How to fix OneCore-DeviceAssociationService error ID 3503 in Windows?

OneCore-DeviceAssociationService is the Event Viewer source of the Windows service that pairs your PC with wireless and network devices. Its error 3503 names no device and, in every report we read, is logged in the last seconds of a shutdown, so it needs no repair when your devices work. Act only when a device really fails to pair, and start by reading the event's Details tab.

Facts checked on 14 October 2026. Steps written for Windows 11 (24H2, 25H2 and 26H2), with the Windows 10 22H2 paths where they differ.

What OneCore-DeviceAssociationService error 3503 means

OneCore-DeviceAssociationService is the name Event Viewer shows in the Source column for the event provider Microsoft-Windows-DeviceAssociationService. The events come from the Device Association Service, which Microsoft describes in one sentence: it "enables pairing between the system and wired or wireless devices". Pairing a Bluetooth mouse, adding a network printer and casting to a wireless display all pass through it.

Event 3503 says that one search for devices was cut short. On current builds its whole text is one sentence: "Device Association Service detected an endpoint discovery failure". On the first 24H2 builds users quoted it as "The Device Association Service detected an error discovering endpoints." An endpoint here is a device that Windows can find over a wireless or network protocol.

• Other spellings. OneCore Device Association Service, one core device association error, OneCore-DeviceAssociation and DeviceAssociationService all mean this one source. DAS in the event data is short for Device Association Service.
• An event number, not an error code. 3503 and 3502 are IDs inside this one source. Other programs use the same numbers for unrelated messages, so always read the Source column too.
• Other languages. The text is translated with Windows. German: "Der Gerätezuordnungsdienst hat einen Fehler bei der Endpunktermittlung erkannt." Dutch, for 3502: "Apparaat onkoppelen (ontkoppelen) is mislukt." The ID stays the same.
• Not Autopilot. Microsoft also uses the words device association for a Windows Autopilot feature for company PCs. That feature has nothing to do with these events.

Events 3502, 3503, 3505 and 3509: what each one tells you

Most readers of this page search for 3502, not 3503. The two come from the same source but say different things, and only some of them point at a device. Microsoft publishes no list of these events, so the table is built from event text and event XML that users posted on Microsoft Q&A. Fix 1 shows how to print the full list from your own PC.

• AepId is the identity of an association endpoint, the name Microsoft's device documentation uses for a device found over a wireless or network protocol. In the reports it has the form protocol, a # sign, then an address.
• Two real examples. WiFiDirect#FE:8F:90:1E:7E:30 came from a laptop that could not cast to a wireless display. EsclUsb#{4fac19e4-6bad-5001-bf83-cd0f7905279b} came with the client process spoolsv.exe, the Print Spooler, so a printer or scanner was involved.
• ProtocolError is shown in decimal. The value 2154037265 from both reports is 0x80640011 in hexadecimal. We found no Microsoft page that explains that code.
• 2147549183 in the 3505 report is 0x8000FFFF, which Microsoft lists as E_UNEXPECTED, "Unexpected failure". It tells you that the step failed, not why.
• ClientProcessName is the program that asked the service to act. svchost.exe is a Windows service host and tells you little. spoolsv.exe points to printing.

Why the OneCore Device Association Service error appears

Microsoft has not published a cause. The order below follows how well each explanation is supported: by event data, by a reply from Microsoft's community support, or only by user reports. A forum report is never proof, and each row says what it rests on.

• A hypervisor driver, as a report only. One Microsoft Q&A user saw 3503 together with a Service Control Manager error 7000 for the driver l1vhlwf (Nested Network Virtualization). The same user later saw both errors on a PC without that Windows feature, so the link is unproven.
• A firewall rule, as a report only. One forum user stopped the events with an inbound allow rule for Device Association Framework Provider Host. A second user who made the same rule still got them. We do not recommend opening the firewall for a log entry.
• Network adapters, as a guess. Forum users suspect an unused Wi-Fi adapter or a network driver that stops early. Nobody showed evidence for it.
• Corrupted system files and malware. Nothing in any source ties them to these events. A system file check does no harm, but do not expect it to change the log.

When you can ignore the error and when you cannot

Event Viewer records what Windows components say about themselves, and the level Error is chosen by the component, not by its effect on you. A healthy Windows 11 PC logs errors at every shutdown. What counts is whether something you use is broken.

