WNS push channel

A WNS push channel is the address a cloud service uses to reach one app on one Windows device. When an app wants to receive push notifications, it asks Windows for a channel; Windows obtains a channel URI from the Windows Push Notification Services (WNS) and hands it to the app, which sends it to its own back-end server. From then on, the server posts toasts, tile updates, badges or raw data to that URI, and WNS delivers them to the device, where the notification platform stores and displays them.

Channel URIs are not permanent: Microsoft documents that they expire, so apps request fresh ones regularly. In wpndatabase.db, the WNSPushChannel table keeps them with the columns ChannelId, HandlerId, Uri, CreatedTime and ExpiryTime. The times are FILETIME values in UTC, and HandlerId links each channel to its notification handler.

Why it matters in investigations

A channel shows that an app was set up to receive notifications from the cloud, and its creation time tells you when it registered for push, even if no notification from it survives. A new channel created during an incident, or one belonging to an unfamiliar handler, is worth correlating with installation and execution artifacts. The older appdb.dat store also keeps a push URI in each chunk, which can help tie an unnamed chunk to an app.

Example

ChannelId   : 3
HandlerId   : 12  -> NotificationHandler.RecordId 12
Uri         : https://<region>.notify.windows.com/?token=<opaque token>
CreatedTime : 134338537240000000  (2026-09-14 10:02:04 UTC)
ExpiryTime  : later FILETIME, when Windows considers the channel stale

The token is meaningful only to WNS: identify the app through the handler, not the URI.

Related terms

• Notification handler
• PrimaryId (AppUserModelID)
• Toast notification

The Apps & channels view of the Windows Notification Parser lists each handler's push channels; the wpndatabase.db guide puts them in context.