Fields by providers

This table lists the most common Windows event providers and their associated fields.

Event value Task Operation Level Fields

Microsoft-Windows-AppLocker

8000

task_0

-

ERROR

$Status (integer)

8001

task_0

-

INFO

8002

task_0

-

INFO

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8003

task_0

-

WARNING

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8004

task_0

-

ERROR

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8005

task_0

-

INFO

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8006

task_0

-

WARNING

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8007

task_0

-

ERROR

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$FilePathLength (integer)

$FilePathBuffer (string)

$FileHashLength (integer)

$FileHash (string)

$FqbnLength (integer)

$Fqbn (string)

$TargetLogonId (string)

$FullFilePathLength (integer)

$FullFilePathBuffer (string)

8008

task_0

-

WARNING

$FilePathLength (integer)

$FilePathBuffer (string)

8009

task_0

-

WARNING

$FilePathLength (integer)

$FilePathBuffer (string)

8010

SrpPolicyConversion

win:Start

INFO

8011

SrpPolicyConversion

win:Stop

INFO

8012

SrpPolicyConversion

win:Stop

ERROR

8013

SrpPolicyRuleSort

win:Start

INFO

8014

SrpPolicyRuleSort

win:Stop

INFO

8015

SrpPolicyHitCountJoin

win:Start

INFO

8016

SrpPolicyHitCountJoin

win:Stop

INFO

8017

SrpPolicyLoad

win:Start

INFO

8018

SrpPolicyLoad

win:Stop

INFO

8019

SrpPolicyLoad

win:Stop

ERROR

8020

task_0

-

INFO

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8021

task_0

-

WARNING

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8022

task_0

-

ERROR

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8023

task_0

-

INFO

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8024

task_0

-

WARNING

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8025

task_0

-

ERROR

$PolicyNameLength (integer)

$PolicyNameBuffer (string)

$RuleId (string)

$RuleNameLength (integer)

$RuleNameBuffer (string)

$RuleSddlLength (integer)

$RuleSddlBuffer (string)

$TargetUser (string)

$TargetProcessId (integer)

$PackageLength (integer)

$PackageBuffer (string)

$FqbnLength (integer)

$Fqbn (string)

8026

task_0

-

ERROR

8027

task_0

-

ERROR

8028

task_0

-

WARNING

$FilePathLength (integer)

$FilePath (string)

$Sha1Hash (string)

$Sha256Hash (string)

$Result (integer)

$USN (integer)

$Sha1CatalogHash (string)

$Sha256CatalogHash (string)

8029

task_0

-

ERROR

$FilePathLength (integer)

$FilePath (string)

$Sha1Hash (string)

$Sha256Hash (string)

$Result (integer)

$USN (integer)

$Sha1CatalogHash (string)

$Sha256CatalogHash (string)

8030

task_0

-

INFO

$ImageNameLength (integer)

$ImageName (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$StatusCode (string)

$AppLockerReason (integer)

$Bucket (integer)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8030

task_0

-

-

$ImageNameLength (integer)

$ImageName (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$StatusCode (string)

$AppLockerReason (integer)

$Bucket (integer)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8031

task_0

-

INFO

$FileNameLength (integer)

$FileName (string)

$CurrentProcessLength (integer)

$CurrentProcess (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$DataLength (integer)

$Data (string)

8031

task_0

-

-

$FileNameLength (integer)

$FileName (string)

$CurrentProcessLength (integer)

$CurrentProcess (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$DataLength (integer)

$Data (string)

8032

task_0

-

ERROR

$ImageNameLength (integer)

$ImageName (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$StatusCode (string)

$AppLockerReason (integer)

$Bucket (integer)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8033

task_0

-

WARNING

$ImageNameLength (integer)

$ImageName (string)

$ParentProcessLength (integer)

$ParentProcess (string)

$StatusCode (string)

$AppLockerReason (integer)

$Bucket (integer)

$USN (integer)

$NtfsFileIdSize (integer)

$NtfsFileId (string)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8034

task_0

-

INFO

$ImageNameLength (integer)

$ImageName (string)

$StatusCode (string)

$Bucket (integer)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8035

task_0

-

ERROR

$ImageNameLength (integer)

$ImageName (string)

$StatusCode (string)

$Bucket (integer)

$OriginDataPresent (boolean)

$SessionId (string)

$SubSessionId (string)

$Origin (integer)

$Type (integer)

$Generation (integer)

$SmartScreen (integer)

$RevocationID (integer)

$DataLength (integer)

$Data (string)

8036

task_0

-

ERROR

$IsApproved (boolean)

$CLSID (string)

8037

task_0

-

INFO

$FilePathLength (integer)

$FilePath (string)

$Sha1Hash (string)