How to deal with OneCore-DeviceAssociationService errors 3503 and 3502

Fix 1 and Fix 2 are the diagnosis. They take five minutes, change nothing and tell you whether there is anything to repair. Fix 3 to Fix 6 are for a device or printer that really fails. Fix 7 and Fix 8 are only for a pairing problem that began right after an update. Do not work through all of them for a log entry.

Fix 1. Read the event details to see which device and which program it names

5 minutesNo riskEveryone who found these errors and wants to know what they are about.

The text of these events is one short sentence, and everything useful sits in the fields behind it. The ID tells you whether a device is named at all, AepId tells you which one, and ClientProcessName tells you which program asked.

1. Press Win + R, type eventvwr and select OK.
2. Expand Windows Logs and select System.
3. Double-click one error whose Source is OneCore-DeviceAssociationService.
4. Note the Event ID and the Logged time on the General tab.
5. Open the Details tab and read the fields under EventData.
6. For 3502 and 3505, copy the value of AepId. The part before the # is the protocol, the part after it is the address of the device.
7. Read ClientProcessName. If it ends with spoolsv.exe, the event is about a printer or scanner.

PowerShell (as administrator): every event of this source in the last 7 days, with its fields on one line

Get-WinEvent -FilterHashtable @{ LogName='System'; ProviderName='Microsoft-Windows-DeviceAssociationService'; StartTime=(Get-Date).AddDays(-7) } |
  ForEach-Object {
    $x = [xml]$_.ToXml()
    [pscustomobject]@{
      Time = $_.TimeCreated
      Id   = $_.Id
      Data = ($x.Event.EventData.Data | ForEach-Object { $_.Name + '=' + $_.'#text' }) -join ' | '
    }
  } | Format-List

To open PowerShell as administrator, right-click Start and select Terminal (Admin). On Windows 10, search for PowerShell, right-click Windows PowerShell and select Run as administrator. If the command says that no events were found, the PC has logged none in that week. Raise the -7 to look further back.

PowerShell: the full list of events this source can write on your build, with their text

(Get-WinEvent -ListProvider Microsoft-Windows-DeviceAssociationService).Events |
  Format-Table Id, Description -Wrap

• Match an address to a device. For a Bluetooth or Wi-Fi Direct address, remove the colons and search the installed devices: Get-PnpDevice | Where-Object InstanceId -like '*FE8F901E7E30*'. No result means that Windows has no installed device with that address. It was a device nearby, or one that was removed.
• A second log. A reply on Microsoft Q&A points to Applications and Services Logs > Microsoft > Windows > DeviceAssociationFramework > Operational, where a warning at the same time can hold a device instance ID. In that thread it showed nothing useful, so do not count on it.
• Check that the log exists. Get-WinEvent -ListLog *DeviceAssoc* lists the logs with that word in their name on your PC, with the number of records in each.

Fix 2. Check whether the errors are logged only while Windows shuts down

5 minutesNo riskYou have event 3503, or any of these errors, and every device you use works.

Users who timed event 3503 found it about two seconds before the PC powered off, when other services had already stopped. If your errors sit only in that window, nothing fails while you work, and there is nothing to repair.

PowerShell (as administrator): shutdown and start markers next to the device association errors, oldest first

Get-WinEvent -FilterHashtable @{ LogName='System'; Id=12,13,1074,6005,6009,3502,3503,3505,3509; StartTime=(Get-Date).AddDays(-7) } |
  Sort-Object TimeCreated |
  Format-Table TimeCreated, Id, ProviderName -AutoSize

1. Run the command above in PowerShell as administrator.
2. Find a row with ID 1074 from User32. It marks a shutdown or restart that somebody or something requested.
3. Find the next row with ID 13 from Microsoft-Windows-Kernel-General: "The operating system is shutting down".
4. Check whether your 3503 rows stand between those two rows and the next ID 12, which marks the following start.
5. Repeat for two or three shutdowns in the list.
6. Ignore rows with these numbers from other providers. Event IDs repeat across sources, which is why the table shows ProviderName.

Fix 3. Remove the device that fails and pair it again

5 minutesLow riskA Bluetooth or wireless device will not pair or reconnect, or events 3502 and 3505 name a device you know.

Windows keeps a record of every paired device. Event 3502 means removing such a record failed, and 3505 means creating one failed. Removing the device in Settings and pairing it from scratch replaces a record that may be damaged.

