| Previous | Next |
| UTC_E_FORWARDER_ALREADY_ENABLED | UTC_E_EVENTLOG_ENTRY_MALFORMED |
UTC_E_FORWARDER_ALREADY_DISABLED
Where the UTC workflow stopped: trigger-forwarder state
UTC_E_FORWARDER_ALREADY_DISABLED has the unsigned value 0x87C51008. In UTC it comes from trigger-forwarder lifecycle, where trigger-forwarder state owns the decision. The decisive question is which UTC object rejected the request for this HRESULT. The immediate contract failed because a disable operation targeted a forwarder that has no active forwarding path, so diagnosis should remain at that boundary until a controlled comparison crosses it for this HRESULT.
Trigger forwarders connect a producer to scenario trigger processing and have their own registration and enable state for this HRESULT. Reusing a handle after configuration reload or crossing producer types can fail before any scenario filter is evaluated for this HRESULT. Record the configuration package or scenario generation together with the Windows build; otherwise a repaired file can be tested against a stale in-memory graph and appear to fail for the same reason for this HRESULT.
Evidence to preserve
| UTC diagnostic field | Value |
|---|---|
| Owning state or object | trigger-forwarder state |
| Producing layer | trigger-forwarder lifecycle |
| Do not confuse with | UTC_E_TRIGGER_NOT_FOUND concerns a missing trigger definition rather than a disabled forwarder |
| Decisive evidence | forwarder ID, producer type, last disable event, registration lifetime and caller sequence |
| Narrow comparison | enable the same forwarder, verify one forwarded trigger, then disable it exactly once |
The AllStat message names the immediate condition as “Trigger forwarder is already disabled” for this HRESULT. In practice, the useful extension is to ask whether the request was rejected before any side effect, after partial setup, or during cleanup for this HRESULT. Verify the existence and ownership of the expected output—session, directory, process, result object or emitted event—rather than assuming the message describes the final system state for this HRESULT.
Controlled reproduction
- Freeze the failing scenario package, caller inputs and UTC service lifetime that produced this result.
- Collect the high-value state: forwarder ID, producer type, last disable event, registration lifetime and caller sequence for this HRESULT.
- Use a passing control on the same Windows build, then enable the same forwarder, verify one forwarded trigger, then disable it exactly once for this HRESULT.
- Repeat once after normal teardown to prove the result is not caused by a stale handle or leftover run state for this HRESULT.
The most informative neighbor is UTC_E_TRIGGER_NOT_FOUND. The distinction is concrete: UTC_E_TRIGGER_NOT_FOUND concerns a missing trigger definition rather than a disabled forwarder for this HRESULT. Keeping both symbolic names in logs prevents a broad “DiagTrack error” bucket from hiding whether the failure occurred during parsing, authorization, resource acquisition, execution or teardown for this HRESULT.
Platform-state note
Capture capability and identity state at the moment this result is returned. Session, container, service and destination state can change asynchronously, so a later successful query does not describe the failed generation for this HRESULT.
Correction and verification
Align teardown with ownership and ignore a second disable only when no resources remain for this HRESULT. Apply that change only to the owning boundary for this HRESULT. A successful repair must make the controlled case cross this boundary while retaining the intended policy, trace providers, destination and security context for this HRESULT.
Deleting the working directory, killing all ETW sessions or retrying in a tight loop can suppress this result temporarily while leaving the underlying lifecycle defect intact for this HRESULT.
- the same request now produces its documented success or nonfatal status without a second hidden retry
- the operational log shows one coherent request lifetime and no orphaned action, timer, process or trace session
- teardown followed by a second run does not reuse stale state or recreate trigger-forwarder state
- the nearby condition remains distinguishable: UTC_E_TRIGGER_NOT_FOUND concerns a missing trigger definition rather than a disabled forwarder
Technical references
- Microsoft Open Specifications: Windows error-code registry — reference for trigger-forwarder lifecycle while interpreting this result.
- Microsoft: Universal Telemetry Client configuration diagnosis — reference for trigger-forwarder lifecycle while interpreting it.
- Microsoft: Event Tracing for Windows
- Microsoft: UniversalTelemetryClient operational-log guidance
Looking for a different code? Search another status or error code.