$Sha256Hash (string)

$Result (integer)

$USN (integer)

$Sha1CatalogHash (string)

$Sha256CatalogHash (string)

8038

task_0

-

INFO

$TotalSignatureCount (integer)

$Signature (integer)

$PublisherNameLength (integer)

$PublisherName (string)

$IssuerNameLength (integer)

$IssuerName (string)

$PublisherTBSHashSize (integer)

$PublisherTBSHash (string)

$IssuerTBSHashSize (integer)

$IssuerTBSHash (string)

Microsoft-Windows-Dhcp-Client

1000

AddressConfigurationStateEvent

LostIpAddress

WARNING

$Address (integer)

$HWLength (integer)

$HWAddress (string)

1001

AddressConfigurationStateEvent

IpAddressNotAssigned

ERROR

$HWLength (integer)

$HWAddress (string)

$StatusCode (integer)

1002

AddressConfigurationStateEvent

IpLeaseDenied

ERROR

$Address1 (integer)

$HWLength (integer)

$HWAddress (string)

$Address2 (integer)

1003

AddressConfigurationStateEvent

IpLeaseRenewalFailed

WARNING

$HWLength (integer)

$HWAddress (string)

$StatusCode (integer)

1004

ServiceStateEvent

ErrorServiceStop

ERROR

$StatusCode (integer)

$DwordVal (integer)

1005

AddressConfigurationStateEvent

IPConflict

WARNING

$Address (integer)

$HWLength (integer)

$HWAddress (string)

1006

AddressConfigurationStateEvent

AutoconfigurationFailed

WARNING

$HWLength (integer)

$HWAddress (string)

$StatusCode (integer)

1007

AddressConfigurationStateEvent

AutoconfigurationSuccess

INFO

$HWLength (integer)

$HWAddress (string)

$Address (integer)

1008

AddressConfigurationStateEvent

InitNetworkInterfaceFailed

ERROR

$StatusCode (integer)

1018

AddressConfigurationStateEvent

Dhcpv6InitFailed

ERROR

$StatusCode (integer)

50001

MediaStateEvent

MediaConnect

INFO

$InterfaceId (integer)

50002

MediaStateEvent

MediaDisconnect

INFO

$InterfaceId (integer)

50003

MediaStateEvent

MediaReconnect

INFO

$InterfaceId (integer)

50004

AddressConfigurationStateEvent

DhcpEnabled

INFO

$InterfaceId (integer)

50005

AddressConfigurationStateEvent

DhcpDisabled

INFO

$InterfaceId (integer)

50006

ProtocolStateEvent

InitRequestAck

INFO

$InterfaceId (integer)

50007

ProtocolStateEvent

InitDORA

INFO

$InterfaceId (integer)

50008

AddressConfigurationStateEvent

StaticToDhcp

INFO

$InterfaceId (integer)

50009

ProtocolStateEvent

DiscoverSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

50010

ProtocolStateEvent

OfferReceived

INFO

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

50011

ProtocolStateEvent

OfferDiscarded

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50012

ProtocolStateEvent

RequestSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

50013

ProtocolStateEvent

AckReceived

INFO

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

50014

ProtocolStateEvent

AckDiscarded

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50015

ProtocolStateEvent

NackReceived

ERROR

$InterfaceId (integer)

50016

ProtocolStateEvent

UnknownMessageDiscarded

WARNING

$InterfaceId (integer)

50017

ProtocolStateEvent

DeclineSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

50018

ProtocolStateEvent

InformSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

50019

ProtocolStateEvent

ReleaseSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

50020

ProtocolStateEvent

BroadcastbitToggled

INFO

$InterfaceId (integer)

$BoolFlag (boolean)

50021

ProtocolStateEvent

ErrorExtractingOptions

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50022

AddressConfigurationStateEvent

FallbackConfigSet

INFO

$InterfaceId (integer)

$Address (integer)

$StatusCode (integer)

50023

ProtocolStateEvent

OfferReceiveTimeout

WARNING

$InterfaceId (integer)

50024

ProtocolStateEvent

AckReceiveTimeout

WARNING

$InterfaceId (integer)

50025

ProtocolStateEvent

CancelRenewal

INFO

$InterfaceId (integer)

50028

AddressConfigurationStateEvent

AddressPlumbed

INFO

$Address (integer)

$InterfaceId (integer)

$StatusCode (integer)

50029

AddressConfigurationStateEvent

AddressUnplumbed

INFO

$Address (integer)

$InterfaceId (integer)

$StatusCode (integer)

50030

AddressConfigurationStateEvent

PlumbingError

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50032

AddressConfigurationStateEvent

LeaseExpired

INFO

$InterfaceId (integer)

$Address (integer)