1. Windows 11: open Start > Settings > Bluetooth & devices > Devices. Windows 10: open Start > Settings > Devices > Bluetooth & other devices.
2. Windows 11: select More options next to the device, then Remove device and Yes. Windows 10: select the device, then Remove device and Yes.
3. Put the device into pairing mode. A Microsoft support specialist advises holding the pairing button of a mouse for 5 to 10 seconds, until its light blinks.
4. Windows 11: select the Bluetooth quick setting on the taskbar, then the Manage Bluetooth devices chevron, and pick the device under New devices.
5. Windows 10: select Add Bluetooth or other device, then Bluetooth, and pick the device.
6. Follow any instructions on screen and select Done.
7. Open Event Viewer and check whether a new 3505 or 3502 was logged at the time of the attempt.

• The device is not in the list. On Windows 11, set Bluetooth devices discovery to Advanced under Settings > Bluetooth & devices > Devices. With the default setting Windows hides some kinds of devices.
• Basics first. Microsoft's checklist: the device is charged, switched on and in range, Airplane mode is off, and the device is not next to a USB 3.0 port, which can interfere with Bluetooth.
• Let Windows check. Windows 11: Settings > System > Troubleshoot > Other troubleshooters, then Run next to Bluetooth. Windows 10: Settings > Update & Security > Troubleshoot, select Bluetooth, then Run the troubleshooter.
• A device that is paired to something else. Many headsets and mice reconnect to the last phone or PC they knew. Switch Bluetooth off on that other device for the test.

Fix 4. Check that the pairing services are running

5 minutesLow riskNo device can be added at all, pairing fails for every device, or the window for adding a device closes by itself.

Pairing needs three Windows services at once. The Device Association Service creates the pairing, the Bluetooth Support Service handles discovery and association of Bluetooth devices, and the Device Install Service installs what was found. If one is disabled, pairing fails.

PowerShell: the state and startup type of the three services

Get-Service -Name DeviceAssociationService, bthserv, DeviceInstall |
  Format-Table Name, DisplayName, Status, StartType -AutoSize

1. Press Win + R, type services.msc and press Enter.
2. Find Device Association Service and read its Status and Startup Type columns.
3. If the startup type is Disabled, double-click the service, set Startup type to Automatic and select Apply.
4. If the service is not running, right-click it and select Start. If it is running, select Restart.
5. Do the same check for Bluetooth Support Service and Device Install Service. Do not leave either of them Disabled.
6. Try to pair the device again.

Every step of the Services window, with the startup types explained: Check and restart Windows services

Fix 5. Reinstall the Bluetooth or Wi-Fi adapter driver

10 minutesLow riskPairing fails for several devices, or the device named in the event still fails after Fix 3 and Fix 4.

The service only coordinates pairing. The radio work is done by the driver of the Bluetooth or Wi-Fi adapter, and a driver left in a bad state after an upgrade can fail every association. Microsoft's Bluetooth guide ends with exactly this step.

1. Right-click Start and select Device Manager.
2. Expand Bluetooth and find the adapter. Its name often contains the word radio, or the name of the maker, such as Intel, Realtek or MediaTek.
3. First try the mild way: right-click the adapter and select Update driver, then Search automatically for updated driver software.
4. If nothing changes, right-click the adapter and select Uninstall device, then Uninstall.
5. Shut the PC down, wait a few seconds and turn it on again. Windows installs the driver again.
6. If the adapter does not come back, open Device Manager and select Action > Scan for hardware changes.
7. Pair the device again as in Fix 3.

The driver steps for both Windows versions, including rollback and optional driver updates: Update, roll back or reinstall a driver

• Casting and Wi-Fi Direct. If the AepId starts with WiFiDirect#, the device talks over the Wi-Fi adapter. Do the same steps under Network adapters for the wireless adapter.
• The maker's driver. If Windows installs nothing or the same driver fails again, Microsoft's advice is to download the driver from the website of the PC or adapter maker and install it by hand.
• A wired keyboard and mouse. While the Bluetooth adapter is uninstalled, Bluetooth input devices do not work. Have wired ones ready.

Fix 6. Remove and add the printer or scanner the event points to

15 minutesLow riskClientProcessName in the event ends with spoolsv.exe, the AepId starts with EsclUsb, or the errors repeat while a printer is installed.

The Print Spooler asks the Device Association Service about network and USB printers and scanners. When a stored printer entry cannot be associated or removed, the spooler retries, and each retry is one more 3502 or 3509 in the log.

