier: 0x80043617
message_string:
This is an internal error:  A static thread has gotten invalid arguments and will force batches to be aborted and retried.


message_identifier: 0xc0000bd2
message_string:
Advise Status Change failed. The system is probably low on resources. Free up resources and restart the service.%1


message_identifier: 0x80043609
message_string:
Data transferred between the MSFTESQL service and a filter daemon process is corrupted. This is an internal error.


message_identifier: 0x80000be6
message_string:
The update for the index cannot be started because the specified content sources were not configured for updates. Add at least one content source.%1


message_identifier: 0x80040402
message_string:
The requested content index is disabled on the search server. Contact the system administrator to enable the content index. Check the event log for possible errors.


message_identifier: 0x80040406
message_string:
The request cannot be processed, because the system is low on resources. Try again later, or contact your system administrator to free up system resources.


message_identifier: 0x8004118a
message_string:
The content index server cannot update or access information because of a sharing violation.  Stop and restart the search service.  If the problem persists, reset and recrawl the content index.  In some cases it may be necessary to delete and recreate the content index.


message_identifier: 0x80040d81
message_string:
Annotation transactions always spawn a transaction for the annotated document and then fail themselves.  This is an internal error code and should not be reported to users.  Call Microsoft Product Support.


message_identifier: 0x80040d88
message_string:
Alerts for this content source cannot be established because information about the file share cannot be obtained.


message_identifier: 0x80040d89
message_string:
Alerts for a content source with a local address are only supported for a fixed media drive type. Use the UNC name for remote file shares.


message_identifier: 0x80043630
message_string:
The filter daemon process MSFTEFD timed out for an unknown reason. This may indicate a bug in a filter, wordbreaker, or protocol handler.


message_identifier: 0x0004111d
message_string:
The search server was added successfully, but cannot be contacted.  Check that the search service is executing on the remote computer, and that you can connect to the remote computer.


message_identifier: 0x80040d1b
message_string:
The gatherer index was not initialized. The content index must be remounted. If the index is still not initialized, remove it.


message_identifier: 0xc0001b98
message_string:
Performance monitoring cannot be initialized because the counters are not loaded or the shared memory object cannot be opened. Stop and restart the search service.  If this error continues, reinstall the application.%1


message_identifier: 0x80040d8b
message_string:
The new content index cannot be added because there is not enough disk space.  Free up at least 10 megabytes of free space, and then try again.


message_identifier: 0x80040d8c
message_string:
The urn:schemas-microsoft-com:publishing:ShortcutTarget property must be type LPWSTR. Change the type for the property to LPWSTR.


message_identifier: 0xc0000bd1
message_string:
Critical error %2 occurred, and the index was shut down. The system is probably low on resources. Free up resources and restart the service.%1


message_identifier: 0x00041116
message_string:
The search server does not exist.  This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x00041114
message_string:
There is no update in progress.  This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041184
message_string:
The content index server cannot update or access its database because sessions are unavailable. Increase the system resource usage setting for the search service.  If the problem persists, stop and restart the search service.


message_identifier: 0x80041185
message_string:
The content index server cannot update or access its database because insufficient system resources are available. Increase the system resource usage setting for the search service.  If the problem persists, stop and restart the search service.


message_identifier: 0x80041186
message_string:
The content index server cannot update an unrecognized or recently defined property attribute. Reset and recrawl the content index.


message_identifier: 0x80041187
message_string:
The property store was unable to open, close, or delete a data file used in propagation.  Check that your index volume has enough disk space.


message_identifier: 0x80041181
message_string:
The content index server cannot find a description of the content index in its database. Search will automatically attempt to recreate the content index description.  If this problem persists, stop and restart the search service and, if necessary, delete  and recreate the content index.


message_identifier: 0x80041182
message_string:
The content index server cannot find needed information in its database. Reset and recrawl the content index.


message_identifier: 0x80041183
message_string:
The content index server cannot update or access its database, because the version store has insufficient resources.  Increase the system resource usage setting for the search service.  If the problem persists, stop and restart the search service.


message_identifier: 0x80041188
message_string:
The property store encountered propagation data files that cannot be used.  Try propagation again.


message_identifier: 0x80041189
message_string:
There is a mismatch in the property store version numbers. Ensure that the same versions of search are used on both the content index and search servers.  If necessary, recrawl the content index and try to propagate the content index again.


message_identifier: 0x80041903
message_string:
The account cannot be granted a privilege to "log on as service"" on the domain controller.  The domain security administrator needs to grant the default account this privilege.  All of the default accounts specified for the server need this account privilege.


message_identifier: 0x80040d18
message_string:
The ProgID for a protocol handler cannot be obtained, and the protocol handler registration is invalid. Reregister the protocol handlers.


message_identifier: 0x80040d13
message_string:
The filtering process returned an unsupported property type. Fix the filter to allow successful use of the document.


message_identifier: 0x80040d15
message_string:
The user agent or e-mail address was not specified. Specify the e-mail address to use in the protocol headers.


message_identifier: 0x80040d14
message_string:
The specified name for this object exceeds the maximum length, which is usually 2047 characters. Use a shorter name for the object.


message_identifier: 0x80040d16
message_string:
A filter for the document cannot be created. Install the corresponding filter for this document format.


message_identifier: 0x80042004
message_string:
The chunk does not allow changes. To set properties on a chunk, create it using IGatherScriptFilterSink::CreateChunk


message_identifier: 0x80040d07
message_string:
The specified address was excluded from the index. The site path rules may have to be modified to include this address.


message_identifier: 0xc0001b63
message_string:
Directory location <%2> is invalid. The application configuration cannot be read.  Reinstall the application.%1


message_identifier: 0x80040d04
message_string:
The value cannot be set, because the object was already deleted or was not initialized properly. Check that the object reference is still valid, increase the registry size, or recreate the content index configuration.


message_identifier: 0x00041209
message_string:
Filtering of this file ended because the file reached the maximum filter output limit. Check that the filter does not generate a large amount of data relative to the size of the document.


message_identifier: 0x00040d78
message_string:
Some parts of the document were modified, and others were not. The gatherer will refilter the entire document.


message_identifier: 0x80041113
message_string:
The propagation state information cannot be read. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041112
message_string:
The property store cannot be initialized. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041110
message_string:
The index data is corrupt. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041117
message_string:
The content index is not loaded. Stop and restart the search service.  If the problem persists, review other errors in the event log. If necessary, delete and recreate the content index.


message_identifier: 0xc0000c15
message_string:
The project cannot be initialized, because one of the checkpoint files is missing. The data structures on the disk will be reset.  Check to see if someone is manually deleting files, and verify that your hardware is working properly. %1


message_identifier: 0xc0000c14
message_string:
The project cannot be initialized, because the checkpoint record cannot be read. The data structures on the disk will be reset.  Verify that your hardware is working properly. %1


message_identifier: 0xc0000c13
message_string:
The checkpoint record cannot be read, and this action cannot be completed.  If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1


message_identifier: 0xc0000c12
message_string:
The gatherer files from the previous checkpoint cannot be restored, and this action cannot be completed. The gatherer will attempt to restore the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1


message_identifier: 0xc0000c11
message_string:
The gatherer files cannot be saved, and this action cannot be completed. The gatherer will attempt to save the files again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1


message_identifier: 0xc0000c10
message_string:
The checkpoint record cannot be updated, and this action cannot be completed. The gatherer will attempt to update the checkpoint record again. If the problem persists, restart the service, free system resources or verify that your hardware is working properly. %1


message_identifier: 0x0004120c
message_string:
The file reached the maximum download limit. Check that the full text of the document can be meaningfully crawled.


message_identifier: 0x80043653
message_string:
A failure occurred when tracking the completion of wordlists which will cause current activity to be aborted.


message_identifier: 0x8004361e
message_string:
This is an internal error that should be handled. The FD has been killed and this chunk buffer has already been reassigned.


message_identifier: 0x80042609
message_string:
The user name mapping cannot be read. Check that the database, view, and column names are correct, that the Notes database is accessible, and that the sort option is enabled. For more information, see the Administrator's Guide.


message_identifier: 0x8004111c
message_string:
The index was dismounted because it is being removed or the search service stopped.  If the problem persists, restart the search service.


message_identifier: 0x8004111b
message_string:
Crawling of documents was stopped. This is an internal error code and should not be reported to users.  Call Microsoft Product Support.


message_identifier: 0x8004111a
message_string:
A connection with the Search service on a remote machine could not be established. Check the connectivity with the remote machine.  If necessary, stop and restart the Search service on the remote machine.


message_identifier: 0x00041902
message_string:
At least one content index definition was not initialized.  Check the amount of free disk space, and verify that the registry configuration is correct.


message_identifier: 0x80040117
message_string:
The calling process is an NT service, and registry keys required by MAPI could not be initialized.  


message_identifier: 0xc0000bc6
message_string:
An exception occurred. ID: %2. This is an internal error. Reproduce the error with the debugger attached and enable exceptions, then contact product support. One of the components loaded in your system is bad. You may be able to avoid the problem by recreating the index.%1


message_identifier: 0x800411a8
message_string:
The account information specified for accessing the Exchange 5.5 server cannot be used. Verify the account and password information.


message_identifier: 0x80040d65
message_string:
The data size returned by the filter is greater than the allocated buffer. Download and install an update for the filter.


message_identifier: 0x80000c01
message_string:
The gatherer detected pages in the history during recovery that cannot be read, and repaired them.  However, statistical data for some URLs may have been lost.  This can be caused by restarting a computer without first shutting down Windows, or by disk failure.%1


message_identifier: 0x80000c00
message_string:
The gatherer is recovering after an improper shutdown.  This will delay availability of gathering functions, and may result in some noncritical data loss.%1


message_identifier: 0x80000c06
message_string:
The Windows Search service stopped the Protocol Host process because it was consuming too many resources.  A new Protocol Host process will be started.  No user action is required.%1


message_identifier: 0x80000c08
message_string:
Notifications for the scope %2 are not active. The event logging threshold for this scope was exceeded.  No further events will be sent for one hour. %1


message_identifier: 0x80000bf0
message_string:
The automatic description encoding tag value is invalid. The gatherer is setting this value to "yes"". Fix the gthrprm.txt file.%1


message_identifier: 0xc0001b80
message_string:
The search service has detected corrupted data files in the index {id=%2}. The service will attempt to automatically correct this problem by rebuilding the index.%1


message_identifier: 0x80000c0a
message_string:
Notifications for the scope %2 were reactivated. The event logging threshold for this scope was exceeded.  No further events will be sent for one hour. %1


message_identifier: 0x80040d53
message_string:
The path is not specified or contains invalid characters, such as ["" ?*]. Specify a path that does not contain these characters.


message_identifier: 0x80000bfc
message_string:
The gatherer is using the word breaker for language id <%2> for text in language id <%3>. The corresponding language resources are not installed on your computer.%1


message_identifier: 0xc0001b65
message_string:
The update was paused because the disk <%2> is full. Free up disk space to continue crawling the index.%1


message_identifier: 0x80001048
message_string:
%1 Unable to create the query engine's first request item due to error %2. It's possible that the MSFTESQL service account is invalid or the password has expired.


message_identifier: 0x80040d58
message_string:
The path expression cannot contain the reserved escape character '|'. Use an expression without reserved characters.
|' - a reserved escape character. Use an expression without reserved characters.


message_identifier: 0x40000bca
message_string:
The update is complete. The gatherer successfully processed %2 documents totaling %3K. It failed to filter %4 documents. %5 documents were modified. %6 URLs were not found or denied access.%1


message_identifier: 0x80043500
message_string:
This is an internal error code. A method was called when it should not be. Call Microsoft Product Support.


message_identifier: 0x8004160f
message_string:
No information was found in the relevant documents with the specified properties, because a clause of the query contained only words that are ignored.


message_identifier: 0x8004160d
message_string:
The relevant specified documents were not found, because a clause of the query contained only words that are ignored.


message_identifier: 0x80041120
message_string:
Information for this content class was not found. Use the default content class.  This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041104
message_string:
The specified search server already exists. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041105
message_string:
An update is already in progress. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041106
message_string:
The index list file cannot be read. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80041904
message_string:
The selected content index definition did not initialize and cannot be used.  Check server status, content index configuration, and user access to the server.


message_identifier: 0x80040d9b
message_string:
The plug-in is not properly registered on this computer.  Check that the application is properly installed, or contact Microsoft Product Support.


message_identifier: 0x80040d9d
message_string:
File system alerts were not initialized successfully   If the problem persists after restarting the service, try rerunning Setup.


message_identifier: 0x80040d9f
message_string:
Alerts failed because of network failures or because the internal cache size was exceeded.  If the problem persists, change the content source type to adaptive or crawl.


message_identifier: 0x80041101
message_string:
The tag is invalid. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80040c16
message_string:
A column having the specified property set and PID already exists. The application's configuration has been corrupted.  Reinstall the application.


message_identifier: 0x80040c17
message_string:
The configuration describing a language and sublanguage contains unexpected duplicate information. The application's configuration may be corrupted.  Though basic functionality is unlikely to be impacted, it is recommended that you reinstall the application.


message_identifier: 0x80040c14
message_string:
An invalid attribute was specified for this tag, or a required attribute is missing. The application's configuration was corrupted.  Reinstall the application.


message_identifier: 0x80040c15
message_string:
The specified file name is invalid. This error is obsolete and should no longer be reported.  Call Microsoft Product Support.


message_identifier: 0x80040c12
message_string:
The specified column name is invalid. The application's configuration has been corrupted.  Reinstall the application.


message_identifier: 0x80040c13
message_string:
The property ID specified is invalid. The application's configuration has been corrupted.  Reinstall the application.


message_identifier: 0x80040c10
message_string:
No more columns.  This is an internal error code and should not be reported to users.  Call Microsoft Product Support.


message_identifier: 0x80040c11
message_string:
The system cannot write to the configuration file, because it was modified since it was last read. Stop and restart the search service.  If this problem persists, reinstall search.


message_identifier: 0x80041103
message_string:
The number of search servers exceeded the limit.  Ensure that the number of propagated content indexes is less than the documented maximum.  If so, start and restart the search service, and then try again.


message_identifier: 0x80043605
message_string:
The system attempted to load an apartment threading model filter marked in a multi-threaded filter daemon. The document will be retried in a single-threaded filter daemon process. Since multithreaded filtering is more efficient, try to obtain the version of the filter that is multi-threaded.


message_identifier: 0x80043607
message_string:
An internal interface is being used after the corresponding catalog has been shutdown. The operation will be aborted.


message_identifier: 0x80043606
message_string:
The value cannot be set, because the object was already deleted or was not initialized properly. Make sure the object reference is still valid, increase the registry size, or recreate the catalog configuration.


message_identifier: 0x80041107
message_string:
A registry entry required for content index creation cannot be read or created. Delete and recreate the content index.  If the problem persists, you may need to reinstall search.


message_identifier: 0x80040419
message_string:
There is a mismatch in the protocol between the search service and the client. Install the correct version of the client.


message_identifier: 0x80040411
message_string:
The SetStatus operation cannot be completed, because another SetStatus operation is already in progress. Try again after the current operation is completed.


message_identifier: 0x80040410
message_string:
The search server cannot find one or more catalog files. Check the event log for related failures.


message_identifier: 0x80040412
message_string:
The content index cannot be created, because another content index with the same name already exists. Create the content index using a different name.


message_identifier: 0x80040414
message_string:
The search server cannot read or write to the registry. Check that the search server is running with administrative privileges.


message_identifier: 0x80040d97
message_string:
Backup and restore failed during an ESE database phase. For more detailed information, check the event log.


message_identifier: 0x8004cb04
message_string:
The in-memory wordlist is corrupted. This is due to a faulty filter, wordbreaker, or other indexing component.


message_identifier: 0x8004cb03
message_string:
There is not enough occurrence buffer memory available. Possible causes include too many processors, too many filter threads, or the occurrence buffer is not being returned.


message_identifier: 0x8004cb02
message_string:
There is not enough available physical or virtual memory for chunk buffers. Chunk buffers are needed to index data. Please free up memory.


# message_table_175_0x00000409

message_identifier: 0xc101004f
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Assemblies that require branch version logic can not be privately deployed.


message_identifier: 0xc101004e
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The application element is not allowed in component manifest.


message_identifier: 0xc101004d
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Multiple compatibilityInfo elements are not allowed in manifest.


message_identifier: 0xc1010048
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The element %1 appears as a child of element %2 which is not supported by this version of Windows.


message_identifier: 0xc101004b
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Multiple requestedPrivileges elements are not allowed in manifest.


message_identifier: 0xc101004a
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The requestedPrivileges element is not allowed in component manifest.


message_identifier: 0xc101000c
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The value specified for the manifest assembly element manifestVersion attribute is not currently supported.


message_identifier: 0xc101000b
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest assembly element is missing the required manifestVersion attribute.


message_identifier: 0xc101000a
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The application config file root element must be configuration.


message_identifier: 0xc101000f
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.


message_identifier: 0xc1010050
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: %1.
Component 2: %2.


message_identifier: 0xc1010052
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Application configuration specified an invalid private-assembly probing path.
The invalid probing path was part of %1.


message_identifier: 0xc1010049
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The element %1 may only appear before the %2 element.


message_identifier: 0xc101004c
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The compatibilityInfo element is not allowed in component manifest.


message_identifier: 0xc1010010
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Call to installation callback failed; %1


message_identifier: 0xc1010018
message_string:
Activation context generation failed for "%11".
Dll redirector contributor unable to add file map entry for file %1; %2


message_identifier: 0xc101002e
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest contains a non-empty <noInherit> tag.


message_identifier: 0xc101002f
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest contains multiple <noInherit> tags; it must have zero or one.


message_identifier: 0xc101003b
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Invalid Xml syntax.


message_identifier: 0xc1010044
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
In element %1 the value of attribute %2 must either be yes or no.


message_identifier: 0xc1010036
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
An application configuration manifest contains a dependentAssembly element which is missing its assemblyIdentity subelement.


message_identifier: 0xc1010032
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The bindingRedirect element is only permitted in component configuration manifests.


message_identifier: 0xc1010033
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The bindingRedirect element requires both oldVersion and newVersion attributes.


message_identifier: 0xc101003e
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The required attribute %2 is missing from element %1.


message_identifier: 0xc1010030
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.