50033

MediaStateEvent

InterfaceAdded

INFO

$InterfaceId (integer)

$StatusCode (integer)

50034

AddressConfigurationStateEvent

ErrorInitializeInterface

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50035

AddressConfigurationStateEvent

RouteUpdated

INFO

$InterfaceId (integer)

$StatusCode (integer)

50036

ServiceStateEvent

ServiceStart

INFO

50037

ServiceStateEvent

ServiceStop

INFO

$DwordVal (integer)

50038

ServiceStateEvent

ErrorInitService

ERROR

$StatusCode (integer)

50039

WinsockStateEvent

ErrorOpeningSocket

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50040

WinsockStateEvent

ErrorClosingSocket

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50041

DNSStateEvent

DomainChangeNotification

INFO

50042

DNSStateEvent

DnsRegistrationDone

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Dword (integer)

50043

DNSStateEvent

DnsDeregistrationDone

INFO

$InterfaceId (integer)

$StatusCode (integer)

50044

ProtocolStateEvent

InformAckReceived

INFO

$InterfaceId (integer)

50053

ProtocolStateEvent

NetworkError

ERROR

$InterfaceId (integer)

$StatusCode (integer)

50055

AddressConfigurationStateEvent

GatewayReachable

INFO

$Address (integer)

$InterfaceId (integer)

50056

AddressConfigurationStateEvent

GatewayUnreachable

ERROR

$InterfaceId (integer)

50058

AddressConfigurationStateEvent

SuccessfulLease

INFO

50059

AddressConfigurationStateEvent

RouteAdded

INFO

$Str1 (string)

$Str2 (string)

$Str3 (string)

$Str4 (string)

50060

AddressConfigurationStateEvent

RouteDeleted

INFO

$Str1 (string)

$Str2 (string)

$Str3 (string)

$Str4 (string)

50061

ProtocolStateEvent

OfferReceivedForDiagnostics

INFO

$InterfaceId (integer)

50062

AddressConfigurationStateEvent

StartGatewayReachabilityTest

INFO

$Address (integer)

$InterfaceId (integer)

50063

AddressConfigurationStateEvent

NLANotified

INFO

$InterfaceId (integer)

50064

AddressConfigurationStateEvent

CacheScavengerRun

INFO

$InterfaceId (integer)

50065

AddressConfigurationStateEvent

NetworkHintMatchFound

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

50066

AddressConfigurationStateEvent

MatchedAddressPlumbed

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

50067

AddressConfigurationStateEvent

NetworkHintReceived

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

50068

AddressConfigurationStateEvent

AddressAlreadyExists

ERROR

$Address (integer)

$InterfaceId (integer)

50069

ProtocolStateEvent

BroadcastbitCached

INFO

$BoolFlag (boolean)

$InterfaceId (integer)

50070

AddressConfigurationStateEvent

NetworkHintNotReceived

INFO

$InterfaceId (integer)

50071

AddressConfigurationStateEvent

NetworkHintMatchNotFound

INFO

$NetworkHintString (string)

$NetworkHint (string)

$InterfaceId (integer)

50072

ProtocolStateEvent

DiagnosticsInitiated

INFO

$InterfaceId (integer)

50073

ProtocolStateEvent

DiagnosticsFailed

INFO

$InterfaceId (integer)

50074

ProtocolStateEvent

FirewallPortExempted

INFO

$DwordVal (integer)

$InterfaceId (integer)

$DwordVal1 (integer)

50075

ProtocolStateEvent

FirewallPortClosed

INFO

$DwordVal (integer)

$InterfaceId (integer)

$DwordVal1 (integer)

50076

AddressConfigurationStateEvent

MatchedAddressNotPlumbed

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

50077

ProtocolStateEvent

AggressiveRetryOn

INFO

$InterfaceId (integer)

50081

ProtocolStateEvent

AbandonDiscovInCSSinceDhcp

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address (string)

50083

MediaStateEvent

AcquireNICReference

INFO

$InterfaceId (integer)

$StatusCode (integer)

50084

MediaStateEvent

ReleaseNICReference

INFO

$InterfaceId (integer)

$StatusCode (integer)

50085

ProtocolStateEvent

RegisterConflictDetectionNotification

INFO

$InterfaceId (integer)

$Address (integer)

50086

ProtocolStateEvent

ConflictDetectionComplete

INFO

$InterfaceId (integer)

$Address (integer)

$StatusCode (integer)

50087

ProtocolStateEvent

ConflictDetectionTentative

INFO

$InterfaceId (integer)

$Address (integer)

50088

NetworkParameterStateEvent

ParamChangeRegister

INFO

$ProcID (integer)

$UniqueID (integer)

$EventPath (string)

$ClassIDSize (integer)