1. Windows 11: open Start > Settings > Bluetooth & devices > Printers & scanners. Windows 10: open Start > Settings > Devices > Printers & scanners.
2. Windows 11: select the printer, select Remove and confirm with Yes. Windows 10: select the printer and select Remove device.
3. Type services in the search box on the taskbar and open Services.
4. Double-click Print Spooler, select Stop, then OK.
5. Open the folder %WINDIR%\system32\spool\PRINTERS and delete the files in it. They are waiting print jobs.
6. In Services, double-click Print Spooler again, select Start, check that Startup type is Automatic and select OK.
7. Turn the printer on and connect it.
8. Windows 11: select Add device next to Add a printer or scanner. Windows 10: select Add a printer or scanner, pick the printer, then Add device.
9. Watch the System log for an hour and compare the number of new errors with before.

• The printer app of the maker. In a Microsoft Q&A thread about 3509 with an HP printer, a community answer suggests removing the maker's full software, installing only the basic driver and adding the printer by its IP address. It is a reasonable test, not a confirmed fix.
• Test by switching the printer off. The same answer asks whether the errors stop when the printer is off or disconnected for a day. That is the cheapest way to prove or clear the printer.
• The troubleshooter. Microsoft's printer guide starts with the printer troubleshooter in the Get Help app. Run it before removing anything if the printer also fails to print.

Fix 7. Test pairing with fast startup turned off

5 minutesNo riskA device pairs after a restart but fails after a normal shutdown and power-on, or pairing became unreliable for no clear reason.

With fast startup, a shutdown saves the state of Windows drivers and loads it back at the next power-on, so a Bluetooth driver in a bad state survives. A Microsoft community support specialist lists turning it off among the steps for event 3505.

1. Press Win + R, type powercfg.cpl and select OK.
2. In the left pane, select Choose what the power buttons do.
3. Select Change settings that are currently unavailable, then Yes when Windows asks for permission.
4. Under Shutdown settings, clear Turn on fast startup (recommended).
5. Select Save changes.
6. Shut the PC down with Start > Power > Shut down and turn it on again.
7. Try to pair the device as in Fix 3.
8. If nothing changed, tick the box again the same way. Fast startup was not the cause.

The full procedure, and what to do when the box is missing: Turn off Fast Startup This setting does not remove event 3503. It only helps when a device fails to pair after a shutdown.

Fix 8. Remove the latest Windows quality update as a test

20 minutesRead the warningA device paired fine until a Windows update was installed, and Fix 3 to Fix 5 did not bring it back.

For one pairing failure with event 3505 on Windows 11 24H2, a Microsoft community support specialist wrote that the January 2025 cumulative update KB5050009 may be related and advised removing it first. The same test tells you whether your update is involved.

1. Open Settings > Windows Update > Update history and note the KB number and date of the newest quality update.
2. Compare that date with the first 3505 or 3502 error from Fix 1. If the errors are older than the update, stop: the update is not the cause.
3. Scroll to Related settings and select Uninstall updates.
4. Select Uninstall next to that update and restart the PC.
5. Pause updates for a week, so that the same update is not installed again at once.
6. Pair the device again as in Fix 3.

The paths for Windows 10 and the way to pause updates: How to uninstall a Windows update The upgrade to 24H2 itself is a feature update and is not removed this way. If a driver changed on the same day, a restore point from before it can undo both: Undo recent changes with System Restore

If a device still fails to pair: what to collect and when it is hardware

If your only symptom is the log entry, there is nothing more to do, and no setting we can honestly recommend makes event 3503 go away. If a device still does not pair after Fix 3 to Fix 8, collect the facts below before you contact the device maker or Microsoft.

• The output of the first command in Fix 1, saved as text. It holds the ID, the time and every field of each event.
• The Windows version and build. Press Win + R, type winver and note the version and the OS build number.
• The adapter and its driver. In Device Manager, the name of the Bluetooth or Wi-Fi adapter and the Driver Version and Driver Date from its Driver tab.
• What changed. The KB number and date of the last update, and whether a driver, a printer app or security software was installed that week. Reliability Monitor (perfmon /rel) shows this day by day.
• The exact moment. Whether the error comes when you pair, when you remove, at shutdown or all the time.

How to keep these errors from getting in your way

A word on the log filling up. The System log overwrites its oldest entries when it is full. One 3502 every two seconds, as a user described on Microsoft Q&A in April 2026, is about 43,000 entries a day, and that does push useful history out. In that case finding the device or printer behind it (Fix 1, Fix 6) is worth the time even when everything works.

Frequently asked questions

What is the OneCore Device Association Service?

