Reading FSLogix Logs: Event IDs, Status Codes and Reason Codes Explained

By David, 2026-11-09

FSLogix records what happens to each profile in three places: daily text logs under C:\ProgramData\FSLogix\Logs, the FSLogix event logs in Event Viewer, and a Status and Reason code in the registry for every session. The text log is where you'll find the cause of almost every failure. Each sign-in starts with a LoadProfile line for the user, warnings and errors carry a Windows error code, and the sign-in ends with a Status and a Reason code that say whether the container attached and, if not, why.

The short version: Open the newest Profile_<date>.log on the session host, search for LoadProfile: <username>, and read the Status set to and Reason set to lines for that sign-in. Status 0, Reason 0 means the container attached. Any other Status is a failure (the table below says which step failed), and the [ERROR:xxxxxxxx] code before it is a Windows system error code you can look up. Microsoft documents very few FSLogix event IDs; the text log and the Status codes are the reference.

This is a companion to our FSLogix troubleshooting guide. Every table below is from Microsoft Learn as of November 2026, with each source linked.

Where FSLogix writes its logs

Sources: logs and diagnostics, error codes.

How to read the profile log

Each line starts with a time, a thread ID and a level: [INFO], [WARN:xxxxxxxx] or [ERROR:xxxxxxxx]. The eight hex digits on a warning or error are a Windows error code. Microsoft suggests searching for these markers (logs and diagnostics):

On a multi-session host, every user's sign-in writes to the same file, and their lines interleave. A "Status set to" or "ERROR" line near your user's sign-in may belong to someone else. Microsoft's advice is to note the process ID on the user's LoadProfile line and follow only the lines with that ID, "as there may be other processes running for other users at the same time" (logs and diagnostics). To find the user's latest sign-in and the lines after it in today's log:

$log = Get-ChildItem "C:\ProgramData\FSLogix\Logs\Profile" -Filter "Profile*.log" |
  Sort-Object LastWriteTime | Select-Object -Last 1
# The user's most recent LoadProfile line, then the 60 lines after it
Select-String -Path $log.FullName -Pattern "LoadProfile: jdoe" -Context 0,60 | Select-Object -Last 1

Then read only the lines that carry the same process ID as that LoadProfile line, down to its Status set to and Reason set to lines.

FSLogix Status codes

Status is the result of the sign-in. 0, 100, 200 and 300 are normal; everything else names the step that failed (error codes):

What the common ones usually mean in practice. Status 11 or 12 (can't open or attach the disk) with a sharing or lock error before it is usually a locked container. With access denied before it, it's permissions or Kerberos. Status 7 or 9 (can't create the folder or disk) usually means the user can't write to the share, or the share is full. Status 27 (can't find the disk) with an existing user often means a naming setting changed, so FSLogix is looking in the wrong folder.

FSLogix Reason codes

Reason only accompanies a normal Status, and explains why FSLogix did what it did (error codes):

Reasons 1 and 2 are deliberate: the user isn't in the FSLogix include group, or is in the exclude group. Reason 3 means a local profile got there first; Microsoft's DeleteLocalProfileWhenVHDShouldApply setting (recommended value 1) deletes the local profile so the container can load, and it does delete it permanently (configuration settings).

Windows error codes in the log

The code inside [WARN:...] or [ERROR:...] isn't an FSLogix code. Microsoft says these codes "come from Windows" and correspond to System Error Codes, and you can look any of them up with net helpmsg <decimal code> (error codes). The ones you'll see most on AVD:

The meaning of each number is Windows'; the "usual cause" column is our experience, not Microsoft's. For permissions and Kerberos causes, see section 4 of the troubleshooting guide.

FSLogix event logs and event IDs

FSLogix writes to Applications and Services Logs → FSLogix in Event Viewer: the Apps log (Admin and Operational channels, provider Microsoft-FSLogix-Apps) and, if you use Cloud Cache, the CloudCache log (logs and diagnostics).

Microsoft doesn't publish a catalog of FSLogix event IDs. The ones it does document:

The compaction events are from VHD disk compaction troubleshooting and its reference queries. For everything else, alert on the Error and Warning levels of the FSLogix channels rather than on specific IDs, and go to the text log for the cause:

Get-WinEvent -FilterHashtable @{
  LogName   = "Microsoft-FSLogix-Apps/Operational", "Microsoft-FSLogix-Apps/Admin"
  Level     = 2, 3      # Error, Warning
  StartTime = (Get-Date).AddHours(-4)
} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, LevelDisplayName, Message

Logging settings

All under HKLM\SOFTWARE\FSLogix\Logging (configuration settings):

Two practical changes for AVD. Raise LogFileKeepingPeriod: the default of two days means a ticket raised on Monday about Friday's sign-in has no log left. And on pooled hosts that are reimaged or replaced, consider a LogDir on a share so the logs outlive the host.

Tools that help

• frx.exe, in C:\Program Files\FSLogix\Apps. frx version shows the installed build; frx list-redirects shows the active folder redirections; frx list-rules the active rules (frx).
• The Microsoft.FSLogix PowerShell module, installed with FSLogix: Get-CloudCacheDisk and Get-CloudCacheProvider for Cloud Cache (PowerShell module).
• The FSLogix Support Tool (aka.ms/fslogix_support_tool) collects the text and event logs, FSLogix registry settings, gpresult and filter driver output into C:\ProgramData\FSLogix\Support, with an error breakdown report. Useful when you open a case with Microsoft (support tool).

How Atlas AVD helps

Atlas AVD ships alert rules for FSLogix profile load and sign-in time alongside session host CPU, memory and disk, and its Workspace → FSLogix page shows each host's live FSLogix state on Host Coverage, whether each pool is fully configured on Health, and each share's fill level on Capacity, so you know which host and which user to open the log for. See FSLogix optimization for the rest.

FAQ

Where are the FSLogix logs?

On each session host, in C:\ProgramData\FSLogix\Logs, one file per component per day. Profile container activity is in Profile\Profile_<date>.log. Event logs are in Event Viewer under Applications and Services Logs → FSLogix.

What does FSLogix Status 0 and Reason 0 mean?

Success: the profile container is attached. Any Status other than 0, 100, 200 or 300 is an error, and the Status table above names the step that failed.

What does FSLogix Reason 3 mean?

A local profile for the user already exists on the host, so FSLogix used it instead of the container. Remove the local profile, or set DeleteLocalProfileWhenVHDShouldApply to 1 so FSLogix deletes it.

Is there a list of FSLogix event IDs?

No. Microsoft documents only a few: event 26 on Entra-joined hosts, which you can ignore, and events 57, 58 and 60 to 63 for disk compaction. Use the text log for everything else.

How do I keep FSLogix logs for longer?

Set LogFileKeepingPeriod under HKLM\SOFTWARE\FSLogix\Logging to the number of days you want, up to 180. The default is two days.

FSLogix log locations, codes, event IDs and settings are from Microsoft Learn as of November 2026: logs and diagnostics, error codes, known issues, VHD disk compaction troubleshooting, configuration settings, frx, the PowerShell module and the support tool. Windows error messages are from System Error Codes.