$ClassID (string)

$OptListSize (integer)

$OptList (string)

$IsVendor (boolean)

50089

NetworkParameterStateEvent

ParamChangeUnregister

INFO

$ProcID (integer)

$UniqueID (integer)

50090

NetworkParameterStateEvent

ParamChangeNotification

INFO

$ProcID (integer)

$UniqueID (integer)

$StatusCode (integer)

50091

NetworkParameterStateEvent

ParamRequest

INFO

$InterfaceLUID (string)

$ClassIDSize (integer)

$ClassID (string)

$StandardOptListSize (integer)

$StandardOptList (string)

$VendorOptListSize (integer)

$VendorOptList (string)

50092

NetworkParameterStateEvent

ParamRequestUnblocked

INFO

$InterfaceLUID (string)

$InterfaceId (integer)

50093

NetworkParameterStateEvent

ParamRequestComplete

INFO

$InterfaceLUID (string)

$InterfaceId (integer)

$StatusCode (integer)

$OptDataSize (integer)

$OptData (string)

50094

ProtocolStateEvent

FirewallPortExemptionTriggered

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

50095

ProtocolStateEvent

FirewallPortCloseTriggered

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

50096

ProtocolStateEvent

AbandonDiscovInCSSinceStateless

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address (string)

50097

ProtocolStateEvent

AbandonDiscovInCSSinceStatic

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address (string)

50098

ProtocolStateEvent

DontStartDiscovInCSSinceV6Plumbed

INFO

$InterfaceId (integer)

$Address (string)

50099

ProtocolStateEvent

StartDiscovInCSSinceV6Unplumbed

INFO

$InterfaceId (integer)

50100

ProtocolStateEvent

StartDiscovInCSAtCompulsoryTime

INFO

$InterfaceId (integer)

50101

NetworkParameterStateEvent

NotifyCSEntry

INFO

50102

NetworkParameterStateEvent

NotifyCSExit

INFO

50103

ServiceStateEvent

ServiceShutdown

INFO

50104

ServiceStateEvent

ServiceShutdown

INFO

50105

ServiceStateEvent

ServiceShutdown

INFO

50106

ServiceStateEvent

ServiceShutdown

INFO

60000

ProtocolStateEvent

PerfTrackAckConfirm

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60001

ProtocolStateEvent

PerfTrackAckDORA

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60002

AddressConfigurationStateEvent

PerfTrackGatewayReachable

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60003

AddressConfigurationStateEvent

PerfTrackStatic

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60004

AddressConfigurationStateEvent

PerfTrackFallbackAddressSet

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$StatusCode (integer)

60005

ProtocolStateEvent

PerfTrackToggleRequestAck

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60006

ProtocolStateEvent

PerfTrackToggleDORAAck

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60007

ProtocolStateEvent

PerfTrackToggleInitDORA

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60010

ProtocolStateEvent

PerfTrackAckConfirm

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60011

ProtocolStateEvent

PerfTrackAckDORA

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60012

AddressConfigurationStateEvent

PerfTrackGatewayReachable

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60013

AddressConfigurationStateEvent

PerfTrackStatic

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60014

AddressConfigurationStateEvent

PerfTrackFallbackAddressSet

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$StatusCode (integer)

60015

ProtocolStateEvent

PerfTrackToggleRequestAck

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60016

ProtocolStateEvent

PerfTrackToggleDORAAck

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60017

ProtocolStateEvent

PerfTrackToggleInitDORA

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (integer)

$Address2 (integer)

60018

MediaStateEvent

PerfTrackMediaConnect

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60019

MediaStateEvent

PerfTrackMediaConnectEnd

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60020

MediaStateEvent

PerfTrackMediaReconnect

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60021

ProtocolStateEvent

PerfTrackDiscoverNetworkLatency

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60022

ProtocolStateEvent

PerfTrackDiscoverTimeout

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60023

ProtocolStateEvent

PerfTrackRequestNetworkLatency

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60024

ProtocolStateEvent

PerfTrackRequestNoResponse

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60025

AddressConfigurationStateEvent

PerfTrackFallbackAfterDiscover

INFO

$InterfaceGuid (string)

$Address (integer)

$InterfaceId (integer)

60026

AddressConfigurationStateEvent

ProcessDHCPRequestForeverEntered

INFO

60027

AddressConfigurationStateEvent

ProcessDHCPRequestForeverTimedout

INFO

60028

AddressConfigurationStateEvent

CreateRenewalSignalHandleFailed

ERROR

$StatusCode (integer)

60029

AddressConfigurationStateEvent

DeleteRenewTimerFailed

ERROR

$StatusCode (integer)