The policy contains a <noInherit> tag, but only manifests may have these.



message_identifier: 0xc1010047
message_string:
Activation context generation failed for "%11".
Version overlap with previous version redirection while parsing policy file %1 where oldVersion is %2 and newVersion is %3.


message_identifier: 0xc1010046
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Multiple assemblyIdentity elements within one dependentAssembly element.


message_identifier: 0xc1010009
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest file root element must be assembly.


message_identifier: 0xc1010043
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest defines multiple identities for this assembly or application.


message_identifier: 0xc1010042
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The manifest contains multiple noInheritable elements.


message_identifier: 0xc1010041
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The root or application manifest contains the noInherit element but the dependent assembly manifest does not
contain the noInheritable element. Application manifests which contain the noInherit element may only
depend on assemblies which are noInheritable.


message_identifier: 0xc1010040
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The attribute %2 is not permitted in this context on element %1.


message_identifier: 0xc1010001
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Multiple top-level ASSEMBLY elements found.


message_identifier: 0xc1010034
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
A component configuration manifest contains more than one dependentAssembly element.


message_identifier: 0xc1010021
message_string:
Activation context generation failed for "%11".
Dependent Assembly %1 could not be found.
Please use sxstrace.exe for detailed diagnosis.


message_identifier: 0xc1010023
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Component identity found in manifest does not match the identity of the component requested.
Reference is %1.
Definition is %2.
Please use sxstrace.exe for detailed diagnosis.


message_identifier: 0xc1010022
message_string:
Activation context generation failed for "%11".
The application failed to launch because of an invalid manifest.


message_identifier: 0xc1010035
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
An application configuration manifest contains more than one dependentAssembly element for configuring the same assembly identity.


message_identifier: 0xc1010045
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
Multiple dependentAssembly elements within one dependency element.


message_identifier: 0xc101003f
message_string:
Activation context generation failed for "%11".Error in manifest or policy file "%12" on line %13.
The value "%3" of attribute "%2" in element "%1" is invalid.


# message_table_176_0x00000409

message_identifier: 0x00000002
message_string:
A program failed to access information from a location sensor or default location%n%nFriendlyName=%1;%nImagePath=%2;%nPID=%3;%nUsername=%4;%nSID=%5


message_identifier: 0x00000001
message_string:
A program accessed information from a location sensor or default location%n%nFriendlyName=%1;%nImagePath=%2;%nPID=%3;%nUsername=%4;%nSID=%5


# message_table_177_0x00000409

message_identifier: 0xb0000101
message_string:
EFS key demoted from current key.  CertValidated: %1, cbHash: %2, pbHash: %3, ContainerName: %4, ProviderName: %5, DisplayInformation: %6, dwCapabilities: %7, bIsCurrentKey: %8, eKeyType: %9


message_identifier: 0xb0000100
message_string:
EFS key promoted from current key.  CertValidated: %1, cbHash: %2, pbHash: %3, ContainerName: %4, ProviderName: %5, DisplayInformation: %6, dwCapabilities: %7, bIsCurrentKey: %8, eKeyType: %9


message_identifier: 0xb0000102
message_string:
EFS key flushed from cache.  CertValidated: %1, cbHash: %2, pbHash: %3, ContainerName: %4, ProviderName: %5, DisplayInformation: %6, dwCapabilities: %7, bIsCurrentKey: %8, eKeyType: %9


message_identifier: 0xb0000310
message_string:
%1.%2: Smartcard notification detected, but the logon cert is already cached.  No processing required.


message_identifier: 0xb0000312
message_string:
%1.%2: User does not yet have a current key.  If smartcard is required by policy, the logon cert and PIN will be cached.


message_identifier: 0xb0000316
message_string:
%1.%2: tried to install logon cert, but it's not available (not a smartcard logon, or the smartcard was removed)


message_identifier: 0xb0001006
message_string:
%1.%2: Plug-n-Play service not ready. EFS server will not try to detect interrupted encryption/decryption operation(s).


message_identifier: 0xb0000303
message_string:
%1.%2: Policy settings specified new cache flush interval: %3.  Stop polling (will restart if there are active user caches)


message_identifier: 0xb0001004
message_string:
%1.%2: user is modifying a DDF matching the PoP entry, or the DRF.  Don't require WRITE_ATTRIBUTES


message_identifier: 0xb0001106
message_string:
%1.%2: EFS recovery service cannot open the file %3. The interrupted encryption/decryption operation cannot be recovered.


message_identifier: 0xb0001105
message_string:
%1.%2: Interrupted encryption/decryption operation(s) found on a volume. Recovery procedure started.


message_identifier: 0xb0000205
message_string:
EFS key added to user cache.  CertValidated: %1, cbHash: %2, pbHash: %3, ContainerName: %4, ProviderName: %5, DisplayInformation: %6, dwCapabilities: %7, bIsCurrentKey: %8, eKeyType: %9


message_identifier: 0xb0001111
message_string:
%1.%2: EFS recovery service cannot open the backup file %3 by name. The interrupted encryption/decryption operation (on file %4) may be recovered.  The backup file will not be deleted. User should delete the backup file if the recovery operation is done successfully.


message_identifier: 0xb0001113
message_string:
%1.%2: EFS recovery service cannot get the backup file name. The interrupted encryption/decryption operation (on file %3) may be recovered.  The temporary backup file %4 is not deleted.  User should delete the backup file if the recovery operation is done successfully.


message_identifier: 0xb0001112
message_string:
%1.%2: %3 was opened by File ID successfully the first time but not the second time. No recovery operation was tried on file %4. This is an internal error.


# message_table_178_0x00000409

message_identifier: 0x4000232c
message_string:
The Desktop Window Manager was unable to start because of an insufficient display mode color depth


message_identifier: 0x4000232d
message_string:
The Desktop Window Manager was unable to start because the video card does not support hardware acceleration


message_identifier: 0x40002344
message_string:
The Desktop Window Manager did not start because the maximum texture size supported by the graphics adapter is less than the size of the largest monitor


message_identifier: 0x4000233a
message_string:
The user was prompted that the Desktop Window Manager was suffering a performance slowdown and chose to shutdown


message_identifier: 0x40002330
message_string:
The Desktop Window Manager was unable to start because pixel shader version 2.0 is not supported by the video card


message_identifier: 0x40002336
message_string:
The Desktop Window Manager did not start because necessary data required to verify starting was not available


message_identifier: 0x40002337
message_string:
The Desktop Window Manager was unable to start because the remote client does not support desktop composition remoting


message_identifier: 0x40002334
message_string:
The Desktop Window Manager was unable to start because the disable desktop composition policy is active


message_identifier: 0x40002335
message_string:
The Desktop Window Manager was unable to start because composition was disabled by a running application


message_identifier: 0x40002338
message_string:
The Desktop Window Manager did not start because an analysis of the hardware and configuration indicated that it would perform poorly


message_identifier: 0x40002339
message_string:
The Desktop Window Manager did not start because the user explicitly requested that desktop composition not occur


message_identifier: 0x40002341
message_string:
The Desktop Window Manager has stopped locking system memory due to passing its working set threshold


message_identifier: 0x4000233b
message_string:
The Desktop Window Manager was unable to start because the desktop composition setting is disabled


message_identifier: 0x40002342
message_string:
The Desktop Window Manager has restarted locking system memory due to falling far enough below its working set threshold


message_identifier: 0x4000233d
message_string:
The Desktop Window Manager used an opaque colorization because an analysis of the hardware and configuration indicated that a transparent colorization would perform poorly


message_identifier: 0x4000233e
message_string:
The Desktop Window Manager did not start due to the Windows installation not being Genuine. Consult the user interface that was raised at login to determine how to correct this


message_identifier: 0x40002340
message_string:
The Desktop Window Manager has been disabled automatically by the system due to too much system memory in use


# message_table_179_0x00000409

message_identifier: 0xc0000503
message_string:
Error: Can't execute the command using the 32-bit version under WOW64. Please run the command in the 64-bit installation directory.


message_identifier: 0xc000043c
message_string:
aspnet_wp.exe could not be started. The error code for the failure is %1. This error can be caused when the worker process account has insufficient rights to read the .NET Framework files. Please ensure that the .NET Framework is correctly installed and that the ACLs on the installation directory allow access to the configured account.


message_identifier: 0x4000047f
message_string:
The Web Site Administration Tool has been configured to allow only local connections and to use Windows authentication.  If the aspnet_webadmin application was previously set to use a Secure Sockets Layer (SSL) connection, it is still configured to require SSL.


message_identifier: 0x4000047e
message_string:
The Web Site Administration Tool has been configured to allow remote connections and to use Windows authentication.


message_identifier: 0x4000047d
message_string:
The Web Site Administration Tool has been configured to allow remote connections and to use Forms authentication.


message_identifier: 0xc0000432
message_string:
An error occurred in while processing a request in state server. Major callstack: %1. Error code: %2


message_identifier: 0xc0000506
message_string:
Warning: No 64-bit install detected.  You should register the 64-bit version
before using the 32-bit version under WOW64.  Please run "aspnet_regiis -ir" in
the 64-bit installation directory.


message_identifier: 0xc00004b2
message_string:
Install this version of ASP.NET. If there are any existing applications that uses ASP.NET, it will not update scriptmaps in IIS.


message_identifier: 0x800003fc
message_string:
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To configure ASP.NET to run in IIS, please install or enable IIS and re-register ASP.NET using aspnet_regiis.exe /i.


message_identifier: 0xc00004bb
message_string:
Uninstall this version of ASP.NET.  Existing scriptmaps to this version are remapped to highest remaining version of ASP.NET installed on the machine.


message_identifier: 0xc0000438
message_string:
"Provides support for out-of-process session states for ASP.NET. If this service is stopped, out-of-process requests will not be processed. If this service is disabled, any services that explicitly depend on it will fail to start."


message_identifier: 0xc0000436
message_string:
The state server has closed an expired TCP/IP connection. The IP address of the client is %1.%2.%3.%4. The expired %5 operation began at %6/%7/%8 %9:%10:%11.


message_identifier: 0xc0000437
message_string:
(For debugging) State Server expiry thread is closing a socket. The IP address of the client is %1.%2.%3.%4. The expired %5 operation began at %6/%7/%8 %9:%10:%11.


message_identifier: 0x4000046f
message_string:
Setup has detected some errors during the operation. For details, please read the setup log file %1


message_identifier: 0x80000408
message_string:
Registration (version %1) will not register the DLL in the scriptmap properties of any IIS website because the version is not high enough to replace the existing one at the root.  See help for the explanation of version comparison during installation.


message_identifier: 0x800004a4
message_string:
ASP.NET Admin Service has rejected a request because the authentication level was not RPC_C_AUTHN_LEVEL_PKT_PRIVACY.


message_identifier: 0x800004a2
message_string:
ASP.NET Admin Service has rejected a request from user '%1' because the user does not belong to the IIS_WPG group.


message_identifier: 0x80000406
message_string:
Updates to the IIS metabase were aborted because IIS is either not installed or is disabled on this machine. To completely uninstall ASP.NET from IIS, please re-enable IIS and unregister ASP.NET using aspnet_regiis.exe /u.


message_identifier: 0xc00004b3
message_string:
When -enable is specified with -i, -ir or -r, ASP.NET will be enabled in the IIS security console (IIS 6.0 or later).


message_identifier: 0xc00003ef
message_string:
aspnet_wp.exe could not be launched because the username and/or password supplied in the processModel section of the config file are invalid.


message_identifier: 0xc00004e1
message_string:
[-app virtual-path] Decrypt at this virtual path. Virtual path must begin with a forward slash. If it is '/', then it refers to the root of the site. If -app is not specified, the root web.config will be decrypted.


message_identifier: 0xc00004db
message_string:
[-app virtual-path] Encrypt at this virtual path. Virtual path must begin with a forward slash. If it is '/', then it refers to the root of the site. If -app is not specified, the root web.config will be encrypted.


message_identifier: 0xc00004c2
message_string:
List all versions of ASP.NET that are installed on the machine, with status and installation path.


message_identifier: 0xc00004c8
message_string:
Grant the specified user or group access to the IIS metabase and other directories used by ASP.NET.


message_identifier: 0x8000040f
message_string:
Registration failed to find the highest installed version from the registry. As a result, registration will use the IIS Default Document, Mimemap settings and ISAPI Filter DLL path from the current version. Error code: %1


message_identifier: 0x8000040e
message_string:
Failed while getting the version of %1, which is found in a scriptmap in IIS.  The file could be missing. Error code: %2


message_identifier: 0xc0000507
message_string:
Error: No 64-bit install detected.  You must register the 64-bit version before
using 32-bit version under WOW64.  Please run "aspnet_regiis -ir" in the 64-bit
installation directory.


message_identifier: 0xc0000409
message_string:
Registration failed when trying to find the highest version installed on the machine. Error code: %1


message_identifier: 0xc00003f2
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because the synchronous pipes
 could not be initialized. Error code: %2


message_identifier: 0xc0000469
message_string:
The error indicates that IIS is disabled on the machine. Please enable IIS before using this tool.


message_identifier: 0xc0000468
message_string:
The error indicates that IIS is not installed on the machine. Please install IIS before using this tool.


message_identifier: 0xc00004d0
message_string:
If the web admin tool is already installed on a site, this command will copy over the content of the app_globalresources and app_localresources folders from the .NET Framework installation directory to the web admin tool directory of the site. <Site> is the path of the site defined in IIS.  If * argument is used, this command will work on all sites.


message_identifier: 0xc00004c3
message_string:
List all the path of all IIS metabase keys where ASP.NET is scriptmapped, together with the version.  Keys that inherit ASP.NET scriptmaps from a parent key will not be displayed.


message_identifier: 0x8000051c
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rException information:
%r%b%b%b%bException type: %18
%r%b%b%b%bException message: %19
%r
%rCustom event details:
%r%14


message_identifier: 0x8000051d
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rException information:
%r%b%b%b%bException type: %18
%r%b%b%b%bException message: %19
%r
%rRequest information:
%r%b%b%b%bRequest URL: %20
%r%b%b%b%bRequest path: %21
%r%b%b%b%bUser host address: %22
%r%b%b%b%bUser: %23
%r%b%b%b%bIs authenticated: %24
%r%b%b%b%bAuthentication Type: %25
%r%b%b%b%bThread account name: %26
%r
%rThread information:
%r%b%b%b%bThread ID: %27
%r%b%b%b%bThread account name: %28
%r%b%b%b%bIs impersonating: %29
%r%b%b%b%bStack trace: %30
%r
%rCustom event details:
%r%14


message_identifier: 0xc0000441
message_string:
Failed to execute the request because the ASP.NET process identity does not have read permissions to the global assembly cache. Error: %1


message_identifier: 0xc00003f3
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because the asynchronous pipe
 could not be initialized. Error code: %2


message_identifier: 0xc0000426
message_string:
It is not possible to run two different versions of ASP.NET in the same IIS process. Please use the IIS Administration Tool to reconfigure your server to run the application in a separate process.


message_identifier: 0xc00004b4
message_string:
When -disable is specified with -i, -ir or -r, ASP.NET will be disabled in the IIS security console (IIS 6.0 or later).


message_identifier: 0xc0000515
message_string:
The following exception was thrown by the web event provider '%1' in the application '%2' (in an application
lifetime a maximum of one exception will be logged per provider instance):%r%r%3


message_identifier: 0xc0000445
message_string:
Unable to get the private bytes memory limit for the W3WP process.
The ASP.NET cache will be unable to limit its memory use, which may lead
to a process restart. Error: %1


message_identifier: 0x40000533
message_string:
When -disable is specified with -i, -ir or -r, ASP.NET will be disabled in the IIS security console (IIS 6.0 or later). Note: this will not have any effect on applications running in Integrated mode.


message_identifier: 0x40000530
message_string:
Set the ASP.NET version of the application pool for the specified application path and all child applications of the specified application to ASP.NET version 2.0. If the application pool of the specified application or child applications is the "ASP.NET 1.1", the application pool of that application is set to "DefaultAppPool". Requires that the "IIS 6 Management Compatibility" features are enabled.