It is the Windows service that pairs the PC with devices. Its display name is Device Association Service and its service name is DeviceAssociationService. Microsoft describes it as the service that "enables pairing between the system and wired or wireless devices". OneCore-DeviceAssociationService is how Event Viewer shows the source of its events, and the full provider name is Microsoft-Windows-DeviceAssociationService. Bluetooth pairing, adding printers and scanners, and connecting to wireless displays all use it. It is a part of Windows, not a third-party program, and it should stay enabled.

Is OneCore-DeviceAssociationService error 3503 something to worry about?

No, as long as your devices work. Event 3503 reads "Device Association Service detected an endpoint discovery failure" and is logged while Windows shuts down or restarts. Its details name no device, only an internal error number. Reports started with Windows 11 24H2, on upgraded and on freshly installed PCs, and users describe no effect beyond the log entry. Microsoft has not published a known issue or a fix for it. Worry only when a Bluetooth device, a printer or a wireless display stops connecting. Then follow Fix 1 and Fix 3 for that device.

What does event ID 3502, "Device disassociation (unpairing) failed", mean?

It means the service tried to remove the stored pairing of one device and could not. Unlike 3503, this event names the device: open the Details tab and read AepId, which holds a protocol and an address, such as WiFiDirect followed by a MAC address. The field ClientProcessName shows which program asked. A reply on Microsoft Q&A says the event usually does not mean that something is broken. If the named device works, or is long gone, treat it as noise. If you cannot remove or reconnect a device, use Fix 3.

How do I find which device the error is about?

Open the event in Event Viewer, select the Details tab and look for AepId under EventData. Events 3502 and 3505 have it. The part before the # sign is the protocol and the part after it is the device address. The PowerShell command in Fix 1 prints these fields for every event of the last week. Event 3503 has no such field, so for 3503 there is no device to find. If ClientProcessName ends with spoolsv.exe, the request came from the Print Spooler, and the device is a printer or scanner.

Should I disable the Device Association Service or set it to Manual?

No. Users on Microsoft Q&A report that Windows 11 24H2 sets the service back to Automatic at the next restart when you choose Manual, so that change does nothing. Disabled stays in place and stops the errors, but it also stops pairing, and a Microsoft support specialist lists this service among those that must run for Bluetooth pairing to work. Microsoft's service guidance for Windows Server gives no recommendation to disable it either. Hiding a harmless log entry is not worth losing the ability to add devices.

Why did the errors start after the update to Windows 11 24H2?

We do not know for certain, and Microsoft has not said. The first reports are from August to December 2024, on builds 26100.1591 and 26100.2454, and users in one thread noted that the same PCs on 23H2 did not log the event. Users who watched the timing saw 3503 about two seconds before power-off and concluded that the service was still searching for devices when other services had stopped. That fits a change in shutdown order or in logging, not a fault in your hardware. It also explains why clean installs show it.

Does error 3503 slow down the shutdown or restart of my PC?

Usually not. Most users who reported the event saw no delay. One user on Microsoft Q&A did report a restart that hung for several minutes on a new workstation with 3503 as the only critical entry, but nobody showed that the event caused the hang instead of just being logged during it. If your restarts are slow, check the timing with Fix 2 and the services with Fix 4, and disconnect USB and network devices one at a time for a test.

What are events 3505 and 3509 from the same source?

They belong to the same family. Event 3505 appears when adding a device fails. A user who could not pair a Bluetooth mouse quoted its text as "Device Association Failed - Enumerate Ceremonies", and its details hold AepId and ProtocolError like 3502. For 3509 we could not confirm the text. A Microsoft community support reply says it generally indicates a device connection failure, and in one report its client process was spoolsv.exe, with a wireless printer installed. The command in Fix 1 that lists the provider's events shows the exact wording on your build.

Will a system file check, a driver update or a Windows reset remove the error?

For event 3503, we found no report that any of them did. Users with fully clean installs and with clean results from DISM and the system file checker still had it. A driver update or reinstall is worth doing only when a device really fails to pair, and then for the Bluetooth or Wi-Fi adapter, not for every device in Device Manager. Resetting Windows Update components, a clean boot and a Windows reset have no connection to this service. They cost time and settings, and the entry returns at the next restart.

Is this error a sign of malware?

No. The event comes from a Windows component, its provider is registered by Windows itself, and nothing in Microsoft's documentation or in the user reports connects it to malicious software. The process named in the event, svchost.exe in the System32 folder, is the normal host of Windows services. If you have other reasons to suspect an infection, such as unknown programs or changed browser settings, run a scan with Windows Security. Do not treat this log entry as evidence in either direction.