60030

AddressConfigurationStateEvent

ResetRenewalSignalHandleFailed

ERROR

$StatusCode (integer)

60031

AddressConfigurationStateEvent

CreateRenewTimerFailed

ERROR

$StatusCode (integer)

60032

AddressConfigurationStateEvent

ProcessDHCPRequestForeverFailed

ERROR

$StatusCode (integer)

Microsoft-Windows-DHCPv6-Client

1000

AddressConfigurationStateEvent

LostIpAddress

ERROR

$InterfaceGUID (string)

$HWLength (integer)

$HWAddress (string)

1003

AddressConfigurationStateEvent

LeaseRenewalFailed

ERROR

$HWLength (integer)

$HWAddress (string)

$StatusCode (integer)

1004

ServiceStateEvent

ErrorServiceStop

ERROR

$StatusCode (integer)

$DwordVal (integer)

1005

AddressConfigurationStateEvent

IPConflict

WARNING

$InterfaceGUID (string)

$HWLength (integer)

$HWAddress (string)

1006

MediaStateEvent

RAChanged

INFO

$InterfaceId (integer)

$Flag1 (boolean)

$Flag2 (boolean)

1008

AddressConfigurationStateEvent

InitNetworkInterfaceFailed

ERROR

$StatusCode (integer)

1009

ServiceStateEvent

DHCPv6DUIDValidationFailed

INFO

$HWLength (integer)

$HWAddress (string)

$DUIDLength (integer)

$DUID (string)

$NewHWLength (integer)

$NewHWAddress (string)

$NewDUIDLength (integer)

$NewDUID (string)

1010

AddressConfigurationStateEvent

DHCPv6NetworkHintMatch

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

1011

AddressConfigurationStateEvent

DHCPv6NetworkHintStatefullConfig

INFO

$Address1 (string)

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

1012

AddressConfigurationStateEvent

DHCPv6NetworkHintStatelessConfig

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

1013

AddressConfigurationStateEvent

DHCPv6NetworkHintConfigExpired

INFO

$NetworkHintString (string)

$NetworkHint (string)

$HWLength (integer)

$HWAddress (string)

50057

ProtocolStateEvent

NetworkError

ERROR

$StatusCode (integer)

50071

MediaStateEvent

AcquireNICReference

INFO

$InterfaceId (integer)

$StatusCode (integer)

50072

MediaStateEvent

ReleaseNICReference

INFO

$InterfaceId (integer)

$StatusCode (integer)

51001

MediaStateEvent

MediaConnect

INFO

$InterfaceId (integer)

51002

MediaStateEvent

MediaDisconnect

INFO

$InterfaceId (integer)

51004

ProtocolStateEvent

InitConfirmReply

INFO

$InterfaceId (integer)

51005

ProtocolStateEvent

InitSARR

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

$DwordVal2 (integer)

51006

ProtocolStateEvent

SolicitSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51007

ProtocolStateEvent

AdvertiseReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Address (string)

51008

ProtocolStateEvent

AdvertiseDiscarded

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51009

ProtocolStateEvent

RequestSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51010

ProtocolStateEvent

ReplyForRequestReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Address (string)

51011

ProtocolStateEvent

InvalidReplyForRequestReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51012

ProtocolStateEvent

RenewSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51013

ProtocolStateEvent

ReplyForRenewReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

51014

ProtocolStateEvent

InvalidReplyForRenewReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51015

ProtocolStateEvent

RebindSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51016

ProtocolStateEvent

ReplyForRebindReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

51017

ProtocolStateEvent

InvalidReplyForRebindReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51018

ProtocolStateEvent

ReleaseSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51019

ProtocolStateEvent

DeclineSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51020

ProtocolStateEvent

ReplyForDeclineReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

51021

ProtocolStateEvent

InvalidReplyForDeclineReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51022

ProtocolStateEvent

ConfirmSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51023

ProtocolStateEvent

ReplyForConfirmReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

51024

ProtocolStateEvent

InvalidReplyForConfirmReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51025

ProtocolStateEvent

InfoRequestSent

INFO

$InterfaceId (integer)

$StatusCode (integer)

51026

ProtocolStateEvent

ReplyForInfoRequestReceived

INFO

$InterfaceId (integer)

$StatusCode (integer)

51027

ProtocolStateEvent

InvalidReplyForInfoRequestReceived

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51029

ProtocolStateEvent

ErrorCreatingPacket

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51030

ProtocolStateEvent

ErrorExtractingOptions

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51031

AddressConfigurationStateEvent

StatefulToStateless

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Dword1 (integer)

$Dword2 (integer)

51032

AddressConfigurationStateEvent

StatelessToStateful

INFO

$InterfaceId (integer)

$StatusCode (integer)