message_identifier: 0x40000531
message_string:
Set the ASP.NET version of the application pool for the specified application path to ASP.NET version 2.0. If the application pool of the specified application is the "ASP.NET 1.1", the application pool of the application is set to "DefaultAppPool". Requires that the "IIS 6 Management Compatibility" features are enabled.


message_identifier: 0x80000402
message_string:
During unregistration (version %1), a clean uninstall was done because the process failed to get the next highest version. Error code: %2


message_identifier: 0x40000534
message_string:
When -enable is specified with -i, -ir or -r, ASP.NET will be enabled in the IIS security console (IIS 6.0 or later). Note: this will not have any effect on applications running in Integrated mode.


message_identifier: 0x40000535
message_string:
A request mapped to aspnet_isapi.dll was made within an application pool running in Integrated .NET mode.  Aspnet_isapi.dll can only be used when running in Classic .NET mode.  Please either specify preCondition="ISAPImode" on the handler mapping to make it run only in application pools running in Classic .NET mode, or move the application to another application pool running in Classic .NET mode in order to use this handler mapping.


message_identifier: 0xc0000453
message_string:
Finished installing ASP.NET (%1) and replacing ASP.NET DLL in all Scriptmaps with current version.


message_identifier: 0xc00004c6
message_string:
Remove the client side scripts for all versions from the aspnet_client subdirectory of each IIS site directory.


message_identifier: 0xc00004c4
message_string:
Install the client side scripts for this version to the aspnet_client subdirectory of each IIS site directory.


message_identifier: 0xc00004c5
message_string:
Remove the client side scripts for this version from the aspnet_client subdirectory of each IIS site directory.


message_identifier: 0xc00003f7
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because webengine.dll
 could not be initialized. Error code: %2


message_identifier: 0xc00003f4
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because the .NET Runtime
 could not be initialized. Error code: %2


message_identifier: 0x8000041b
message_string:
An error message detailing the cause of this specific request failure can be found in the application event log of the web server.  Please review this log entry to discover what caused this error to occur.


message_identifier: 0xc00004ba
message_string:
Install this version of ASP.NET and update scriptmaps at the IIS metabase root and for all scriptmaps below the root. Existing scriptmaps are upgraded to this version regardless of the original versions.


message_identifier: 0xc00003f1
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because the synchronization event
 could not be initialized. Error code: %2


message_identifier: 0xc00003eb
message_string:
aspnet_wp.exe  (PID: %1) was recycled because it was suspected to be in a deadlocked state. It did not send any responses for pending requests in the last %2 seconds. This timeout may be adjusted using the <processModel responseDeadlockInterval> setting in machine.config.


message_identifier: 0x4000051f
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rRequest information:
%r%b%b%b%bRequest URL: %18
%r%b%b%b%bRequest path: %19
%r%b%b%b%bUser host address: %20
%r%b%b%b%bUser: %21
%r%b%b%b%bIs authenticated: %22
%r%b%b%b%bAuthentication Type: %23
%r%b%b%b%bThread account name: %24
%r
%rCustom event details:
%r%14


message_identifier: 0x4000051b
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rProcess statistics:
%r%b%b%b%bProcess start time: %18
%r%b%b%b%bThread count: %19
%r%b%b%b%bWorking set: %20 bytes
%r%b%b%b%bPeak working set: %21 bytes
%r%b%b%b%bManaged heap size: %22 bytes
%r%b%b%b%bApplication domain count: %23
%r%b%b%b%bRequests executing: %24
%r%b%b%b%bRequests queued: %25
%r%b%b%b%bRequests rejected: %26
%r
%rCustom event details:
%r%14


message_identifier: 0x40000529
message_string:
The error indicates that IIS is in 32 bit mode, while this application is a 64 bit application and thus not compatible.


message_identifier: 0x40000528
message_string:
The error indicates that IIS is in 64 bit mode, while this application is a 32 bit application and thus not compatible.


message_identifier: 0x80000419
message_string:
The web application you are attempting to access on this web server is currently unavailable.&nbsp; Please hit the "Refresh" button in your web browser to retry your request.


message_identifier: 0x40000521
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rRequest information:
%r%b%b%b%bRequest URL: %18
%r%b%b%b%bRequest path: %19
%r%b%b%b%bUser host address: %20
%r%b%b%b%bUser: %21
%r%b%b%b%bIs authenticated: %22
%r%b%b%b%bAuthentication Type: %23
%r%b%b%b%bThread account name: %24
%r
%rName to authenticate: %25
%r
%rCustom event details:
%r%14


message_identifier: 0x40000524
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rRequest information:
%r%b%b%b%bRequest URL: %18
%r%b%b%b%bRequest path: %19
%r%b%b%b%bUser host address: %20
%r%b%b%b%bUser: %21
%r%b%b%b%bIs authenticated: %22
%r%b%b%b%bAuthentication Type: %23
%r%b%b%b%bThread account name: %24
%r
%rViewStateException information:
%r%b%b%b%bException message: %25
%r%b%b%b%bClient IP: %26
%r%b%b%b%bPort: %27
%r%b%b%b%bUser-Agent: %28
%r%b%b%b%bPersistedState: %29
%r%b%b%b%bReferer: %30
%r%b%b%b%bPath: %31
%r
%rCustom event details:
%r%14


message_identifier: 0xc00004b0
message_string:
Install this version of ASP.NET and update scriptmaps at the IIS metabase root and for all scriptmaps below the root. Existing scriptmaps of lower version are upgraded to this version.


message_identifier: 0xc00004ce
message_string:
Remove the web admin tool from the site specified by <site>, where <site> is the path of the site defined in IIS.  If the * argument is used, then the web admin tool is removed from all sites on the machine, and the WADM_[machinename] account will be get disabled on the machine.


message_identifier: 0xc00004cb
message_string:
Install the web admin tool to the site specified by <site>, where <site> is the path of the site defined in IIS.  If the * argument is used, then the web admin tool is installed on all sites on the machine.  If a copy of web administration tool already exists on a site, it will be overwritten.


message_identifier: 0xc00003f8
message_string:
aspnet_wp.exe  (PID: %1) failed to startup because of failure
to create the thread for answering ping messages. Error code: %2


message_identifier: 0x4000052a
message_string:
Failed to execute request because the worker process account does not have access to the IIS Metabase. This may be fixed by running "aspnet_regiis -ga <account-name>" for the worker process account. However, there are security implications of running "aspnet_regiis -ga".


message_identifier: 0x4000052c
message_string:
Note: This utility has limited capabilities on the Windows Vista operating system. It is recommended that you use the "Turn on or off Windows features" option of the "Programs" component of Control Panel to install or remove ASP.NET. It is also recommended that you use the IIS Manager component or the Appcmd.exe tool to configure ASP.NET applications.


message_identifier: 0x4000052b
message_string:
[-site site-name-or-ID] The site of the virtual path specified in -app. If not specified, the default web site will be used.


message_identifier: 0x4000052d
message_string:
Install ASP.NET version 2.0 and upgrade all application pools to ASP.NET version 2.0. The "ASP.NET 1.1" application pool is ignored.


message_identifier: 0x40000518
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rProcess information:
%r%b%b%b%bProcess ID: %15
%r%b%b%b%bProcess name: %16
%r%b%b%b%bAccount name: %17
%r
%rCustom event details:
%r%14


message_identifier: 0x40000517
message_string:
Event code: %1
%rEvent message: %2
%rEvent time: %3
%rEvent time (UTC): %4
%rEvent ID: %5
%rEvent sequence: %6
%rEvent occurrence: %7
%rEvent detail code: %8
%r
%rApplication information:
%r%b%b%b%bApplication domain: %9
%r%b%b%b%bTrust level: %10
%r%b%b%b%bApplication Virtual Path: %11
%r%b%b%b%bApplication Path: %12
%r%b%b%b%bMachine name: %13
%r
%rCustom event details:
%r%14


message_identifier: 0xc00003e9
message_string:
aspnet_wp.exe  (PID: %1) was recycled because memory consumption exceeded the %2 MB (%3 percent of available RAM).


# message_table_180_0x00000409

message_identifier: 0x00002023
message_string:
The user name %1 specified in registry (%2) is not valid, winerror %3. The entry is ignored.%n
It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'.
%4


message_identifier: 0x00002026
message_string:
Volume Shadow Copy Service error: Failed resolving account %1 with status %2. Check connection to domain controller and VssAccessControl registry key.
%3


message_identifier: 0x00002024
message_string:
Fail to parse XML file.%n
Reason %1%n
Line %2%n
Position %3%n
Errorcode %4%n
Problem text %5%n
%6


message_identifier: 0x00002025
message_string:
A VSS writer has rejected an event with error %1. Changes that the writer made to the writer components while handling the event will not be available to the requester.
Check the event log for related events from the application hosting the VSS writer.
%2


message_identifier: 0x00000011
message_string:
The value with name %1 specified in registry (%2) of value (%3) cannot be interpreted. The entry is ignored.
It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'.
Value '0' denies the username from running any VSS writer.
Value '1' is used to allow it.
%4


message_identifier: 0x00000010
message_string:
The value with name %1 specified in registry (%2) is not of type REG_DWORD. The entry is ignored.
It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'.
Value '0' denies the username from running any VSS writer.
Value '1' is used to allow it.
%3


message_identifier: 0x00000013
message_string:
Volume Shadow Copy Service error: The EventSystem service is disabled or is attempting to start during Safe Mode.
The Volume Shadow Copy service cannot start while in safe mode.
If not in safe mode, make sure that EventSystem service is enabled.
CLSID:%1 Name:%2 [%3]
%4


message_identifier: 0x00000012
message_string:
Volume Shadow Copy Service error: The COM Server with CLSID %1 and name %2 cannot be started during Safe Mode.
The Volume Shadow Copy service cannot start while in safe mode. [%3]
%4


message_identifier: 0x00000015
message_string:
Volume Shadow Copy Service error: Writers will not receive events since the COM+ database is corrupted.
This might happened if an error occurred during Windows setup.
The error returned from CoCreateInstance on class with CLSID %1 and Name %2 is [%3]
%4


message_identifier: 0x00000014
message_string:
Volume Shadow Copy Service error: The Volume Shadow Copy infrastructure cannot be used during Safe Mode.
%1


message_identifier: 0x00000017
message_string:
The value specified in registry (%1) has no name. The entry is ignored.
It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'.
Value '0' denies the username from running any VSS writer.
Value '1' is used to allow it.
%2


message_identifier: 0x00000016
message_string:
Volume Shadow Copy Service error: A critical component required by the Volume Shadow Copy service is not registered.
This might happened if an error occurred during Windows setup or during installation of a Shadow Copy provider.
The error returned from CoCreateInstance on class with CLSID %1 and Name %2 is [%3].
%4


message_identifier: 0x00000019
message_string:
Volume Shadow Copy Service Warning: The Microsoft Shadow Copy Provider is shutting down
and is experiencing delay while waiting for in-progress calls to complete.
%1


message_identifier: 0x00000018
message_string:
Volume Shadow Copy Service Warning: The Volume Shadow Copy Service is shutting down
and is experiencing delay while waiting for in-progress calls to complete.
%1


message_identifier: 0x00003055
message_string:
The Volume Shadow Copy Service was unable to load the provider with identifier %1. Reinstall the provider
and retry the operation. If the provider still fails to load, please contact the vendor responsible
for that provider.%n
%2


message_identifier: 0x00003056
message_string:
The destination LUN could not be resynchronized from the source volume because it did not report a
unique SCSI storage storage identifier of type 1, 2, 3, or 8 and association 0.%n
Retry the operation with a different destination LUN.%n
%1


message_identifier: 0x00003057
message_string:
The resynchronization operation failed because the MBR signature or GPT ID of one or more of the
destination LUNs could not be changed.%n
If the affected destination LUNs have incorrect signatures, this might cause associated disk cluster
resources to remain offline.%n
%1


message_identifier: 0x0000002d
message_string:
Volume Shadow Copy Service information: Volume '%1' appears as disconnected and it is
ignored by the service. You may want to rescan disks. [%2]
%3


message_identifier: 0x0000b003
message_string:
Select this volume (%1) if it is a critical volume.
Critical volumes are those which ASR must restore.


message_identifier: 0x0000002c
message_string:
Volume Shadow Copy Service information: Disk '%1' appears as disconnected and it is
rejected by the service. You may want to rescan disks. [%2]
%3


message_identifier: 0x0000304e
message_string:
An unhandled exception was encountered while processing a VSS writer event callback method. The VSS
writer infrastructure is in an unstable state. Restart the service or application that hosts the writer.%n
%n
Writer name:            %1%n
Writer id:              %2%n
Writer instance:        %3%n
Process command line:   %4%n
Process ID:             %5%n
Writer operation:       %6%n
Writer state:           %7%n
Exception code:         %8%n
Exception location:     %9%n


message_identifier: 0x0000304c
message_string:
An expected volume arrival did not complete because this LUN was not detected.%n
%n
LUN ID			%1%n
%n
Version			%2%n
Device Type		%3%n
Device TypeModifier	%4%n
Command Queueing	%5%n
Bus Type		%6%n
Vendor Id		%7%n
Product Id		%8%n
Product Revision		%9%n
Serial Number		%10%n
%n
Storage Identifiers%n
%11%n
%n
%12


message_identifier: 0x0000304b
message_string:
An expected hidden volume arrival did not complete because this LUN was not detected.%n
%n
LUN ID			%1%n
%n
Version			%2%n
Device Type		%3%n
Device TypeModifier	%4%n
Command Queueing	%5%n
Bus Type		%6%n
Vendor Id		%7%n
Product Id		%8%n
Product Revision		%9%n
Serial Number		%10%n
%n
Storage Identifiers%n
%11%n
%n
%12


message_identifier: 0x0000304a
message_string:
A Shadow Copy LUN was not detected in the system and did not arrive.%n
%n
LUN ID			%1%n
%n
Version			%2%n
Device Type		%3%n
Device TypeModifier	%4%n
Command Queueing	%5%n
Bus Type		%6%n
Vendor Id		%7%n
Product Id		%8%n
Product Revision		%9%n
Serial Number		%10%n
%n
Storage Identifiers%n
%11%n
%n
%12


message_identifier: 0x00000024
message_string:
Volume Shadow Copy Service error: The MSXML classes are not registered.  This may be caused
due to a setup failure or as a result of an application's installer or uninstaller.
%1


message_identifier: 0x00000025
message_string:
Volume Shadow Copy Service error: The Microsoft Shadow Copy Provider class is not registered..
This may be caused due to a setup failure or as a result of an application's installer or uninstaller.
%1


message_identifier: 0x00000026
message_string:
Volume Shadow Copy Service error:  Either the COM+ Event System service (EventSystem) or
the COM+ System Application service (COMSysApp) is disabled.  Enable the service and try
again.
%1


message_identifier: 0x00000027
message_string:
Volume Shadow Copy Service error:  The Volume Shadow Copy service (VSS) is disabled. Enable 
the service and try again.
%1


message_identifier: 0x00000020
message_string:
Volume Shadow Copy Service error: The VSS Coordinator class is not registered.  This may be caused
due to a setup failure or as a result of an application's installer or uninstaller.
%1


message_identifier: 0x00000021
message_string:
Volume Shadow Copy Service error: The VSS management class is not registered.  This may be caused
due to a setup failure or as a result of an application's installer or uninstaller.
%1


message_identifier: 0x00000022
message_string:
Volume Shadow Copy Service error: The VSS event class is not registered.  This will prevent any
VSS writers from receiving events.  This may be caused due to a setup failure or as a result of an
application's installer or uninstaller.
%1


message_identifier: 0x00003046
message_string:
The requester specified the VSS_ONLUNSTATECHANGE_DO_MASK_LUNS flag when calling the BreakSnaphsotSetEx method,
but the hardware provider for this shadow copy does not implement the IVssHardwareSnapshotProviderEx interface.
%1


message_identifier: 0x00003045
message_string:
The BreaksnapshotSetEx method failed because the disk signature of one or more shadow copy LUNs could not 
be reverted to those of the original LUNs. If one or more original LUNs are not masked on the computer, this
can cause a disk signature collision.  Disk signatures of dynamic disks cannot be reverted.
%1


message_identifier: 0x00000028
message_string:
Volume Shadow Copy Service error:  The Microsoft Software Shadow Copy Provider (SWPRV) service is
disabled.  Enable the service and try again.
%1


message_identifier: 0x0000001a
message_string:
This machine is a Domain Controller with the Active Directory service (NTDS) stopped.
Backup cannot be performed, nor can shadow copies be managed in this case.
Either the NTDS must be started (net start ntds), or reboot in DSRM to enumerate shadow copies/providers/writers only.
%1


message_identifier: 0x0000001c
message_string:
The given type for the ApplicationsBlockingRevert key (%1) is incorrect.
It must be a REG_MULTI_SZ containing a sequence of null-terminated volume GUID strings specifying volumes
blocked from revert, followed by an extra null termination.
%2


message_identifier: 0x0000001b
message_string:
This machine is a Domain Controller but the Active Directory (NTDS) service is stopped.
Restore cannot be performed while NTDS is stopped.
Either the NTDS must be started (net start ntds), or reboot in DSRM.
%1


message_identifier: 0x0000001e
message_string:
Fail to acquire Security Audit privilege.%n
Security Audits for shadow copy creation and import will not be logged.
%1


message_identifier: 0x0000001d
message_string:
This machine is a Domain Controller in Directory Service Restore Mode (DSRM).
Backup cannot be performed in this case, please reboot out of DSRM.
%1


message_identifier: 0x0000001f
message_string:
Volume Shadow Copy Service Warning: A writer with name %1 and ID %2 waited %3 seconds
for in-progress calls to complete before shutting down.
%4


message_identifier: 0x0000a001
message_string:
ASR Warning: Failed to collect disk information for ASR Backup.
Reason:    Unable to obtain disk information for device %1 (Win32 error code %2).


