| EventCreate.exe | 78.11011 | %1 |
| WinMgmtR.dll | 1011 | Windows Management Instrumentation ADAP was unable to save object %1 in namespace %2 because of the following error %3 |
| cipher.exe | 78.11011 | There is no local current EFS certificate to be backed up. |
| dsreg.dll | 10 | Local Security Authority (LSA) authentication failed.
Authentication package identifier: %1.
Authentication package name: %2.
Error: %3 |
| dsreg.dll | 11 | Local Security Authority (LSA) authentication failed.
Authentication package identifier: %1.
Authentication package name: %2.
Authentication package message: %3.
Error: %4 |
| dssec.dll | 78.11011 | remote access information |
| ehepgres.dll | 7 | %1 |
| hvloader.dll | 11 | Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor (leaf %1, register %2: features needed %3, features supported %4). |
| hvservice.sys | 10 | Hypervisor launch failed; Processor does not provide the features necessary to run the hypervisor (leaf %1, register %2: features needed %3, features supported %4). |
| nslookup.exe | 78.11011 | *** Can't find address for server %1: %2 |
| reagentc.exe | 8.11011 | %1: Windows RE cannot be placed in the root directory of a volume. |
| sc.exe | 78.11011 | SERVICE_NAME: %1
DISPLAY_NAME: %2
TYPE : %3 %4 %5
STATE : %6 %7
(%8, %9, %10)
WIN32_EXIT_CODE : %11 (0x%12)
SERVICE_EXIT_CODE : %13 (0x%14)
CHECKPOINT : 0x%15
WAIT_HINT : 0x%16 |
| w32time.dll | 1011 | Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer '%1'. NtpClient will continue to try the DNS lookup every %3 minutes. This message will not be logged again until a successful lookup of this manually configured peer occurs. The error was: %2 |
| webservices.dll | 78.11011 | The URL contained a query string but the endpoint did not expect a query string. |
| wecutil.exe | 78.110 | /esa:EVENT_SOURCE (EventSourceAddress)
Specifies the address of an event source. EVENT_SOURCE is a string that identifies a
machine serving as a source of events using fully-qualified domain name, NetBIOS name,
or an IP address. This option should be used with /ese (EventSourceEnabled),
/aes (AddEventSource), /res (RemoveEventSource), or /un (UserName) and /up (UserPassword)
options.
/ese[:VALUE] (EventSourceEnabled)
Enable or disable an event source. VALUE can be true or false. This option is allowed
only if /esa (EventSourceAddress) option is specified. The default value of this option
is true.
OPTIONS SPECIFIC TO COLLECTOR INITIATED SUBSCRIPTIONS:
/aes (AddEventSource)
Adds event source specified by the /esa (EventSourceAddress) option, if it is not already
a part of the subscription. If the address specified by the /esa (EventSourceAddress) is
already a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.
/res (RemoveEventSource)
Removes event source specified by the /esa (EventSourceAddress) option, if it is already
a part of the subscription. If the address specified by the /esa (EventSourceAddress)
is not a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.
/un:USERNAME (UserName)
Specifies user credential to be used with the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /esa (EventSourceAddress)
option is specified.
/up:PASSWORD (UserPassword)
Sets the user password for the user credential for the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /un (UserName) option
is specified.
/tp:TRANSPORTPORT (TransportPort)
Port number used by transport when connecting to remote event source. If not specified the
port defaults to the standard one used for the given transport name: 80 for http, 443 for
https
/hn:NAME (HostName)
String that specifies the FQDNS name of the local machine. This name is used by remote
event source to push back events and must be used for push subscription only. It is used
in scenarios involving multi-homed servers that may have multiple FQDNS names.
/ct:TYPE (CredentialsType)
String that specifies the credential type to be used for remote source access. TYPE may
be one of the following values: "default", "negotiate", "digest", "basic" or
"localmachine". The default value is "default".
/cun:USERNAME (CommonUserName)
Sets shared user credential to be used for event sources that do not have their own user
credentials.
Note: if this option is specified with the /c (Config) option, UserName/UserPassword
settings for individual event sources from the configuration file are ignored. If you
want to use different credential for a specific event source, you may override this
value by specifying the /un (UserName) and /up (UserPassword) for a specific event
source on the command line of another ss (set-subscription) command.
/cup:PASSWORD (CommonUserPassword)
Sets the user password for the shared user credential. When PASSWORD is set to
* (asterisk), the password is read from the console. This option is only valid when
/cun (CommonUserName) option is specified.
OPTIONS SPECIFIC TO SOURCE INITIATED SUBSCRIPTIONS:
/ica:THUMBPRINTS (AllowedIssuerCA)
Sets the list of issuer certificate thumbprints, in a comma separated list.