51033

AddressConfigurationStateEvent

NonDhcpToStateful

INFO

$InterfaceId (integer)

$StatusCode (integer)

51034

AddressConfigurationStateEvent

NonDhcpToStateless

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Dword1 (integer)

$Dword2 (integer)

51035

AddressConfigurationStateEvent

StaticMode

INFO

$InterfaceId (integer)

$StatusCode (integer)

51036

ProtocolStateEvent

ErrorInParsing

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51037

ProtocolStateEvent

InformationRefreshTimeOptionReceived

INFO

$InterfaceId (integer)

$RefreshTime (integer)

51038

ProtocolStateEvent

InformationRefreshTimeExpired

INFO

$InterfaceId (integer)

51039

AddressConfigurationStateEvent

AddressPlumbed

INFO

$Address (string)

$InterfaceId (integer)

$StatusCode (integer)

51040

AddressConfigurationStateEvent

AddressUnplumbed

INFO

$Address (string)

$InterfaceId (integer)

$StatusCode (integer)

51043

MediaStateEvent

InterfaceAdded

INFO

$InterfaceId (integer)

$StatusCode (integer)

51044

AddressConfigurationStateEvent

ErrorInitializingInterface

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51045

AddressConfigurationStateEvent

ErrorPlumbingParameters

ERROR

$StatusCode (integer)

51046

ServiceStateEvent

ServiceStart

INFO

51047

ServiceStateEvent

ServiceStop

INFO

$DwordVal (integer)

51048

WinsockStateEvent

ErrorOpeningSocket

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51049

WinsockStateEvent

ErrorClosingSocket

ERROR

$InterfaceId (integer)

$StatusCode (integer)

51050

DNSStateEvent

DnsRegistrationDone

INFO

$InterfaceId (integer)

$StatusCode (integer)

$Dword (integer)

51051

DNSStateEvent

dnsDeregistrationDone

INFO

$InterfaceId (integer)

$StatusCode (integer)

51057

ServiceStateEvent

ServiceStopWithRefCount

INFO

$DwordVal (integer)

51058

AddressConfigurationStateEvent

StatefulToStateful

INFO

$InterfaceId (integer)

$StatusCode (integer)

51059

ProtocolStateEvent

InvalidMessageDiscarded

ERROR

51060

AddressConfigurationStateEvent

SetClassID

INFO

$InterfaceGUID (string)

$HWLength (integer)

$HWAddress (string)

51061

AddressConfigurationStateEvent

AddressAlreadyExists

ERROR

$Address (string)

$InterfaceId (integer)

51062

AddressConfigurationStateEvent

FailedToObtainLease

ERROR

$HWLength (integer)

$HWAddress (string)

$StatusCode (integer)

51063

ProtocolStateEvent

FirewallPortExempted

INFO

$DwordVal (integer)

$InterfaceId (integer)

$DwordVal1 (integer)

51064

ProtocolStateEvent

FirewallPortClosed

INFO

$DwordVal (integer)

$InterfaceId (integer)

$DwordVal1 (integer)

51065

AddressConfigurationStateEvent

ModeChanging

INFO

$InterfaceId (integer)

$NewMode (integer)

51066

ProtocolStateEvent

AggressiveRetryOn

INFO

$InterfaceId (integer)

51067

ProtocolStateEvent

AbandonSolicitInCSSinceDhcp

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address1 (integer)

$DwordVal2 (integer)

$DwordVal3 (integer)

51068

ProtocolStateEvent

AbandonSolicitInCSSinceStatic

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address1 (integer)

$DwordVal2 (integer)

$DwordVal3 (integer)

51069

ProtocolStateEvent

DontStartSolicitInCSSinceV4Plumbed

INFO

$InterfaceId (integer)

$Address1 (integer)

$DwordVal1 (integer)

$DwordVal2 (integer)

51070

ProtocolStateEvent

StartSolicitInCSSinceV4Unplumbed

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

$DwordVal2 (integer)

51073

ProtocolStateEvent

FirewallPortExemptionTriggered

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

51074

ProtocolStateEvent

FirewallPortCloseTriggered

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

51075

NetworkParameterStateEvent

NotifyCSEntry

INFO

51076

NetworkParameterStateEvent

NotifyCSExit

INFO

51077

ProtocolStateEvent

StartSolicitInCSAtCompulsoryTime

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

$DwordVal2 (integer)

51078

ProtocolStateEvent

EnableDhcpV6

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

51079

ProtocolStateEvent

DisableDhcpV6

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

51080

ProtocolStateEvent

NoProcessingSinceDhcpV6Disabled

INFO

$InterfaceId (integer)

51081

ProtocolStateEvent

AbandonSolicitInCSSinceV6Static

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address (string)