message_identifier: 0x0000305a
message_string:
The LUN resynchronization operation failed because the destination disk could not be found or because
another application holds an exclusive handle to the destination LUN.%n
Make sure that all applications have released their handles to the LUN and retry the operation.%n
%1


message_identifier: 0x0000a003
message_string:
ASR Error: Fail to exclude dynamic pack.
Reason:    Some, but not all, dynamic disks in the pack have been marked excluded.


message_identifier: 0x00003035
message_string:
Volume Shadow Copy Warning: VSS spent %1 seconds trying to flush and hold the volume %2.  This might cause
problems when other volumes in the shadow-copy set timeout waiting for the release-writes phase, and it can cause
the shadow-copy creation to fail.  Trying again when disk activity is lower may solve this problem.
%3


message_identifier: 0x0000305d
message_string:
The LUN resynchronization operation failed because the Volume Shadow Copy Service was unable to enumerate 
the cluster resources. The Cluster service returned the following error %1. Check the system event log for
events related to the Cluster service.%n
%2


message_identifier: 0x0000a004
message_string:
ASR Error: Fail to include critical Virtual Hard Disk (VHD) #%1.
Reason:    The specified VHD is hosted on another VHD.


message_identifier: 0x0000305f
message_string:
The LUN resynchronization operation failed because one or more destination LUNs could not be
placed in maintenance mode. Check the system event log for events related to the Cluster service.%n
%1


message_identifier: 0x00002019
message_string:
Volume Shadow Copy Service error: VSS only supports multiple instances of writer
with class id %1 if the writer either does not require restore events or supplies an
instance name.
%2


message_identifier: 0x00002005
message_string:
Volume Shadow Copy Service error: ERROR_INSUFFICIENT_BUFFER expected error.  Actual Error was [%1].
%2


message_identifier: 0x00002006
message_string:
Volume Shadow Copy Service error: Unexpected error. Final buffer for call to GetTokenInformation was size = %1, original size was %2.
%3


message_identifier: 0x00002007
message_string:
Volume Shadow Copy Service error: Unexpected error performing QueryInterface from IXMLDOMNode to IXMLDOMElement.  hr = %1.
%2


message_identifier: 0x00002002
message_string:
Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = %1.
This is often caused by incorrect security settings in either the writer or requestor process.
%2


message_identifier: 0x00002003
message_string:
Volume Shadow Copy Service error: Internally transferred WRITER_COMPONENTS document is invalid.
%1


message_identifier: 0x0000201b
message_string:
Ran out of time while expanding file specification %1\%2.  This was being done
for the %3 subscriber.
%4


message_identifier: 0x0000201a
message_string:
Two instances of writer with class id %1 attempted to register with the same
instance name %2.
%3


message_identifier: 0x00002008
message_string:
Volume Shadow Copy Service error: An unexpected error was encountered examining the XML document.  The document is missing the %1 element.
%2


message_identifier: 0x00002009
message_string:
Volume Shadow Copy Service error: An unexpected error was encountered examining the XML document.  The document is missing the %1 attribute.
%2


message_identifier: 0x0000201e
message_string:
Shadow copy has been created.%n
%n
User SID:			%1%n
User name:			%2%n
Process ID:			%3%n
%n
Shadow Set ID:			%4%n
Shadow ID:			%5%n
Provider ID:			%6%n
Original Machine:		%7%n
Original Volume:			%8%n
Shadow device name:		%9%n


message_identifier: 0x0000201d
message_string:
The Backup Components XML document was rejected. In this case the reason could be that
it is not a Backup Components Document from a transportable shadow copy.
%1


message_identifier: 0x0000302a
message_string:
Volume Shadow Copy Warning: The hardware shadow-copy volume %1 disappeared unexpectedly.
Check for any event logs reported by Plug And Play, by the hardware provider, or by volsnap.
%2


message_identifier: 0x0000302b
message_string:
Volume Shadow Copy: Attempt to dismount the volume failed with %1.  Check the
system event log for more information.
%2


message_identifier: 0x0000302d
message_string:
Volume Shadow Copy Warning: The provider has reported a storage identifier that is not supported by VSS.
                 Codeset:     %1
                 Type:          %2
                 Size:           %3
                 NextOffset:  %4
                 Association: %5

This identifier will be skipped by VSS.
%6


message_identifier: 0x00003038
message_string:
Volume Shadow Copy Error: An error %1 was encountered while Registry Writer was preparing the registry for a shadow
copy.  Check the Application and System event logs for any related errors.
%2


message_identifier: 0x00003039
message_string:
Volume Shadow Copy Error: The Registry Writer experienced an out-of-space condition while preparing the registry for
a Shadow Copy.  Check the Application and System event logs for any related errors.
%1


message_identifier: 0x00003032
message_string:
Volume Shadow Copy Error: VSS spent more than %1 seconds trying to open and flush all the volumes in the shadow-
copy set.  This caused volume %2 to timeout waiting for the hold-writes phase of shadow-copy creation.  Trying again when
disk activity is lower may solve this problem.
%3


message_identifier: 0x00003033
message_string:
Volume Shadow Copy Warning: VSS spent %1 seconds trying to open and flush the volume %2.  This might cause
timeouts while flushing other volumes in the shadow-copy set, causing the shadow-copy creation to fail.  Trying again when
disk activity is lower may solve this problem.
%3


message_identifier: 0x00003031
message_string:
Volume Shadow Copy Error: After restarting the device %1, Plug and Play reports that a reboot is required.  This is an
unexpected situation.
%3


message_identifier: 0x00003036
message_string:
Volume Shadow Copy Error: An error %1 was encountered while trying to initialize the Registry Writer.  This may cause
future shadow-copy creations to fail.
%2


message_identifier: 0x00003037
message_string:
Volume Shadow Copy Error: An error %1 was encountered while Registry Writer was attempting to initialize itself.  This
may case a shadow-copy creation to fail.  Check the Application event log for any related errors.
%2


message_identifier: 0x00003034
message_string:
Volume Shadow Copy Error: VSS waited more than %1 seconds for all volumes to be flushed.  This caused volume %2
to timeout while waiting for the release-writes phase of shadow copy creation.  Trying again when disk activity is lower may
solve this problem.
%3


message_identifier: 0x00003006
message_string:
Volume Shadow Copy Service error: Error calling a routine on the Shadow Copy Provider %1. Routine returned E_INVALIDARG.
Routine details %2.
%3


message_identifier: 0x0000200d
message_string:
Volume Shadow Copy Service error: An error occured calling QueryInterface from IVssCoordinator to IVssShim.  hr = %1.


message_identifier: 0x0000200f
message_string:
Volume Shadow Copy Service error: An unexpected error was encountered when calling QueryInterface for IVssAsync.  hr = %1.
%2


message_identifier: 0x0000200a
message_string:
Volume Shadow Copy Service error: An unexpected error was encountered when QueryInterface for IDispatch was called.  hr = %1 attribute.
%2


message_identifier: 0x0000200b
message_string:
Volume Shadow Copy Service error: An unexpected error was encountered cloning a document.  The cloned document has no children.
%1


message_identifier: 0x00002013
message_string:
Volume Shadow Copy Service error: Writer with name %1 and ID %2 attempted to subscribe in safe mode.
%3


message_identifier: 0x00002017
message_string:
Volume Shadow Copy Service error: A component was added to the backup document that does not exist in any writer's metadata.
Ensure that only actual writer components are added to the backup document.
%1


message_identifier: 0x00002016
message_string:
Volume Shadow Copy Service error: The shadow copy writer could not communicate with the Shadow Copy publisher.
The shadow copy publisher (for example the backup application) might have terminated during the shadow copy process.
hr = %1.
%2


message_identifier: 0x00002015
message_string:
Volume Shadow Copy Service error: The process that hosts the writer with name %1 and ID %2 does not run under a user with sufficient access rights.
Consider running this process under a local account which is either Local System, Administrator, Network Service, or Local Service.
%3


message_identifier: 0x00002014
message_string:
Volume Shadow Copy Service: Writer with name %1 and ID %2 attempted to subscribe during setup.
%3


message_identifier: 0x00003059
message_string:
The following destination LUN could not be restarted after the LUN resynchronization operation.  Retry the operation.%n
%n
LUN ID			%1%n
%n
Version			%2%n
Device Type		%3%n
Device TypeModifier	%4%n
Command Queueing	%5%n
Bus Type		%6%n
Vendor Id		%7%n
Product Id		%8%n
Product Revision		%9%n
Serial Number		%10%n
%n
Storage Identifiers%n
%11%n
%n
%12


message_identifier: 0x0000303b
message_string:
Volume Shadow Copy Service error: An internal inconsistency was detected in trying
to contact shadow copy service writers.  The Registry Writer failed to respond to a query
from VSS. Check to see that the Event Service and Volume Shadow Copy Service
are operating properly, and please check the Application event log for any other events.
%1


message_identifier: 0x0000303c
message_string:
Volume Shadow Copy Service warning: VSS was denied access to the root of volume %1.
Denying administrators from accessing volume roots can cause many unexpected failures,
and will prevent VSS from functioning properly.  Check security on the volume, and try the
operation again.
%2


message_identifier: 0x0000303d
message_string:
Volume Shadow Copy Service warning: The writer spent too much time processing it's Freeze
notification.  This can cause this writer as well as other writers on the system time to time out
and fail shadow-copy creation.
%1


message_identifier: 0x0000303e
message_string:
When snapshot volume %1 was restarted in the system, the restart failed. The volume is no longer found in the system.%n
Try a rescan from Diskmgmt.msc and see if the volume appears.%n
If not, try restarting the disk device then rescan.
%2


message_identifier: 0x00003029
message_string:
Volume Shadow Copy Warning: A plug-and-play devnode could not be found for the volume while
attempting to restart or remove the associated device.  The function GetHiddenVolumeDevinfo failed with %1.
The operation will be continue, however some state associated with this volume may not be cleaned up.
%2


message_identifier: 0x00003028
message_string:
Volume Shadow Copy Warning: A timeout occurred while trying to bring the cluster resource %1 online.
This means that bringing the resource offline took longer than %2 seconds.
%3


message_identifier: 0x00003021
message_string:
Failed to connect to remote machine %1 for shadow copies management. Remote machine is unsupported: hr = %2.
This error indicates that the remote machine does not support shadow copies for shares. A common cause for this error
is that the remote machine is running a Windows version which doesn't support this capability.
%3


message_identifier: 0x00003020
message_string:
Failed to connect to remote machine %1 for shadow copies management. Remote machine denies access: hr = %2.
Make sure that the account running your local Volume Shadow Copy service is authorized for shadow copy management on the remote machine.
%3


message_identifier: 0x00003023
message_string:
Volume Shadow Copy Warning: A timeout was encountered while trying to freeze the Kernel Transaction Manager.
This means that one or more Resource Managers failed to commit within %1 seconds.  Check the System
event log for more information.
%2


message_identifier: 0x00003022
message_string:
Revert operation for volume %1 has begun.  Volume is being reverted to the shadow copy with id
%2.
%3


message_identifier: 0x00003025
message_string:
Volume Shadow Copy Warning: A timeout was encountered while trying to freeze the Distributed Transaction Manager.
This means that one or more Transaction Managers failed to commit within %1 seconds.  Check the event
logs for more information.
%2


message_identifier: 0x00003024
message_string:
Volume Shadow Copy Warning: A timeout was encountered while trying to thaw the Kernel Transaction Manager.
This means that the shadow-copy creation process took longer than %1 seconds.
%2


message_identifier: 0x00003027
message_string:
Volume Shadow Copy Warning: A timeout occured while trying to take the cluster resource %1 offline.
This means that taking the resource offline took longer than %2 seconds.
%3


message_identifier: 0x00003026
message_string:
Volume Shadow Copy Warning: A timeout was encountered while trying to thaw the Distributed Transaction Manager.
This means that the shadow-copy creation process took longer than %1 seconds.
%2


message_identifier: 0x0000300b
message_string:
Volume Shadow Copy Service error: One of the shadow copy providers returned an invalid number of committed shadow copies.
The expected number of committed shadow copies is %1. The detected number of committed shadow copies is %2.
%3


message_identifier: 0x0000300a
message_string:
Volume Shadow Copy Service error: The I/O writes cannot be held during the shadow copy creation period on volume %1.
The volume index in the shadow copy set is %2. Error details: Open[%3], Flush[%4], Release[%5], OnRun[%6].
%7


message_identifier: 0x0000300e
message_string:
Volume Shadow Copy Service error: An internal inconsistency was detected in trying
to contact shadow copy service writers.  Check to see that the Event Service
and Volume Shadow Copy Service are operating properly.
%1


message_identifier: 0x0000201f
message_string:
Hardware shadow copy imported.%n
%n
User SID:			%1%n
User name:			%2%n
Process ID:			%3%n
%n
Shadow Set ID:			%4%n
Shadow ID:			%5%n
Provider ID:			%6%n
Original Machine:		%7%n
Original Volume:			%8%n
Shadow device name:		%9%n


message_identifier: 0x00003016
message_string:
Volume Shadow Copy Service error: The shadow copy could not be committed - operation timed out.
Error context: %1.
%2


message_identifier: 0x00003010
message_string:
An error occurred trying to QI the IVssWriter event object for
IMultiInterfaceEventControl.  hr = %1
%2


message_identifier: 0x00000002
message_string:
Volume Shadow Copy Service initialization error: the control handler cannot be registered [%1].
%2


message_identifier: 0x0000b004
message_string:
This is the path to the boot BCD store and the boot managers.
All the files in this directory need to be backed up.


message_identifier: 0x0000301f
message_string:
Failed to connect to remote machine %1 for shadow copies management. Remote machine is unavailable: hr = %2.
Make sure that this remote machine and the local machine are both on the network.
%3


message_identifier: 0x00003003
message_string:
Volume Shadow Copy Service error: Error on creating/using the COM+ Writers publisher interface: %1 [%2].
%3


message_identifier: 0x00003007
message_string:
Volume Shadow Copy Service error: Wrong type %1 (should be %2) for the
Registry value %3 under the key %4.
%5


message_identifier: 0x00003005
message_string:
Volume Shadow Copy Service error: Error calling a routine on a Shadow Copy Provider %1. Routine details %2 [hr = %3].
%4


message_identifier: 0x00003004
message_string:
Volume Shadow Copy Service error: Error creating the Shadow Copy Provider COM class with CLSID %1 [%2].
%3


message_identifier: 0x00003009
message_string:
Volume Shadow Copy Service error: The I/O writes cannot be flushed during the shadow copy creation period on volume %1.
The volume index in the shadow copy set is %2. Error details: Open[%3], Flush[%4], Release[%5], OnRun[%6].
%7


message_identifier: 0x00003008
message_string:
Volume Shadow Copy Service error: The system may be low on resources.
Unexpected error at background thread creation
(_beginthreadex returns %1, errno = %2).
%3


message_identifier: 0x00001003
message_string:
Volume Shadow Copy Service error: Cannot install the component %1 into the COM+ application '%2' [%3].
%4


message_identifier: 0x00000fa3
message_string:
Volume Shadow Copy Service warning: Writer received a Freeze event more than two minutes ago.
The writer is still waiting for either an Abort or a Thaw event.
%1


message_identifier: 0x00000fa2
message_string:
Volume Shadow Copy Service error: Cannot create multiple shadow copies on the same volume (%1)
%2


message_identifier: 0x00000fa1
message_string:
Volume Shadow Copy Service error: Cannot find diff areas for creating shadow copies.
Add at least one NTFS drive to the system with enough free space.
The free space needed is at least %1 Mb for each volume to be shadow copied.
%2


message_identifier: 0x00000fa4
message_string:
Volume Shadow Copy Service warning: The sector size of the diff area volume %1 cannot be larger than the sector size of the original volume %2
%3


message_identifier: 0x0000000b
message_string:
Volume Shadow Copy Service information: The COM Server with CLSID %1 and name %2 cannot be started.
Most likely the CPU is under heavy load. [%3]
%4


message_identifier: 0x0000000c
message_string:
Volume Shadow Copy Service information: The COM Server with CLSID %1 and name %2 cannot be started.
Most likely the server is in the process of shutting down or the system is out of memory. [%3]
%4


message_identifier: 0x0000000f
message_string:
The user name %1 specified in registry (%2) does not map to a real user name. The entry is ignored.
It must have a valid username as name, be of type REG_DWORD, and value either '0' or '1'.
%3


message_identifier: 0x0000000d
message_string:
Volume Shadow Copy Service information: The COM Server with CLSID %1 and name %2 cannot be started. [%3]
%4


message_identifier: 0x0000100e
message_string:
Volume Shadow Copy Service error: Cannot attach the catalog object to the COM+ application [%1].
%2


message_identifier: 0x0000a005
message_string:
ASR Error: Fail to include critical dynamic pack.
Reason:    The dynamic pack consists of a Virtual Hard Disk (VHD) #%1.