/as:SUBJECTS (AllowedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.
/ds:SUBJECTS (DeniedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
not allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.
/adc:SDDL (AllowedSourceDomainComputers)
A string which specifies which domain computers are allowed or not to initiate
subscriptions, in SDDL format. Default is to allow all domain computers.
EXAMPLES:
Update subscription configuration named sub1 from a new XML file, WsSelRg2.xml.
wecutil ss sub1 /c:%Windir%\system32\WsSelRg2.xml
Update subscription configuration named sub2 with multiple parameters:
wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:Normal
Update the allowed and denied subject lists for a source initiated subscription:
wecutil ss sub3 /as:"*.private.mydomain.com" /ds:"*.public.mydomain.net,*.mydomain.tv" |
| wecutil.exe | 11 | /esa:EVENT_SOURCE (EventSourceAddress)
Specifies the address of an event source. EVENT_SOURCE is a string that identifies a
machine serving as a source of events using fully-qualified domain name, NetBIOS name,
or an IP address. This option should be used with /ese (EventSourceEnabled),
/aes (AddEventSource), /res (RemoveEventSource), or /un (UserName) and /up (UserPassword)
options.
/ese[:VALUE] (EventSourceEnabled)
Enable or disable an event source. VALUE can be true or false. This option is allowed
only if /esa (EventSourceAddress) option is specified. The default value of this option
is true.
OPTIONS SPECIFIC TO COLLECTOR INITIATED SUBSCRIPTIONS:
/aes (AddEventSource)
Adds event source specified by the /esa (EventSourceAddress) option, if it is not already
a part of the subscription. If the address specified by the /esa (EventSourceAddress) is
already a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.
/res (RemoveEventSource)
Removes event source specified by the /esa (EventSourceAddress) option, if it is already
a part of the subscription. If the address specified by the /esa (EventSourceAddress)
is not a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.
/un:USERNAME (UserName)
Specifies user credential to be used with the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /esa (EventSourceAddress)
option is specified.
/up:PASSWORD (UserPassword)
Sets the user password for the user credential for the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /un (UserName) option
is specified.
/tp:TRANSPORTPORT (TransportPort)
Port number used by transport when connecting to remote event source. If not specified the
port defaults to the standard one used for the given transport name: 80 for http, 443 for
https
/hn:NAME (HostName)
String that specifies the FQDNS name of the local machine. This name is used by remote
event source to push back events and must be used for push subscription only. It is used
in scenarios involving multi-homed servers that may have multiple FQDNS names.
/ct:TYPE (CredentialsType)
String that specifies the credential type to be used for remote source access. TYPE may
be one of the following values: "default", "negotiate", "digest", "basic" or
"localmachine". The default value is "default".
/cun:USERNAME (CommonUserName)
Sets shared user credential to be used for event sources that do not have their own user
credentials.
Note: if this option is specified with the /c (Config) option, UserName/UserPassword
settings for individual event sources from the configuration file are ignored. If you
want to use different credential for a specific event source, you may override this
value by specifying the /un (UserName) and /up (UserPassword) for a specific event
source on the command line of another ss (set-subscription) command.
/cup:PASSWORD (CommonUserPassword)
Sets the user password for the shared user credential. When PASSWORD is set to
* (asterisk), the password is read from the console. This option is only valid when
/cun (CommonUserName) option is specified.
OPTIONS SPECIFIC TO SOURCE INITIATED SUBSCRIPTIONS:
/ica:THUMBPRINTS (AllowedIssuerCA)
Sets the list of issuer certificate thumbprints, in a comma separated list.
/as:SUBJECTS (AllowedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.
/ds:SUBJECTS (DeniedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
not allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.
/adc:SDDL (AllowedSourceDomainComputers)
A string which specifies which domain computers are allowed or not to initiate
subscriptions, in SDDL format. Default is to allow all domain computers.
EXAMPLES:
Update subscription configuration named sub1 from its config XML file, WsSelRg2.xml.
wecutil ss /c:%Windir%\system32\WsSelRg2.xml
Update subscription configuration named sub2 with multiple parameters:
wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:Normal
Update the allowed and denied subject lists for a source initiated subscription:
wecutil ss sub3 /as:"*.private.mydomain.com" /ds:"*.public.mydomain.net,*.mydomain.tv" |
| wevtutil.exe | 78.11011 | Option query is only available for querytype Log and LogFile. |
| whealogr.dll | 1011 | A fatal memory error has occurred.
Error Source: %1
Error Bank: %2
MCi_STATUS: %3
Physical Address: %4
MCi_MISC: %5
FRU Text: %6 |
| win32k.sys | 78.1 | ButtonShadow |
| win32kbase.sys | 1011 | ButtonShadow |