$DwordVal2 (integer)

$DwordVal3 (integer)

51082

ProtocolStateEvent

AbandonSolicitInCSSinceV6Stateless

INFO

$DwordVal1 (integer)

$InterfaceId (integer)

$Address (string)

$DwordVal2 (integer)

$DwordVal3 (integer)

51083

ProtocolStateEvent

AbandonSolicitSinceNonMulticast

INFO

$InterfaceId (integer)

51084

ProtocolStateEvent

NoteFlagValues

INFO

$InterfaceId (integer)

$DwordVal1 (integer)

$DwordVal2 (integer)

60000

ProtocolStateEvent

PerfTrackSARR

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

$Address1 (string)

60001

ProtocolStateEvent

PerfTrackInfoRequest

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60002

MediaStateEvent

PerfTrackMediaConnect

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

60003

MediaStateEvent

PerfTrackMediaConnectEnd

INFO

$InterfaceGuid (string)

$InterfaceId (integer)

Microsoft-Windows-Directory-Services-SAM-Utility

1

task_0

Opcode_SamDatabaseChangeEvent

INFO

Microsoft-Windows-Directory-Services-SAM

12288

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

12289

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

12291

task_0

-

ERROR

$__binLength (integer)

$LogStatus (string)

12293

task_0

-

ERROR

$AccountDistinguishedName (string)

12294

task_0

-

ERROR

$UserName (string)

$__binLength (integer)

$ErrorCode (string)

12295

task_0

-

INFO

$FilePath (string)

$__binLength (integer)

$WinError (string)

12296

task_0

-

INFO

$DirectoryPath (string)

$__binLength (integer)

$WinError (string)

12297

task_0

-

INFO

$ComputerName (string)

12298

task_0

-

ERROR

$ComputerName (string)

12299

task_0

-

WARNING

$__binLength (integer)

$ErrorCode (string)

12300

task_0

-

INFO

12301

task_0

-

INFO

12302

task_0

-

ERROR

$SecurityPackage (string)

$UserName (string)

$__binLength (integer)

$ErrorCode (string)

12303

task_0

-

ERROR

$AccountDistinguishedName (string)

12304

task_0

-

INFO

$AccountDistinguishedName (string)

$SystemAssignedAccountName (string)

12305

task_0

-

WARNING

$__binLength (integer)

$ErrorCode (string)

16384

task_0

-

INFO

$AccountName (string)

$__binLength (integer)

$ErrorCode (string)

16385

task_0

-

WARNING

$UserName (string)

$__binLength (integer)

$ErrorCode (string)

16386

task_0

-

WARNING

$__binLength (integer)

$ErrorCode (string)

16387

task_0

-

WARNING

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16388

task_0

-

WARNING

$__binLength (integer)

$ErrorCode (string)

16389

task_0

-

WARNING

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16390

task_0

-

WARNING

$__binLength (integer)

$ErrorCode (string)

16391

task_0

-

WARNING

$AccountDistinguishedName (string)

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16392

task_0

-

WARNING

$AccountSID (string)

$AccountDistinguishedName (string)

$__binLength (integer)

$ErrorCode (string)

16393

task_0

-

WARNING

$AccountDistinguishedName (string)

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16394

task_0

-

WARNING

$AccountRID (integer)

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16395

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16398

task_0

-

ERROR

$SecurityPackage (string)

$__binLength (integer)

$ErrorCode (string)

16399

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16400

task_0

-

INFO

$UserName (string)

$__binLength (integer)

$ErrorCode (string)

16401

task_0

-

INFO

$AccountName (string)

$GroupName (string)

$ErrorMessage (string)

$__binLength (integer)

$ErrorCode (string)

16402

task_0

-

INFO

$AccountName (string)

$GroupName (string)

$ErrorMessage (string)

$__binLength (integer)

$ErrorCode (string)

16403

task_0

-

INFO

$AccountName (string)

$ErrorMessage (string)

$__binLength (integer)

$ErrorCode (string)

16405

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16406

task_0

-

WARNING

$UserName (string)

$__binLength (integer)

$ErrorCode (string)

16407

task_0

-

WARNING

$GroupName (string)

$__binLength (integer)

$ErrorCode (string)

16408

task_0

-

INFO

16409

task_0

-

ERROR

$AccountName (string)

$__binLength (integer)

$ErrorCode (string)

16410

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16411

task_0

-

ERROR

$AccountName (string)

$__binLength (integer)

$ErrorCode (string)

16412

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16413

task_0

-

INFO

$AccountName (string)

$GroupName (string)

$ErrorString (string)

$__binLength (integer)

$BinaryData (string)

16642

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16643

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16644

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16645

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16646

task_0

-

ERROR

$ComputedRIDValue (integer)