message_identifier: 0x00000001
message_string:
Volume Shadow Copy Service initialization error: the control dispatcher cannot be started [%1].
%2


message_identifier: 0x00000005
message_string:
Volume Shadow Copy Service initialization error: could not retrieve backup/restore privilege [%1].
%2


message_identifier: 0x00001002
message_string:
Volume Shadow Copy Service error: Cannot install the event class %1 into the COM+ application '%2' [%3].
%4


message_identifier: 0x00001005
message_string:
Volume Shadow Copy Service error: Cannot obtain the collection '%1' from the COM+ catalog [%2].
%3


message_identifier: 0x00001004
message_string:
Volume Shadow Copy Service error: Cannot create service '%1' for the COM+ application '%2' [%3].
%4


message_identifier: 0x00003065
message_string:
The LUN resynchronization operation failed before calling the hardware provider.  As a result, some destination LUNs may be offline.  
To retry the resynchronization, bring the destination LUNs online and retry the operation.
%1


message_identifier: 0x00003067
message_string:
The LUN resynchronization operation failed after calling the hardware provider.  The data on the destination LUNs is
probably intact. However, the LUNs may have incorrect disk signatures.  To retry the resynchronization, recreate the destination LUNs
and retry the operation.
%1


message_identifier: 0x00003066
message_string:
The LUN resynchronization operation failed during a call to the hardware provider.  The destination LUNs are in an unknown
state, and their contents should be discarded.  To retry the resynchronization, repair the destination LUNs if needed, bring
them online, and retry the operation.
%1


message_identifier: 0x00003060
message_string:
The LUN resynchronization operation failed because one or more destination LUNs could not be
removed from maintenance mode. Check the system event log for events to the Cluster service.%n
%1


message_identifier: 0x00003063
message_string:
Resynchronization of a Shadow Copy to a destination disk has completed.%n
%n
User SID:			%1%n
User name:			%2%n
Process ID:			%3%n
%n
Provider ID:			%4%n
Source Shadow Copy:		%5%n
Pre-Resync Volume:		%6%n
Pre-Resync Disk no:		%7%n
Post-Resync Volume:		%8%n
Post-Resync Disk no:		%9%n


message_identifier: 0x00003062
message_string:
The LUN resynchronization operation failed because volume %1 on destination disk %2 is not included
in the recovery set. %n
Include the missing volume and a corresponding shadow copy to the recovery set, or force the 
resynchronization by using the VSS_RECOVERY_NO_VOLUME_CHECK flag.%n
%3


# message_table_181_0x00000409

message_identifier: 0x800003e8
message_string:
Unable to open the System process performance objects. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0xc00007d0
message_string:
Unable to collect system process performance information. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0xc00007d1
message_string:
Unable to collect process virtual memory information. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0x800007d3
message_string:
Unable to query the job object %1 for its accounting info. The calling process may not have permission to query this job. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0x800007d2
message_string:
Unable to open the job object %1 for query access. The calling process may not have permission to open this job. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0x800007d5
message_string:
Unable to query the job object %1 for its process IDs The calling process may not have permission to query this job. The first four bytes (DWORD) of the Data section contains the status code.


message_identifier: 0x800007d4
message_string:
Unable to query the %1 object directory to look for job objects. The calling process may not have permission to perform this query. The first four bytes (DWORD) of the Data section contains the status code.


# message_table_182_0x00000409

message_identifier: 0xc00007d1
message_string:
Unable to read the "First Counter" value under the usbperf\Performance Key. Status codes returned in data.


message_identifier: 0xc00007d2
message_string:
Unable to read the "First Help" value under the usbperf\Performance Key. Status codes returned in data.


# message_table_185_0x00000409

message_identifier: 0x0000022f
message_string:
IPSec main mode security association ended.%n
Keying module type: %1%n
Local address: %2%n
Remote address: %3%n
Local port: %4%n
Remote port: %5%n
Peer private address: %6%n
Main mode SA LUID: %7%n


message_identifier: 0x0000022d
message_string:
IPSec main mode security association establishment failed.%n
Keying module type: %1%n
Local address: %2%n
Remote address: %3%n
Local port: %4%n
Remote port: %5%n
Peer private address: %6%n
Main mode authentication method: %7%n
Main mode my Id: %8%n
Main mode peer Id: %9%n
Failure point: %10%n
Failure reason: %11%n
Main mode IKE state: %12%n
Initiator or Responder: %13%n
Main mode impersonation: %14%n


message_identifier: 0x0000022e
message_string:
IPSec quick mode security association establishment failed.%n
Keying module type: %1%n
Local address: %2%n
Local address mask: %3%n
Remote address: %4%n
Remote address mask: %5%n
Local port: %6%n
Remote port: %7%n
Protocol: %8%n
Encapsulation type: %9%n
Failure point: %10%n
Failure reason: %11%n
Quick mode IKE state: %12%n
Initiator or Responder: %13%n
Main mode SA LUID: %14%n


message_identifier: 0x0000022b
message_string:
IPSec main mode security association established. User mode is not configured.%n
Keying module type: %1%n
Local address: %2%n
Remote address: %3%n
Local port: %4%n
Remote port: %5%n
Peer private address: %6%n
Main mode authentication method: %7%n
Main mode peer subject: %n%8%n
Main mode peer issuing certificate authority: %n%9%n
Main mode peer root certificate authority: %n%10%n
Main mode peer SHA thumbprint: %n%11%n
Main mode my subject: %n%12%n
Main mode my SHA thumbprint: %n%13%n
Cipher algorithm: %14%n
Integrity algorithm: %15%n
Lifetime (seconds): %16%n
Main mode impersonation: %17%n
Main mode SA LUID: %18%n


message_identifier: 0x0000022c
message_string:
IPSec main mode security association establishment failed.%n
Keying module type: %1%n
Local address: %2%n
Remote address: %3%n
Local port: %4%n
Remote port: %5%n
Peer private address: %6%n
Main mode authentication method: %7%n
Main mode peer subject: %n%8%n
Main mode peer issuing certificate authority: %n%9%n
Main mode peer root certificate authority: %n%10%n
Main mode peer SHA thumbprint: %n%11%n
Main mode my subject: %n%12%n
Main mode my SHA thumbprint: %n%13%n
Failure point: %14%n
Failure reason: %15%n
Main mode IKE state: %16%n
Initiator or Responder: %17%n
Main mode impersonation: %18%n


message_identifier: 0x0000022a
message_string:
IPSec main mode security association established. User mode is not configured.%n
Keying module type: %1%n
Local address: %2%n
Remote address: %3%n
Local port: %4%n
Remote port: %5%n
Peer private address: %6%n
Main mode authentication method: %7%n
Main mode my Id: %8%n
Main mode peer Id: %9%n
Cipher algorithm: %10%n
Integrity algorithm: %11%n
Lifetime (seconds): %12%n
Main mode impersonation: %13%n
Main mode SA LUID: %14%n


message_identifier: 0x000002b4
message_string:
Basic Application Group Non-Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000259
message_string:
Attempt to install service:%n
%tService Name:%t%1%n
%tService File Name:%t%2%n
%tService Type:%t%3%n
%tService Start Type:%t%4%n
%tService Account:%t%5%n
By:%n
%tUser Name:%t%6%n
%tDomain:%t%t%7%n
%tLogon ID:%t%t%8%n


message_identifier: 0x00000258
message_string:
A process was assigned a primary token.%n
Assigning Process Information:%n
%tProcess ID:%t%1%n
%tImage File Name:%t%2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
New Process Information:%n
%tProcess ID:%t%6%n
%tImage File Name:%t%7%n
%tTarget User Name:%t%8%n
%tTarget Domain:%t%9%n
%tTarget Logon ID:%t%10%n


message_identifier: 0x000003a3
message_string:
The Windows Firewall was unable to retrieve the security policy from the local storage. The Windows Firewall will continue enforcing the current enforced policy.
%n
Error Code: %1


message_identifier: 0x00000253
message_string:
Indirect access to an object has been obtained:%n
%tObject Type:%t%1%n
%tObject Name:%t%2%n
%tProcess ID:%t%3%n
%tPrimary User Name:%t%4%n
%tPrimary Domain:%t%5%n
%tPrimary Logon ID:%t%6%n
%tClient User Name:%t%7%n
%tClient Domain:%t%8%n
%tClient Logon ID:%t%9%n
%tAccesses:%t%10%n
%tAccess Mask:%t%11%n


message_identifier: 0x00000252
message_string:
A handle to an object has been duplicated:%n
%tSource Handle ID:%t%1%n
%tSource Process ID:%t%2%n
%tTarget Handle ID:%t%3%n
%tTarget Process ID:%t%4%n


message_identifier: 0x00000251
message_string:
A process has exited:%n
%tProcess ID:%t%1%n
%tImage File Name:%t%2%n
%tUser Name:%t%3%n
%tDomain:%t%t%4%n
%tLogon ID:%t%t%5%n
%tExit Status:%t%t%6%n


message_identifier: 0x00000250
message_string:
A new process has been created:%n
%tNew Process ID:%t%1%n
%tImage File Name:%t%2%n
%tCreator Process ID:%t%3%n
%tUser Name:%t%4%n
%tDomain:%t%t%5%n
%tLogon ID:%t%t%6%n
%tToken Elevation Type:%t%7%n


message_identifier: 0x00000257
message_string:
Unprotection of auditable protected data.
%n
%tData Description:%t%t%2%n
%tKey Identifier:%t%t%1%n
%tProtected Data Flags:%t%3%n
%tProtection Algorithms:%t%4%n
%tFailure Reason:%t%t%5%n
By:%n
%t  User Name:%t%6%n
%t  Domain Name:%t%7%n
%t  Logon ID:%t%8


message_identifier: 0x00000256
message_string:
Protection of auditable protected data.
%n
%tData Description:%t%t%2%n
%tKey Identifier:%t%t%1%n
%tProtected Data Flags:%t%3%n
%tProtection Algorithms:%t%4%n
%tFailure Reason:%t%t%5%n
By:%n
%t  User Name:%t%6%n
%t  Domain Name:%t%7%n
%t  Logon ID:%t%8


message_identifier: 0x00000255
message_string:
Recovery of data protection master key.
%n
%tKey Identifier:%t%t%1%n
%tRecovery Reason:%t%t%3%n
%tRecovery Server:%t%t%2%n
%tRecovery Key ID:%t%t%4%n
%tFailure Reason:%t%t%5%n
By:%n
%t  User Name:%t%6%n
%t  Domain Name:%t%7%n
%t  Logon ID:%t%8


message_identifier: 0x00000254
message_string:
Backup of data protection master key.
%n
%tKey Identifier:%t%t%1%n
%tRecovery Server:%t%t%2%n
%tRecovery Key ID:%t%t%3%n
%tFailure Reason:%t%t%4%n
By:%n
%t  User Name:%t%5%n
%t  Domain Name:%t%6%n
%t  Logon ID:%t%7


message_identifier: 0x00000323
message_string:
Certificate Services template updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%8%n%nNew Template Content:%n%7


message_identifier: 0x00000322
message_string:
Certificate Services template:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nTemplate Content:%n%7%nSecurity Descriptor:%n%8


message_identifier: 0x00000320
message_string:
One or more rows have been deleted from the certificate database.%n
%n
Table ID:%t%1%n
Filter:%t%2%n
Rows Deleted:%t%3


message_identifier: 0x00000327
message_string:
Per user auditing policy set for user:%n
%tTarget user:%t%1%n
%tPolicy ID:%t%2%n
%tCategory Settings:%n
%t System:%t%3%n
%t Logon:%t%4%n
%t Object Access%t%5%n
%t Privilege Use:%t%6%n
%t Detailed Tracking:%t%7%n
%t Policy Change:%t%8%n
%t Account Management:%t%9%n
%t DS Access:%t%10%n
%t Account Logon:%t%11%n


message_identifier: 0x00000325
message_string:
Configuration of security log for this session:
%tMaximum Log Size (KB): %1%n
%tAction to take on reaching max log size: %2%n
%tEvent age limit in days: %3%n


message_identifier: 0x00000324
message_string:
Certificate Services template security updated:%n%1 v%2 (Schema V%3)%n%4%n%5%n%nDomain Controller:%t%6%n%nOld Template Content:%n%9%nOld Security Descriptor:%n%10%n%nNew Template Content:%n%7%nNew Security Descriptor:%n%8


message_identifier: 0x00000329
message_string:
A security event source has attempted to unregister.%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tSource Name:%t%7%n
%tProcess Id:%t%8%n
%tEvent Source Id:%t%9%n
%tImage File Name:%t%10%n


message_identifier: 0x00000328
message_string:
A security event source has attempted to register.%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tSource Name:%t%7%n
%tProcess Id:%t%8%n
%tEvent Source Id:%t%9%n
%tImage File Name:%t%10%n


message_identifier: 0x000002c1
message_string:
Workstation is unlocked:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession ID:%t%4%n


message_identifier: 0x000002c0
message_string:
Workstation is locked:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession ID:%t%4%n


message_identifier: 0x000002c3
message_string:
Screen saver is dismissed:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession ID:%t%4%n


message_identifier: 0x000002c2
message_string:
Screen saver is invoked:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession ID:%t%4%n


message_identifier: 0x0000035d
message_string:
Windows Firewall did not apply the following rule:
%nRule:
%n     Id:%1
%n     Name:%2
%nReason: %3 resolved to an empty set.


message_identifier: 0x0000035e
message_string:
Windows Firewall did not apply the following rule:
%nRule:
%n     Id:%1
%n     Name:%2
%nError: %3
%nReason: %4


message_identifier: 0x000003b9
message_string:
An IPSec Security Association was deleted.
%n
%nProfile changed: %1
%nDeleted SA:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003a5
message_string:
The Windows Firewall failed to initialize the driver. The Windows Firewall will continue to enforce current policy.
%n
Error Code: %1


message_identifier: 0x0000025a
message_string:
Scheduled Task created:%n
%tFile Name:%t%1%n
%tCommand:%t%2%n
%tTriggers:%t%t%3%n
%tTime:%t%t%4 %5%n
%tFlags:%t%t%6%n
%tTarget User:%t%7%n
By:%n
%tUser:%t%t%8%n
%tDomain:%t%t%9%n
%tLogon ID:%t%t%10%n


message_identifier: 0x00000318
message_string:
Certificate Services denied a certificate request.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


message_identifier: 0x00000319
message_string:
Certificate Services set the status of a certificate request to pending.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


message_identifier: 0x00000311
message_string:
Certificate Services stopped.%n
%n
Certificate Database Hash:%t%1%n
Private Key Usage Count:%t%2%n
CA Certificate Hash:%t%3%n
CA Public Key Hash:%t%4


message_identifier: 0x00000228
message_string:
Logon attempt using explicit credentials:%n
Logged on user:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon GUID:%t%4%n
User whose credentials were used:%n
%tTarget User Name:%t%5%n
%tTarget Domain:%t%6%n
%tTarget Logon GUID: %7%n%n
Target Server Name:%t%8%n
Target Server Info:%t%9%n
Caller Process ID:%t%10%n
Source Network Address:%t%11%n
Source Port:%t%12%n
Caller Process Name:%t%13%n


message_identifier: 0x00000229
message_string:
%tUser Name:%t%1%n
%tDomain:%t%%t%2%n
%tRequest Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID: %10%n
%tTransited Services: %11%n
%tCaller Process Name:%t%12%n


message_identifier: 0x00000224
message_string:
Logon Failure:%n
%tReason:%t%tDomain sid inconsistent%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6
%tTransited Services:%t%7%n


message_identifier: 0x00000225
message_string:
Logon Failure:%n
%tReason: %tAll sids were filtered out%n
%tUser Name:%t%1%n
%tDomain:%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package%t: %5%n
%tWorkstation Name:%t%6


message_identifier: 0x00000222
message_string:
IKE security association establishment failed because peer
sent invalid proposal.%n
Mode: %n%1%n
Filter: %n%2%n
Attribute: %n%3%n
Expected value: %n%4%n
Received value: %n%5%n


message_identifier: 0x00000223
message_string:
IKE security association negotiation failed.%n
Mode: %n%1%n
Filter: %n%2%n
Peer Identity: %n%3%n
Failure Point: %n%4%n
Failure Reason: %n%5%n
Extra Status: %n%6%n


message_identifier: 0x00000220
message_string:
IKE security association establishment failed because peer could not authenticate.
The certificate trust could not be established.%n
Peer Identity: %n%1%n
Filter: %n%2%n


message_identifier: 0x00000356
message_string:
A Windows Firewall setting has changed.
%n
%nProfile changed: %1
%nNew Setting:
%n    Type: %2
%n    Value: %3


message_identifier: 0x00000357
message_string:
A rule has been ignored because its major version number was not recognized by Windows Firewall.
%n
%nProfile: %1
%nIgnored Rule:
%n     Id:%2
%n     Name:%3


