Skip to content

Event ID 22: Remote Desktop Services: Shell start notification received:

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

Remote Desktop Services: Shell start notification received:

Event 22
TerminalServices-LocalSessionManager
TerminalServices-LocalSessionManager/Operational log
Information

The Remote Desktop session's shell (desktop) started.

Related: 21

Message and fields (as Event Viewer shows them) 
Remote Desktop Services: Shell start notification received:

User: …
Session ID: …
Source Network Address: …

The event logging service encountered an error while initializing publishing resources for channel

Event 22
Eventlog
Security / System log
Error
Message and fields (as Event Viewer shows them) 
The event logging service encountered an error while initializing publishing resources for channel …. If channel type is Analytic or Debug, then this could mean there was an error initializing logging resources as well.

The time zone bias has changed to … from

Event 22
Kernel-General
System log
Information
Message and fields (as Event Viewer shows them) 
The time zone bias has changed to … from ….

The OS loader edit options menu was displayed.

Event 22
Kernel-Boot
System log
Information
Message and fields (as Event Viewer shows them) 
The OS loader edit options menu was displayed.

Restart Required: To complete the installation of the following updates, the computer will be restarted within … minutes

Event 22
WindowsUpdateClient
System log
Information
Message and fields (as Event Viewer shows them) 
Restart Required: To complete the installation of the following updates, the computer will be restarted within … minutes: …

The time provider NtpServer encountered an error while digitally signing the NTP response for peer

Event 22
Time-Service
System log
Warning
Message and fields (as Event Viewer shows them) 
The time provider NtpServer encountered an error while digitally signing the NTP response for peer …. NtpServer cannot provide secure (signed) time to the client and will ignore the request. The error was: …

Initial PORT_CONFIGURATION_INFORMATION data

Event 22
StorPort
System log
Information
Message and fields (as Event Viewer shows them) 
Initial PORT_CONFIGURATION_INFORMATION data

CorrelationId = …; GroupOperationId = …; OperationId = …; ClassName= …; MethodName = …; ImplementationClass = …; ClientMachine = …; User = …; ClientProcessId = …; NamespaceName

Event 22
WMI-Activity
WMI-Activity/Operational log
Information
Message and fields (as Event Viewer shows them) 
CorrelationId = …; GroupOperationId = …; OperationId = …; ClassName= …; MethodName = …; ImplementationClass = …; ClientMachine = …; User = …; ClientProcessId = …; NamespaceName = …

A cached peer was restored from disk.

Event 22
Bits-Client
Bits-Client/Operational log
Information
Message and fields (as Event Viewer shows them) 
A cached peer was restored from disk.