What does HRESULT 0x87C51052 (UTC_E_FILTER_INVALID_COMMAND) mean?

UTC_E_FILTER_INVALID_COMMAND

Map the code to the scenario graph: filter command parser

UTC_E_FILTER_INVALID_COMMAND has the unsigned value 0x87C51052. In UTC it comes from scenario filter parser and evaluator, where filter command parser owns the decision. A reliable investigation preserves the producing action before any cleanup runs. The immediate contract failed because the evaluator cannot recognize the command name or its serialized grammar, so diagnosis should remain at that boundary until a controlled comparison crosses it.

UTC filters are typed programs, not plain text searches. Parsing, command validation, name lookup, signature binding and evaluation are distinct phases. Capturing the normalized expression and inferred operand types is essential for a useful diagnosis.

Data needed for triage

Reproduce without collateral changes

1. Export the relevant Microsoft-Windows-UniversalTelemetryClient/Operational events and preserve their ActivityId or request correlation alongside this result.
2. Capture raw command text/XML, command token, attributes, nesting, schema/filter versions and error location. Do this before restarting the service or deleting any working directory.
3. Perform this one-variable comparison: replace the command with one known valid command in the same position.
4. After the comparison, record the next HRESULT and whether the requested session, action, trigger or output object was actually created.

Nearby result: UTC_E_FILTER_MISSING_ATTRIBUTE — means the command is recognized but incomplete.

Typed-filter note

Save the filter after variable substitution and type inference, not only the authoring XML. A visually plausible expression can still fail because the runtime command table, scope or operand types differ from the authoring tool. Test with one synthetic event whose fields and types are known exactly.

Fix the contract

Regenerate the filter from the supported schema and preserve the original for diffing.

Technical references

• Microsoft Open Specifications: Windows error-code registry — reference for scenario filter parser and evaluator while interpreting this result.
• Microsoft: Universal Telemetry Client configuration diagnosis — reference for scenario filter parser and evaluator while interpreting it.
• Microsoft: Windows Event Log query schema
• Microsoft: Querying Windows Event Log