message_identifier: 0x00000354
message_string:
A change has been made to Windows Firewall exception list. A rule was deleted.
%n
%nProfile changed: %1
%nDeleted Rule:
%n    Rule Id: %2
%n    Rule Name: %3


message_identifier: 0x00000352
message_string:
A change has been made to Windows Firewall exception list. A rule was added.
%n
%nProfile changed: %1
%nAdded Rule:
%n    Rule Id: %2
%n    Rule Name: %3


message_identifier: 0x00000353
message_string:
A change has been made to Windows Firewall exception list. A rule was modified.
%n
%nProfile changed: %1
%nModified Rule:
%n    Rule Id: %2
%n    Rule Name: %3


message_identifier: 0x00000350
message_string:
The following policy was active when the Windows Firewall started.
%n
%nGroup Policy applied: %1
%nProfile used: %2
%nOperational mode: %3
%nAllow remote administration: %4
%nAllow unicast responses to multicast/broadcast traffic: %5
%nSecurity Logging:
%n     Log dropped packets: %6
%n     Log successful connections %7


message_identifier: 0x000002b8
message_string:
LDAP Query Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000351
message_string:
A rule was listed when the Windows Firewall started.
%n
%nProfile used: %1
%nRule:
%n    Rule Id: %2
%n    Rule Name: %3


message_identifier: 0x000003b1
message_string:
A change has been made to IPSec settings. An Authentication Set was modified.
%n
%nProfile changed: %1
%nModified Authentication Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x00000358
message_string:
A rule has been partially ignored because its minor version number was not recognized by Windows Firewall.
%n
%nProfile: %1
%nPartially Ignored Rule:
%n     Id:%2
%n     Name:%3


message_identifier: 0x00000343
message_string:
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tDest. Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


message_identifier: 0x0000032b
message_string:
Auditing settings on object changed:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tProcess ID:%t%5%n
%tImage File Name:%t%6%n%n
%tPrimary User Name:%t%7%n
%tPrimary Domain:%t%8%n
%tPrimary Logon ID:%t%9%n
%tClient User Name:%t%10%n
%tClient Domain:%t%11%n
%tClient Logon ID:%t%12%n
%tOriginal Security Descriptor:%t%13%n
%tNew Security Descriptor:%t%14%n


message_identifier: 0x000003b0
message_string:
A change has been made to IPSec settings. An Authentication Set was added.
%n
%nProfile changed: %1
%nAdded Authentication Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003b7
message_string:
A change has been made to IPSec settings. A Crypto Set was modified.
%n
%nProfile changed: %1
%nModified Crypto Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x00000371
message_string:
During IPSec quick mode SA negotiation, IKE/Authip received an invalid ISAKMP packet.  This could indicate a poor network condition or an attempt to modify or replay this negotiation.
Local address: %1%n
Local address mask: %2%n
Remote address: %3%n
Remote address mask: %4%n
Local port: %5%n
Remote port: %6%n
Protocol: %7%n
Encapsulation type: %8%n


message_identifier: 0x00000310
message_string:
Certificate Services started.%n
%n
Certificate Database Hash:%t%1%n
Private Key Usage Count:%t%2%n
CA Certificate Hash:%t%3%n
CA Public Key Hash:%t%4


message_identifier: 0x000003b6
message_string:
A change has been made to IPSec settings. A Crypto Set was added.
%n
%nProfile changed: %1
%nAdded Crypto Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x00000300
message_string:
Namespace collision detected:%n
%tTarget type:%t%1%n
%tTarget name:%t%2%n
%tForest Root:%t%3%n
%tTop Level Name:%t%4%n
%tDNS Name:%t%5%n
%tNetBIOS Name:%t%6%n
%tSID:%t%t%7%n
%tNew Flags:%t%8%n


message_identifier: 0x0000020d
message_string:
Administrator recovered system from CrashOnAuditFail. LSA will now accept non-administrative logons.
Some auditable activity might not have been recorded.%n
%tValue of CrashOnAuditFail:%t%1%n


message_identifier: 0x0000020e
message_string:
A security package has been loaded by the Local Security Authority.
%n
Security Package Name:%t%1


message_identifier: 0x000002b9
message_string:
Password Policy Checking API is called:%n
%tCaller Username:%t%1%n
%tCaller Domain:%t%2%n
%tCaller Logon ID:%t%3%n
%tCaller Workstation:%t%4%n
%tProvided User Name (unauthenticated):%t%5%n
%tStatus Code:%t%6%n


message_identifier: 0x00000368
message_string:

Windows Filtering Platform has permitted a connection to take place.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tProtocol:%t%5%n
%tDestination Address:%t%6%n
%tDestination Port:%t%7%n
%tDirection:%t%8%n
%tFilter run-time ID:%t%9%n
%tLayer:%t%10%n


message_identifier: 0x00000342
message_string:
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tSource Addr:%t%3%n
%tNaming Context:%t%4%n
%tOptions:%t%5%n
%tStatus Code:%t%6%n


message_identifier: 0x00000239
message_string:
Application client context creation attempt:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient Context ID:%t%5%n
%tStatus:%t%6%n


message_identifier: 0x00000238
message_string:
Hard link creation attempt:%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tFile Name:%t%4%n
%tLink Name:%t%5%n


message_identifier: 0x00000235
message_string:
Object Open:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t{%5,%6}%n
%tProcess ID:%t%7%n
%tProcess Name:%t%8%n
%tPrimary User Name:%t%9%n
%tPrimary Domain:%t%10%n
%tPrimary Logon ID:%t%11%n
%tClient User Name:%t%12%n
%tClient Domain:%t%13%n
%tClient Logon ID:%t%14%n
%tAccesses:%t%15%n
%tPrivileges:%t%16%n%n
%tProperties:%n%17%n
%tAccess Mask:%t%18%n


message_identifier: 0x00000234
message_string:
Object Deleted:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tProcess ID:%t%3%n
%tImage File Name:%t%4%n


message_identifier: 0x00000237
message_string:
Object Access Attempt:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tObject Type:%t%3%n
%tProcess ID:%t%4%n
%tImage File Name:%t%5%n
%tAccesses:%t%6%n
%tAccess Mask:%t%7%n
%tObject Name:%t%8%n
%tPrimary User Name:%t%9%n
%tPrimary Domain:%t%10%n
%tPrimary Logon ID:%t%11%n
%tClient User Name:%t%12%n
%tClient Domain:%t%13%n
%tClient Logon ID:%t%14%n


message_identifier: 0x00000236
message_string:
Object Operation:%n
%tObject Server:%t%1%n
%tOperation Type:%t%2%n
%tObject Type:%t%3%n
%tObject Name:%t%4%n
%tHandle ID:%t%5%n
%tPrimary User Name:%t%6%n
%tPrimary Domain:%t%7%n
%tPrimary Logon ID:%t%8%n
%tClient User Name:%t%9%n
%tClient Domain:%t%10%n
%tClient Logon ID:%t%11%n
%tAccesses:%t%12%n
%tProperties:%n%t%13%n
%tAdditional Info:%t%14%n
%tAdditional Info2:%t%15%n
%tAccess Mask:%t%16%n


message_identifier: 0x00000230
message_string:
Object Open:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t%5%n
%tProcess ID:%t%6%n
%tImage File Name:%t%7%n
%tPrimary User Name:%t%8%n
%tPrimary Domain:%t%9%n
%tPrimary Logon ID:%t%10%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n
%tAccesses:%t%14%n
%tPrivileges:%t%15%n
%tRestricted Sid Count:%t%16%n
%tAccess Mask:%t%17%n


message_identifier: 0x00000233
message_string:
Object Open for Delete:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tOperation ID:%t{%5,%6}%n
%tProcess ID:%t%7%n
%tPrimary User Name:%t%8%n
%tPrimary Domain:%t%9%n
%tPrimary Logon ID:%t%10%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n
%tAccesses:%t%t%14%n
%tPrivileges:%t%t%15%n
%tAccess Mask:%t%16%n


message_identifier: 0x00000232
message_string:
Handle Closed:%n
%tObject Server:%t%1%n
%tHandle ID:%t%2%n
%tProcess ID:%t%3%n
%tImage File Name:%t%4%n


message_identifier: 0x000002a6
message_string:
Account Mapped for Logon.%n
Mapping Attempted By:%n
%t%1%n
Client Name:%n
%t%2%n
%tMapped Name:%n
%t%3%n


message_identifier: 0x000002a5
message_string:
Service Ticket Request Failed:%n
%tUser Name:%t%1%n
%tUser Domain:%t%2%n
%tService Name:%t%3%n
%tTicket Options:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n


message_identifier: 0x000002a4
message_string:
Authentication Ticket Request Failed:%n
%tUser Name:%t%1%n
%tSupplied Realm Name:%t%2%n
%tService Name:%t%3%n
%tTicket Options:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n


message_identifier: 0x000002a3
message_string:
Pre-authentication failed:%n
%tUser Name:%t%1%n
%tUser ID:%t%t%2%n
%tService Name:%t%3%n
%tPre-Authentication Type:%t%4%n
%tFailure Code:%t%5%n
%tClient Address:%t%6%n
%tCertificate Issuer Name:%t%7%n
%tCertificate Serial Number:%t%8%n
%tCertificate Thumbprint:%t%9%n


message_identifier: 0x000002a2
message_string:
Service Ticket Renewed:%n
%tUser Name:%t%1%n
%tUser Domain:%t%2%n
%tService Name:%t%3%n
%tService ID:%t%4%n
%tTicket Options:%t%5%n
%tTicket Encryption Type:%t%6%n
%tClient Address:%t%7%n


message_identifier: 0x000002a1
message_string:
Service Ticket Request:%n
%tUser Name:%t%t%1%n
%tUser Domain:%t%t%2%n
%tService Name:%t%t%3%n
%tService ID:%t%t%4%n
%tTicket Options:%t%t%5%n
%tTicket Encryption Type:%t%6%n
%tClient Address:%t%t%7%n
%tFailure Code:%t%t%8%n
%tLogon GUID:%t%t%9%n
%tTransited Services:%t%10%n


message_identifier: 0x000002a0
message_string:
Authentication Ticket Request:%n
%tUser Name:%t%t%1%n
%tSupplied Realm Name:%t%2%n
%tUser ID:%t%t%t%3%n
%tService Name:%t%t%4%n
%tService ID:%t%t%5%n
%tTicket Options:%t%t%6%n
%tResult Code:%t%t%7%n
%tTicket Encryption Type:%t%8%n
%tPre-Authentication Type:%t%9%n
%tClient Address:%t%t%10%n
%tCertificate Issuer Name:%t%11%n
%tCertificate Serial Number:%t%12%n
%tCertificate Thumbprint:%t%13%n


message_identifier: 0x00000349
message_string:
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tObject:%t%3%n
%tOptions:%t%4%n
%tStatus Code:%t%5%n


message_identifier: 0x00000361
message_string:

IPSec inbound packet replay check failed:%n
%tPacket Source:%t%1%n
%tInbound SA:%t%2%n 
%tNumber of Packets:%t%3%n
Received packet from over a security association with a sequence number for a packet already processed by the system.This could be a temporary problem; if it persists it may indicate a replay attack against the system.%n


message_identifier: 0x0000028a
message_string:
Security Disabled Local Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000028b
message_string:
Security Disabled Local Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000028c
message_string:
Security Disabled Local Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x0000028d
message_string:
Security Disabled Global Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x0000028e
message_string:
Security Disabled Global Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x0000028f
message_string:
Security Disabled Global Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000360
message_string:
IPSec inbound packet integrity check failed:%n
%tPacket Source:%t%1%n
%tInbound SA:%t%2%n
%tNumber Of Packets:%t%3%n
Received packet from over a security association that failed data integrity verification. This could be a temporary problem; if it persists it may indicate either a poor network condition or that packets are being modified in transit to the system.%n


message_identifier: 0x0000023e
message_string:
Security on object changed:%n
%tObject Server:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tHandle ID:%t%4%n
%tProcess ID:%t%5%n
%tImage File Name:%t%6%n%n
%tPrimary User Name:%t%7%n
%tPrimary Domain:%t%8%n
%tPrimary Logon ID:%t%9%n
%tClient User Name:%t%10%n
%tClient Domain:%t%11%n
%tClient Logon ID:%t%12%n
%tOriginal Security Descriptor:%t%13%n
%tNew Security Descriptor:%t%14%n


message_identifier: 0x0000023d
message_string:
%nApplication-specific security event.%n
%tEvent Source:%t%1%n
%tEvent ID:%t%2%n
%t%t%3%n
%t%t%4%n
%t%t%5%n
%t%t%6%n
%t%t%7%n
%t%t%8%n
%t%t%9%n
%t%t%10%n
%t%t%11%n
%t%t%12%n
%t%t%13%n
%t%t%14%n
%t%t%15%n
%t%t%16%n
%t%t%17%n
%t%t%18%n
%t%t%19%n
%t%t%20%n
%t%t%21%n
%t%t%22%n
%t%t%23%n
%t%t%24%n
%t%t%25%n
%t%t%26%n
%t%t%27%n


message_identifier: 0x0000023a
message_string:
Application operation attempt:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tObject Name:%t%3%n
%tScope Names:%t%4%n
%tClient Name:%t%5%n
%tClient Domain:%t%6%n
%tClient Context ID:%t%7%n
%tRole:%t%8%n
%tGroups:%t%9%n
%tOperation Name:%t%10 (%11)%n


message_identifier: 0x0000023c
message_string:
Application Initialized%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient ID:%t%5%n
%tPolicy Store URL:%t%6%n


message_identifier: 0x0000023b
message_string:
Application client context deletion:%n
%tApplication Name:%t%1%n
%tApplication Instance ID:%t%2%n
%tClient Name:%t%3%n
%tClient Domain:%t%4%n
%tClient Context ID:%t%5%n


message_identifier: 0x00000202
message_string:
An authentication package has been loaded by the Local Security Authority.
This authentication package will be used to authenticate logon attempts.
%n
Authentication Package Name:%t%1


message_identifier: 0x00000203
message_string:
A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.
%n
%n
%tLogon Process Name:%t%1%n
%tCaller User Name:%t%2%n
%tCaller Domain:%t%3%n
%tCaller Logon ID:%t%4%n


message_identifier: 0x00000204
message_string:
Internal resources allocated for the queuing of audit messages have been exhausted,
leading to the loss of some audits.
%n
%tNumber of audit messages discarded:%t%1


message_identifier: 0x00000205
message_string:
The audit log was cleared
%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tClient Process ID:%t%7%n


message_identifier: 0x00000206
message_string:
An notification package has been loaded by the Security Account Manager.
This package will be notified of any account or password changes.
%n
Notification Package Name:%t%1


message_identifier: 0x00000207
message_string:
Invalid use of LPC port.%n
%tProcess ID: %1%n
%tImage File Name: %2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
%tClient User Name:%t%6%n
%tClient Domain:%t%7%n
%tClient Logon ID:%t%8%n
%tInvalid use: %9%n
%tServer Port Name:%t%10%n


message_identifier: 0x00000208
message_string:
The system time was changed.%n
Process ID:%t%t%1%n
Process Name:%t%t%2%n
Primary User Name:%t%3%n
Primary Domain:%t%t%4%n
Primary Logon ID:%t%t%5%n
Client User Name:%t%t%6%n
Client Domain:%t%t%7%n
Client Logon ID:%t%t%8%n
Previous Time:%t%t%10 %9%n
New Time:%t%t%12 %11%n


message_identifier: 0x00000209
message_string:
Unable to log events to security log:%n
%tStatus code:%t%t%1%n
%tValue of CrashOnAuditFail:%t%2%n
%tNumber of failed audits:%t%3%n


message_identifier: 0x00000372
message_string:
During IPSec user mode SA negotiation, Authip received an invalid ISAKMP packet.  This could indicate a poor network condition or an attempt to modify or replay this negotiation.
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n


message_identifier: 0x00000373
message_string:
IPSec main mode and user mode security associations established.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
Main mode authentication method: %6%n
Main mode my Id: %7%n
Main mode Peer Id: %8%n
Cipher algorithm: %9%n
Integrity algorithm: %10%n
Lifetime (seconds): %11%n
Main mode impersonation: %12%n
Main mode SA LUID: %13%n%n
User mode authentication method: %14%n
User mode my Id: %15%n
User mode peer Id: %16%n
User mode impersonation: %17%n


message_identifier: 0x00000374
message_string:
IPSec main mode and user mode security associations established.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
Main mode authentication method: %6%n
Main mode my Id: %7%n
Main mode peer Id: %8%n
Cipher algorithm: %9%n
Integrity algorithm: %10%n
Lifetime (seconds): %11%n
Main mode impersonation: %12%n
Main mode SA LUID: %13%n%n
User mode authentication method: %14%n
User mode peer subject: %n%15%n
User mode peer issuing certificate authority: %n%16%n
User mode peer root certificate authority: %n%17%n
User mode peer SHA thumbprint: %n%18%n
User mode my subject: %n%19%n
User mode my SHA thumbprint: %n%20%n
User mode impersonation: %21%n


message_identifier: 0x00000375
message_string:
IPSec main mode and user mode security associations established.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
Main mode authentication method: %6%n
Main mode peer subject: %n%7%n
Main mode peer issuing certificate authority: %n%8%n
Main mode peer root certificate authority: %n%9%n
Main mode peer SHA thumbprint: %n%10%n
Main mode my subject: %n%11%n
Main mode my SHA thumbprint: %n%12%n
Cipher algorithm: %13%n
Integrity algorithm: %14%n
Lifetime (seconds): %15%n
Main mode impersonation: %16%n
Main mode SA LUID: %17%n%n
User mode authentication method: %18%n
User mode my Id: %19%n
User mode peer Id: %20%n
User mode impersonation: %21%n


message_identifier: 0x00000376
message_string:
IPSec main mode and user mode security associations established.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
Main mode authentication method: %6%n
Main mode peer subject: %n%7%n
Main mode peer issuing certificate authority: %n%8%n
Main mode peer root certificate authority: %n%9%n
Main mode peer SHA thumbprint: %n%10%n
Main mode my subject: %n%11%n
Main mode my SHA thumbprint: %n%12%n
Cipher algorithm: %13%n
Integrity algorithm: %14%n
Lifetime (seconds): %15%n
Main mode impersonation: %16%n
Main mode SA LUID: %17%n%n
User mode authentication method: %18%n
User mode peer subject: %n%19%n
User mode peer issuing certificate authority: %n%20%n
User mode peer root certificate authority: %n%21%n
User mode peer SHA thumbprint: %n%22%n
User mode my subject: %n%23%n
User mode my SHA thumbprint: %n%24%n
User mode impersonation: %25%n


message_identifier: 0x00000377
message_string:
IPSec user mode security association establishment failed.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
User mode authentication method: %6%n
User mode peer subject: %n%7%n
User mode peer issuing certificate authority: %n%8%n
User mode peer root certificate authority: %n%9%n
User mode peer SHA thumbprint: %n%10%n
User mode my subject: %n%11%n
User mode my SHA thumbprint: %n%12%n
Failure point: %13%n
Failure reason: %14%n
User mode IKE state: %15%n
Initiator or Responder: %16%n
User mode impersonation: %17%n


message_identifier: 0x00000288
message_string:
Security Disabled Local Group Created:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000289
message_string:
Security Disabled Local Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000280
message_string:
General Account Database Change:%n
%tType of change:%t%1%n
%tObject Type:%t%2%n
%tObject Name:%t%3%n
%tObject ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n


message_identifier: 0x00000281
message_string:
Security Enabled Global Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000282
message_string:
User Account Changed:%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n
Changed Attributes:%n
%tSam Account Name:%t%9%n
%tDisplay Name:%t%10%n
%tUser Principal Name:%t%11%n
%tHome Directory:%t%12%n
%tHome Drive:%t%13%n
%tScript Path:%t%14%n
%tProfile Path:%t%15%n
%tUser Workstations:%t%16%n
%tPassword Last Set:%t%17%n
%tAccount Expires:%t%18%n
%tPrimary Group ID:%t%19%n
%tAllowedToDelegateTo:%t%20%n
%tOld UAC Value:%t%21%n
%tNew UAC Value:%t%22%n
%tUser Account Control:%t%23%n
%tUser Parameters:%t%24%n
%tSid History:%t%25%n
%tLogon Hours:%t%26%n


message_identifier: 0x00000283
message_string:
Domain Policy Changed: %1 modified%n
%tDomain Name:%t%t%2%n
%tDomain ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tMin. Password Age:%t%8%n
%tMax. Password Age:%t%9%n
%tForce Logoff:%t%10%n
%tLockout Threshold:%t%11%n
%tLockout Observation Window:%t%12%n
%tLockout Duration:%t%13%n
%tPassword Properties:%t%14%n
%tMin. Password Length:%t%15%n
%tPassword History Length:%t%16%n
%tMachine Account Quota:%t%17%n
%tMixed Domain Mode:%t%18%n
%tDomain Behavior Version:%t%19%n
%tOEM Information:%t%20%n


message_identifier: 0x00000284
message_string:
User Account Locked Out:%n
%tTarget Account Name:%t%1%n
%tTarget Account ID:%t%3%n
%tCaller Machine Name:%t%2%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


message_identifier: 0x00000285
message_string:
Computer Account Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges%t%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tDisplay Name:%t%9%n
%tUser Principal Name:%t%10%n
%tHome Directory:%t%11%n
%tHome Drive:%t%12%n
%tScript Path:%t%13%n
%tProfile Path:%t%14%n
%tUser Workstations:%t%15%n
%tPassword Last Set:%t%16%n
%tAccount Expires:%t%17%n
%tPrimary Group ID:%t%18%n
%tAllowedToDelegateTo:%t%19%n
%tOld UAC Value:%t%20%n
%tNew UAC Value:%t%21%n
%tUser Account Control:%t%22%n
%tUser Parameters:%t%23%n
%tSid History:%t%24%n
%tLogon Hours:%t%25%n
%tDNS Host Name:%t%26%n
%tService Principal Names:%t%27%n


message_identifier: 0x00000286
message_string:
Computer Account Changed:%n
%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n
Changed Attributes:%n
%tSam Account Name:%t%9%n
%tDisplay Name:%t%10%n
%tUser Principal Name:%t%11%n
%tHome Directory:%t%12%n
%tHome Drive:%t%13%n
%tScript Path:%t%14%n
%tProfile Path:%t%15%n
%tUser Workstations:%t%16%n
%tPassword Last Set:%t%17%n
%tAccount Expires:%t%18%n
%tPrimary Group ID:%t%19%n
%tAllowedToDelegateTo:%t%20%n
%tOld UAC Value:%t%21%n
%tNew UAC Value:%t%22%n
%tUser Account Control:%t%23%n
%tUser Parameters:%t%24%n
%tSid History:%t%25%n
%tLogon Hours:%t%26%n
%tDNS Host Name:%t%27%n
%tService Principal Names:%t%28%n


message_identifier: 0x00000287
message_string:
Computer Account Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x000002af
message_string:
Basic Application Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x000002ae
message_string:
Password of the following user accessed:%n
%tTarget User Name:%t%1%n
%tTarget User Domain:%t%t%2%n
By user:%n
%tCaller User Name:%t%3%n
%tCaller Domain:%t%t%4%n
%tCaller Logon ID:%t%t%5%n


message_identifier: 0x000002ad
message_string:
Account Name Changed:%n
%tOld Account Name:%t%1%n
%tNew Account Name:%t%2%n
%tTarget Domain:%t%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


message_identifier: 0x000002ac
message_string:
Set ACLs of members in administrators groups:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x000002ab
message_string:
Session disconnected from winstation:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession Name:%t%4%n
%tClient Name:%t%5%n
%tClient Address:%t%6


message_identifier: 0x000002aa
message_string:
Session reconnected to winstation:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tSession Name:%t%4%n
%tClient Name:%t%5%n
%tClient Address:%t%6


message_identifier: 0x000003b2
message_string:
A change has been made to IPSec settings. An Authentication Set was deleted.
%n
%nProfile changed: %1
%nDeleted Authentication Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003b3
message_string:
A change has been made to IPSec settings. A Connection Security Rule was added.
%n
%nProfile changed: %1
%nAdded Connection Security Rule:
%n     Id: %2
%n     Name: %3


message_identifier: 0x00000217
message_string:
Logon Failure:%n
%tReason:%t%tThe specified account's password has expired%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000216
message_string:
Logon Failure:%n
%tReason:%tThe user has not been granted the requested%n
%t%tlogon type at this machine%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000215
message_string:
Logon Failure:%n
%tReason:%t%tUser not allowed to logon at this computer%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000214
message_string:
Logon Failure:%n
%tReason:%t%tThe specified user account has expired%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000213
message_string:
Logon Failure:%n
%tReason:%t%tAccount currently disabled%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000212
message_string:
Logon Failure:%n
%tReason:%t%tAccount logon time restriction violation%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000211
message_string:
Logon Failure:%n
%tReason:%t%tUnknown user name or bad password%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000210
message_string:
Successful Logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon Type:%t%4%n
%tLogon Process:%t%5%n
%tAuthentication Package:%t%6%n
%tWorkstation Name:%t%7%n
%tLogon GUID:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID: %12%n
%tTransited Services: %13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n
%tCaller Process Name:%t%16%n


message_identifier: 0x00000367
message_string:

Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tFilter run-time ID:%t%5%n
%tLayer:%t%6%n


message_identifier: 0x00000366
message_string:

Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tFilter run-time ID:%t%5%n
%tLayer:%t%6%n


message_identifier: 0x00000365
message_string:

A more restrictive Windows Filtering Platform filter has blocked the packet.:%n
%tApplication:%t%1%n
%tDirection:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tDestination Address:%t%5%n
%tDestination Port:%t%6%n
%tProtocol:%t%7%n
%tFilter run-time ID:%t%8%n
%tLayer:%t%9%n


message_identifier: 0x00000364
message_string:

The Windows Filter Platform blocked a packet .:%n
%tDirection:%t%1%n
%tLocal Address:%t%2%n
%tLocal Port:%t%3%n
%tRemote Address:%t%4%n
%tRemote Port:%t%5%n
%tProtocol:%t%6%n
%tFilter LUID:%t%7%n
%tLayer Id:%t%8%n


message_identifier: 0x00000363
message_string:

IPSec received inbound clear text packet that should have been secured:%n
%tPacket Source:%t%1%n
%tInbound SA:%t%2%n
%tNumber of Packets:%t%3%n


message_identifier: 0x00000362
message_string:

Received a packet over a security association with a low sequence number. IPsec inbound packet replay check failed.
This may indicate a either network or hardware problem or that a replay attack is in process. Check your IPsec peer network for errors.  To check for a replay attack shutdown the peer device and check if these messages persist.  If the messages persist it may indicate a replay attack.:%n
%tPacket Source:%t%1%n
%tInbound SA:%t%2%n 
%tNumber of Packets:%t%3%n


message_identifier: 0x00000219
message_string:
Logon Failure:%n
%tReason:%t%tAn error occurred during logon%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tStatus code:%t%7%n
%tSubstatus code:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID:%t%12%n
%tTransited Services:%t%13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n
%tCaller Process Name:%t%16%n


message_identifier: 0x00000218
message_string:
Logon Failure:%n
%tReason:%t%tThe NetLogon component is not active%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID:%t%10%n
%tTransited Services:%t%11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000406
message_string:
Signing Certificate is automatically updated by OCSP Responder Service.%n
CA Configuration ID: %t%1%n
New Signing Certificate Hash: %t%2%n


message_identifier: 0x00000407
message_string:
OCSP Revocation Provider successfully updated the revocation information.%n
CA Configuration ID: %t%1%n
Base CRL Number: %t%2%n
Base CRL This Update: %t%3%n
Base CRL Hash: %t%4%n
Delta CRL Number: %t%5%n
Delta CRL Indicator: %t%6%n
Delta CRL This Update: %t%7%n
Delta CRL Hash: %t%8%n


message_identifier: 0x00000402
message_string:
A Configuration entry changed in OCSP Responder Service.%n
CA Configuration ID: %t%1%n
New Value: %t%2%n


message_identifier: 0x00000403
message_string:
A Configuration entry changed in OCSP Responder Service.%n
PropertyName: %t%1%n
New Value: %t%2%n


message_identifier: 0x00000299
message_string:
Security Disabled Universal Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000298
message_string:
Security Disabled Universal Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000297
message_string:
Security Disabled Universal Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000296
message_string:
Security Enabled Universal Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000295
message_string:
Security Enabled Universal Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000294
message_string:
Security Enabled Universal Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000293
message_string:
Security Enabled Universal Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000292
message_string:
Security Enabled Universal Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000291
message_string:
Security Disabled Global Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000290
message_string:
Security Disabled Global Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000026b
message_string:
Audit Security Object changed:%n
%tPrimary User Name:%t%1%n
%tPrimary Domain:%t%2%n
%tPrimary Logon ID:%t%3%n
%tClient User Name:%t%4%n
%tClient Domain:%t%5%n
%tClient Logon ID:%t%6%n
%tOriginal Security Descriptor:%t%7%n
%tNew Security Descriptor:%t%8%n


message_identifier: 0x0000026c
message_string:
Trusted Domain Information Modified:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tModified By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n
%tTrust Type:%t%6%n
%tTrust Direction:%t%7%n
%tTrust Attributes:%t%8%n
%tSID Filtering:%t%9%n


message_identifier: 0x0000026a
message_string:
Encrypted Data Recovery Policy Changed:%n
Changed By:%n
%t  User Name:%t%1%n
%t  Domain Name:%t%2%n
%t  Logon ID:%t%3%n
Changes made:%n
('--' means no changes, otherwise each change is shown as:%n
<ParameterName>: <new value> (<old value>))%n
%4%n


message_identifier: 0x0000026f
message_string:
System Audit Policy Change:%n
   Category:%t%1%n
   Sub Category:%t%2%n
   Sub Category Guid:%t%3%n
   Changes:%t%4%n%n
Changed By:%n
   User Name:%t%5%n
   Domain Name:%t%6%n
   Logon ID:%t%7


message_identifier: 0x0000026d
message_string:
System Security Access Granted:%n
%tAccess Granted:%t%4%n
%tAccount Modified:%t%5%n
%tAssigned By:%n
%t  User Name:%t%1%n
%t  Domain:%t%t%2%n
%t  Logon ID:%t%3%n


message_identifier: 0x0000026e
message_string:
System Security Access Removed:%n
%tAccess Removed:%t%4%n
%tAccount Modified:%t%5%n
%tRemoved By:%n
%t  User Name:%t%1%n
%t  Domain:%t%t%2%n
%t  Logon ID:%t%3%n


message_identifier: 0x0000031b
message_string:
A configuration entry changed in Certificate Services.%n
%n
Node:%t%1%n
Entry:%t%2%n
Value:%t%3


message_identifier: 0x0000031c
message_string:
A property of Certificate Services changed.%n
%n
Property:%t%1%n
Index:%t%2%n
Type:%t%3%n
Value:%t%4


message_identifier: 0x0000031f
message_string:
Certificate Services published the CA certificate to Active Directory Domain Services.%n
%n
Certificate Hash:%t%1%n
Valid From:%t%2%n
Valid To:%t%3


message_identifier: 0x0000021e
message_string:
IKE security association ended.%n
Mode: Data Protection (Quick mode)
Filter: %n%1%n
Inbound SPI: %n%2%n
Outbound SPI: %n%3%n


message_identifier: 0x0000021d
message_string:
IKE security association established.%n
Mode: %n%1%n
Peer Identity: %n%2%n
Filter: %n%3%n
Parameters: %n%4%n


message_identifier: 0x0000021c
message_string:
Successful Network Logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tLogon Type:%t%4%n
%tLogon Process:%t%5%n
%tAuthentication Package:%t%6%n
%tWorkstation Name:%t%7%n
%tLogon GUID:%t%8%n
%tCaller User Name:%t%9%n
%tCaller Domain:%t%10%n
%tCaller Logon ID:%t%11%n
%tCaller Process ID: %12%n
%tTransited Services: %13%n
%tSource Network Address:%t%14%n
%tSource Port:%t%15%n
%tCaller Process Name:%t%16%n


message_identifier: 0x0000021b
message_string:
Logon Failure:%n
%tReason:%t%tAccount locked out%n
%tUser Name:%t%1%n
%tDomain:%t%2%n
%tLogon Type:%t%3%n
%tLogon Process:%t%4%n
%tAuthentication Package:%t%5%n
%tWorkstation Name:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Process ID: %10%n
%tTransited Services: %11%n
%tSource Network Address:%t%12%n
%tSource Port:%t%13%n
%tCaller Process Name:%t%14%n


message_identifier: 0x00000370
message_string:
During IPSec main mode SA negotiation, IKE/Authip received an invalid ISAKMP packet.  This could indicate a poor network condition or an attempt to modify or replay this negotiation.
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n


message_identifier: 0x00000344
message_string:
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tNaming Context:%t%3%n
%tOptions:%t%4%n
%tSession ID:%t%5%n
%tStart USN:%t%6%n


message_identifier: 0x0000036d
message_string:
Special groups have been assigned to a token:%n
%tUser Sid:%t%1%n
%tUser Name:%t%2%n
%tDomain:%t%t%3%n
%tLogon ID:%t%t%4%n
%tLogon GUID:%t%5%n
%tSpecial Groups assigned:%t%6%n
%tCaller User Name:%t%7%n
%tCaller Domain:%t%8%n
%tCaller Logon ID:%t%9%n
%tCaller Logon Guid:%t%10%n


message_identifier: 0x0000036b
message_string:

Windows Filtering Platform has blocked a bind to a local port.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tProtocol:%t%5%n
%tFilter run-time ID:%t%6%n
%tLayer:%t%7%n


message_identifier: 0x0000036a
message_string:

Windows Filtering Platform has permitted a bind to a local port.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tProtocol:%t%5%n
%tFilter run-time ID:%t%6%n
%tLayer:%t%7%n


message_identifier: 0x000003e2
message_string:
An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started.


message_identifier: 0x000003e0
message_string:
An IPsec Quick Mode security association was established.%n
%n
Local address:%t%1%n
Local address mask:%t%2%n
Local port:%t%3%n
Local tunnel endpoint:%t%4%n
Remote address:%t%5%n
Remote address mask:%t%6%n
Remote port:%t%7%n
Remote private address:%t%8%n
Remote tunnel endpoint:%t%9%n
Protocol:%t%10%n
Keying module name:%t%11%n
Integrity algorithm - AH:%t%12%n
Integrity algorithm - ESP:%t%13%n
Encryption algorithm:%t%14%n
Lifetime - seconds:%t%15%n
Lifetime - data:%t%16%n
Lifetime - packets:%t%17%n
Mode:%t%18%n
Role:%t%19%n
Quick Mode filter identifier:%t%20%n
Main Mode SA identifier:%t%21%n
Quick Mode SA identifier:%t%22%n
Inbound SPI:%t%23%n
Outbound SPI:%t%24


message_identifier: 0x000003e1
message_string:
An IPsec Quick Mode security association ended.%n
%n
Local address:%t%1%n
Local port:%t%2%n
Local tunnel endpoint:%t%3%n
Remote address:%t%4%n
Remote port:%t%5%n
Remote tunnel endpoint:%t%6%n
Protocol:%t%7%n
Quick Mode SA identifier:%t%8


message_identifier: 0x00000240
message_string:
Special privileges assigned to new logon:%n
%tUser Name:%t%1%n
%tDomain:%t%t%2%n
%tLogon ID:%t%t%3%n
%tPrivileges:%t%4


message_identifier: 0x00000241
message_string:
Privileged Service Called:%n
%tServer:%t%t%1%n
%tService:%t%t%2%n
%tPrimary User Name:%t%3%n
%tPrimary Domain:%t%4%n
%tPrimary Logon ID:%t%5%n
%tClient User Name:%t%6%n
%tClient Domain:%t%7%n
%tClient Logon ID:%t%8%n
%tPrivileges:%t%9%n
%tProcess ID:%t%10%n
%tProcess Name:%t%11


message_identifier: 0x00000262
message_string:
New Trusted Domain:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tEstablished By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n
%tTrust Type:%t%6%n
%tTrust Direction:%t%7%n
%tTrust Attributes:%t%8%n
%tSID Filtering:%t%9%n


message_identifier: 0x00000263
message_string:
Trusted Domain Removed:%n
%tDomain Name:%t%1%n
%tDomain ID:%t%2%n
%tRemoved By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


message_identifier: 0x00000260
message_string:
User Right Assigned:%n
%tUser Right:%t%1%n
%tAssigned To:%t%2%n
%tAssigned By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


message_identifier: 0x00000261
message_string:
User Right Removed:%n
%tUser Right:%t%1%n
%tRemoved From:%t%2%n
%tRemoved By:%n
%t  User Name:%t%3%n
%t  Domain:%t%t%4%n
%t  Logon ID:%t%5%n


message_identifier: 0x00000264
message_string:
Audit Policy Change:%n
New Policy:%n
%tSuccess%tFailure%n
%t    %3%t    %4%tLogon/Logoff%n
%t    %5%t    %6%tObject Access%n
%t    %7%t    %8%tPrivilege Use%n
%t    %13%t    %14%tAccount Management%n
%t    %11%t    %12%tPolicy Change%n
%t    %1%t    %2%tSystem%n
%t    %9%t    %10%tDetailed Tracking%n
%t    %15%t    %16%tDirectory Service Access%n
%t    %17%t    %18%tAccount Logon%n%n
Changed By:%n
%t  User Name:%t%19%n
%t  Domain Name:%t%20%n
%t  Logon ID:%t%21


message_identifier: 0x00000269
message_string:
Kerberos Policy Changed:%n
Changed By:%n
%t  User Name:%t%1%n
%t  Domain Name:%t%2%n
%t  Logon ID:%t%3%n
Changes made:%n
('--' means no changes, otherwise each change is shown as:%n
<ParameterName>: <new value> (<old value>))%n
%4%n


message_identifier: 0x00000316
message_string:
Certificate Services received a certificate request.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3


message_identifier: 0x00000317
message_string:
Certificate Services approved a certificate request and issued a certificate.%n
%n
Request ID:%t%1%n
Requester:%t%2%n
Attributes:%t%3%n
Disposition:%t%4%n
SKI:%t%t%5%n
Subject:%t%6


message_identifier: 0x00000314
message_string:
Certificate Services imported a certificate into its database.%n
%n
Certificate:%t%1%n
Request ID:%t%2


message_identifier: 0x000002d0
message_string:
RPC detected an integrity violation while decrypting an incoming message.%n
%tPeer Name:%t%1%n
%tProtocol Sequence:%t%2%n
%tSecurity Error:%t%3%n


message_identifier: 0x0000029f
message_string:
User Account Unlocked:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


message_identifier: 0x0000029e
message_string:
Add SID History:%n
%tSource Account Name:%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


message_identifier: 0x0000029d
message_string:
Add SID History:%n
%tSource Account Name:%t%1%n
%tSource Account ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n
%tSidList:%t%10%n


message_identifier: 0x0000029c
message_string:
Group Type Changed:%n
%t%1%n
%tTarget Account Name:%t%2%n
%tTarget Domain:%t%3%n
%tTarget Account ID:%t%4%n
%tCaller User Name:%t%5%n
%tCaller Domain:%t%6%n
%tCaller Logon ID:%t%7%n
%tPrivileges:%t%8%n


message_identifier: 0x0000029b
message_string:
Security Disabled Universal Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x0000029a
message_string:
Security Disabled Universal Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x000002b5
message_string:
Basic Application Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000330
message_string:
Per User Audit Policy Change:%n
   User:%t%t%1%n
   Category:%t%2%n
   Sub Category:%t%3%n
   Sub Category Guid:%t%4%n
   Changes:%t%5%n%n
Changed By:%n
   User Name:%t%6%n
   Domain Name:%t%7%n
   Logon ID:%t%8


message_identifier: 0x000003b4
message_string:
A change has been made to IPSec settings. A Connection Security Rule was modified.
%n
%nProfile changed: %1
%nModified Connection Security Rule:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003ba
message_string:
The IPSec policy was not updated because Active Directory Domain Services could not be reached.
%n


message_identifier: 0x000003b8
message_string:
A change has been made to IPSec settings. A Crypto Set was deleted.
%n
%nProfile changed: %1
%nDeleted Crypto Set:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003d4
message_string:
The following sublayer was present when the Windows Filtering Platform Base Filtering Engine started.
%n
%nProvider ID:%t%1
%nProvider name:%t%2
%nSublayer ID:%t%3
%nSublayer name:%t%4
%nSublayer type:%t%5
%nWeight:%t%6


message_identifier: 0x000003d7
message_string:
A Windows Filtering Platform filter has been changed.
%n
%nProcess ID:%t%1
%nUser ID:%t%2
%nUser name:%t%3
%nProvider ID:%t%4
%nProvider name:%t%5
%nChange type:%t%6
%nFilter ID:%t%7
%nFilter name:%t%8
%nFilter type:%t%9
%nFilter run-time ID:%t%10
%nLayer ID:%t%11
%nLayer name:%t%12
%nLayer run-time ID:%t%13
%nWeight:%t%14
%n
%nConditions:%t%15
%nFilter Action:%t%16
%nCallout ID:%t%17
%nCallout name:%t%18


message_identifier: 0x000003d6
message_string:
A Windows Filtering Platform callout has been changed.
%n
%nProcess ID:%t%1
%nUser ID:%t%2
%nUser name:%t%3
%nProvider ID:%t%4
%nProvider name:%t%5
%nChange type:%t%6
%nCallout ID:%t%7
%nCallout name:%t%8
%nCallout type:%t%9
%nCallout run-time ID:%t%10
%nLayer ID:%t%11
%nLayer name:%t%12
%nLayer run-time ID:%t%13


message_identifier: 0x000003d1
message_string:
The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
%n
%nProvider ID:%t%1
%nProvider name:%t%2
%nFilter ID:%t%3
%nFilter name:%t%4
%nFilter type:%t%5
%nFilter run-time ID:%t%6
%nLayer ID:%t%7
%nLayer name:%t%8
%nLayer run-time ID:%t%9
%nWeight:%t%10
%n
%nConditions:%t%11
%nFilter Action:%t%12
%nCallout ID:%t%13
%nCallout name:%t%14


message_identifier: 0x000003d0
message_string:
The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
%n
%nProvider ID:%t%1
%nProvider name:%t%2
%nCallout ID:%t%3
%nCallout name:%t%4
%nCallout type:%t%5
%nCallout run-time ID:%t%6
%nLayer ID:%t%7
%nLayer name:%t%8
%nLayer run-time ID:%t%9


message_identifier: 0x000003d3
message_string:
The following provider context was present when the Windows Filtering Platform Base Filtering Engine started.
%n
%nProvider ID:%t%1
%nProvider name:%t%2
%nProvider context ID:%t%3
%nProvider context name:%t%4
%nProvider context type:%t%5


message_identifier: 0x000003d2
message_string:
The following provider was present when the Windows Filtering Platform Base Filtering Engine started.
%n
%nProvider ID:%t%1
%nProvider name:%t%2
%nProvider type:%t%3


message_identifier: 0x000003d9
message_string:
A Windows Filtering Platform provider context has been changed.
%n
%nProcess ID:%t%1
%nUser ID:%t%2
%nUser name:%t%3
%nProvider ID:%t%4
%nProvider name:%t%5
%nChange type:%t%6
%nProvider context ID:%t%7
%nProvider context name:%t%8
%nProvider context type:%t%9


message_identifier: 0x000003d8
message_string:
A Windows Filtering Platform provider has been changed.
%n
%nProcess ID:%t%1
%nUser ID:%t%2
%nUser name:%t%3
%nChange type:%t%4
%nProvider ID:%t%5
%nProvider name:%t%6
%nProvider type:%t%7


message_identifier: 0x00000309
message_string:
A certificate request extension changed.%n
%n
Request ID:%t%1%n
Name:%t%2%n
Type:%t%3%n
Flags:%t%4%n
Data:%t%5


message_identifier: 0x00000270
message_string:
User Account Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges%t%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tDisplay Name:%t%9%n
%tUser Principal Name:%t%10%n
%tHome Directory:%t%11%n
%tHome Drive:%t%12%n
%tScript Path:%t%13%n
%tProfile Path:%t%14%n
%tUser Workstations:%t%15%n
%tPassword Last Set:%t%16%n
%tAccount Expires:%t%17%n
%tPrimary Group ID:%t%18%n
%tAllowedToDelegateTo:%t%19%n
%tOld UAC Value:%t%20%n
%tNew UAC Value:%t%21%n
%tUser Account Control:%t%22%n
%tUser Parameters:%t%23%n
%tSid History:%t%24%n
%tLogon Hours:%t%25%n


message_identifier: 0x00000273
message_string:
Change Password Attempt:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000272
message_string:
User Account Enabled:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


message_identifier: 0x00000275
message_string:
User Account Disabled:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


message_identifier: 0x00000274
message_string:
User Account password set:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n


message_identifier: 0x00000277
message_string:
Security Enabled Global Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x00000276
message_string:
User Account Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000279
message_string:
Security Enabled Global Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000278
message_string:
Security Enabled Global Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x00000303
message_string:
Trusted Forest Information Entry Modified:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tModified by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


message_identifier: 0x00000302
message_string:
Trusted Forest Information Entry Removed:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tRemoved by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


message_identifier: 0x00000307
message_string:
Certificate Services received a request to publish the certificate revocation list (CRL).%n
%n
Next Update:%t%1%n
Publish Base:%t%2%n
Publish Delta:%t%3


message_identifier: 0x00000369
message_string:

Windows Filtering Platform has blocked a connection from taking place.:%n
%tProcess ID:%t%1%n
%tApplication:%t%2%n
%tSource Address:%t%3%n
%tSource Port:%t%4%n
%tProtocol:%t%5%n
%tDestination Address:%t%6%n
%tDestination Port:%t%7%n
%tDirection:%t%8%n
%tFilter run-time ID:%t%9%n
%tLayer:%t%10%n


message_identifier: 0x000003a4
message_string:
The Windows Firewall was unable to parse the new security policy. The Windows Firewall will continue with currently enforced policy.
%n
Error Code: %1


message_identifier: 0x000002bb
message_string:
RODC SpecifiC Local Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x000002bc
message_string:
RODC Specific Local Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x000002ba
message_string:
An attempt to set the Directory Services Restore Mode
administrator password has been made.%n
%tCaller Username:%t%1%n
%tCaller Domain:%t%2%n
%tCaller Logon ID:%t%3%n
%tCaller Workstation:%t%4%n
%tStatus Code:%t%5%n


message_identifier: 0x00000345
message_string:
%tDestination DRA:%t%1%n
%tSource DRA:%t%2%n
%tNaming Context:%t%3%n
%tOptions:%t%4%n
%tSession ID:%t%5%n
%tEnd USN:%t%6%n
%tStatus Code:%t%7%n


message_identifier: 0x000003b5
message_string:
A change has been made to IPSec settings. A Connection Security Rule was deleted.
%n
%nProfile changed: %1
%nDeleted Connection Security Rule:
%n     Id: %2
%n     Name: %3


message_identifier: 0x000003da
message_string:
A Windows Filtering Platform sublayer has been changed.
%n
%nProcess ID:%t%1
%nUser ID:%t%2
%nUser name:%t%3
%nProvider ID:%t%4
%nProvider name:%t%5
%nChange type:%t%6
%nSublayer ID:%t%7
%nSublayer name:%t%8
%nSublayer type:%t%9
%nWeight:%t%10


message_identifier: 0x00000308
message_string:
Certificate Services published the certificate revocation list (CRL).%n
%n
Base CRL:%t%1%n
CRL No:%t%t%2%n
Key Container:%t%3%n
Next Publish:%t%4%n
Publish URLs:%t%5


message_identifier: 0x00000359
message_string:
A rule has been rejected by Windows Firewall.
%n
%nProfile: %1
%nReason for Rejection:%2
%nRule:
%n     Id:%3
%n     Name:%4


message_identifier: 0x00000346
message_string:
%tSession ID:%t%1%n
%tObject:%t%2%n
%tAttribute:%t%3%n
%tType of change:%t%4%n
%tNew Value:%t%5%n
%tUSN:%t%6%n
%tStatus Code:%t%7%n


message_identifier: 0x00000378
message_string:
IPSec user mode security association establishment failed.%n
Keying module type: AuthIp%n
Local address: %1%n
Remote address: %2%n
Local port: %3%n
Remote port: %4%n
Peer private address: %5%n
User mode authentication method: %6%n
User mode my Id: %7%n
User mode peer Id: %8%n
Failure point: %9%n
Failure reason: %10%n
User mode IKE state: %11%n
Initiator or Responder: %12%n
User mode impersonation: %13%n


message_identifier: 0x00000242
message_string:
Privileged object operation:%n
%tObject Server:%t%1%n
%tObject Handle:%t%2%n
%tProcess ID:%t%3%n
%tPrimary User Name:%t%4%n
%tPrimary Domain:%t%5%n
%tPrimary Logon ID:%t%6%n
%tClient User Name:%t%7%n
%tClient Domain:%t%8%n
%tClient Logon ID:%t%9%n
%tPrivileges:%t%10%n
%tObject Type:%t%11%n
%tObject Name:%t%12%n
%tDesired Access:%t%13


message_identifier: 0x000002b6
message_string:
LDAP Query Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x000002b7
message_string:
LDAP Query Group Changed:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x000002b2
message_string:
Basic Application Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x000002b3
message_string:
Basic Application Group Non-Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x000002b0
message_string:
Basic Application Group Changed:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x000002b1
message_string:
Basic Application Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000027a
message_string:
Security Enabled Global Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x00000301
message_string:
Trusted Forest Information Entry Added:%n
%tForest Root:%t%1%n
%tForest Root SID:%t%2%n
%tOperation ID:%t{%3,%4}%n
%tEntry Type:%t%5%n
%tFlags:%t%t%6%n
%tTop Level Name:%t%7%n
%tDNS Name:%t%8%n
%tNetBIOS Name:%t%9%n
%tDomain SID:%t%10%n
%tAdded by%t:%n
%tClient User Name:%t%11%n
%tClient Domain:%t%12%n
%tClient Logon ID:%t%13%n


message_identifier: 0x0000027c
message_string:
Security Enabled Local Group Member Added:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000027b
message_string:
Security Enabled Local Group Created:%n
%tNew Account Name:%t%1%n
%tNew Domain:%t%2%n
%tNew Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


message_identifier: 0x0000027e
message_string:
Security Enabled Local Group Deleted:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n


message_identifier: 0x0000027d
message_string:
Security Enabled Local Group Member Removed:%n
%tMember Name:%t%1%n
%tMember ID:%t%2%n
%tTarget Account Name:%t%3%n
%tTarget Domain:%t%4%n
%tTarget Account ID:%t%5%n
%tCaller User Name:%t%6%n
%tCaller Domain:%t%7%n
%tCaller Logon ID:%t%8%n
%tPrivileges:%t%9%n


message_identifier: 0x0000027f
message_string:
Security Enabled Local Group Changed:%n
%tTarget Account Name:%t%1%n
%tTarget Domain:%t%2%n
%tTarget Account ID:%t%3%n
%tCaller User Name:%t%4%n
%tCaller Domain:%t%5%n
%tCaller Logon ID:%t%6%n
%tPrivileges:%t%7%n
Changed Attributes:%n
%tSam Account Name:%t%8%n
%tSid History:%t%9%n