$__binLength (integer)

$ErrorCode (string)

16647

task_0

-

INFO

16648

task_0

-

INFO

$__binLength (integer)

$ErrorCode (string)

16649

task_0

-

ERROR

$__binLength (integer)

$ErrorCode (string)

16651

task_0

-

ERROR

$ErrorMessage (string)

16652

task_0

-

INFO

16653

task_0

-

WARNING

$Maximum (integer)

16654

task_0

-

INFO

16655

task_0

-

INFO

$NewValue (integer)

16656

task_0

-

WARNING

$CeilingTriggerRid (integer)

16657

task_0

-

ERROR

$CeilingTriggerRid (integer)

16658

task_0

-

WARNING

$RemainingRids (integer)

16935

task_0

-

ERROR

$ComputerName (string)

$__binLength (integer)

$ErrorCode (string)

16936

task_0

-

ERROR

$ComputerName (string)

$__binLength (integer)

$ErrorCode (string)

16937

task_0

-

INFO

$ComputerName (string)

$__binLength (integer)

$ErrorCode (string)

16944

task_0

-

INFO

$OID (string)

$ErrorCode (integer)

16945

task_0

-

INFO

$OID (string)

$OIDObjectDN (string)

$ErrorCode (integer)

16946

task_0

-

INFO

$OID (string)

16947

task_0

-

ERROR

$OID (string)

$OIDObjectDN (string)

$GroupDN (string)

$GroupGUID (string)

$GroupSID (string)

$ErrorCode (integer)

16948

task_0

-

ERROR

$GroupDN (string)

$GroupGUID (string)

$GroupSID (string)

$Operation (string)

$ErrorCode (integer)

16949

task_0

-

ERROR

$OIDName (string)

$GroupName (string)

$GroupGUID (string)

$GroupSID (string)

$ErrorCode (integer)

16950

task_0

-

WARNING

$User (string)

$DroppedClaims (string)

16951

task_0

-

WARNING

$User (string)

$Errorcode (integer)

16952

task_0

-

ERROR

$User (string)

$Errorcode (integer)

16953

task_0

-

ERROR

$NotificationPackage (string)

$Registrykey (string)

$Registryvalue (string)

$Errorcode (integer)

16960

task_0

-

INFO

16961

task_0

-

WARNING

16962

task_0

-

INFO

$DefaultSDString (string)

16963

task_0

-

INFO

$RegistrySDString (string)

16964

task_0

-

WARNING

$MalformedSDString (string)

$DefaultSDString (string)

16965

task_0

-

WARNING

$ClientSID (string)

$ClientNetworkAddress (string)

16966

task_0

-

INFO

16967

task_0

-

INFO

16968

task_0

-

WARNING

$ClientSID (string)

$ClientNetworkAddress (string)

16969

task_0

-

WARNING

$Throttlewindow (integer)

$SuppressedMessageCount (integer)

16976

task_0

-

ERROR

$Status (string)

16977

task_0

-

INFO

$MinimumPasswordLength (integer)

$MinimumPasswordLengthAudit (integer)

16978

task_0

-

INFO

$AccountName (string)

$MinimumPasswordLength (integer)

$MinimumPasswordLengthAudit (integer)

16979

task_0

-

ERROR

$MinimumPasswordLength (integer)

16982

task_0

-

INFO

16983

task_0

-

INFO

16984

task_0

-

INFO

$NumberofRPCmethods (integer)

$ThrottleWindow (integer)

16985

task_0

-

INFO

$RPCMethod (string)

$UserAccountName (string)

$ClientSID (string)

$ClientNetworkAddress (string)

16986

task_0

-

WARNING

$AccountRidHex (string)

$AccountRid (integer)

$SavedAccountName (string)

$DeletedAccountNames (string)

16987

task_0

-

WARNING

$AccountRidHex (string)

$AccountRid (integer)

$DuplicatedAccountNames (string)

$RetainedAccountName (string)

16990

task_0

-

ERROR

$Accountname (string)

$AccountobjectClass (string)

$userAccountcontrol (integer)

$Calleraddress (string)

$CallerSID (string)

16991

task_0

-

ERROR

$SamAccountName (string)

Microsoft-Windows-DNS-Client

1000

DnsNoServerConfigV4

-

INFO

$Location (integer)

$Context (integer)

1001

DnsServerForInterface

-

INFO

$Interface (string)

$TotalServerCount (integer)

$Index (integer)

$DynamicAddress (integer)

$AddressLength (integer)

$Address (string)

1002

DnsServerQueryChange

-

INFO

$Interface (string)

$AddressLength (integer)

$Address (string)

1003

DnsServerValidationSuccess

-

INFO

$AddressLength (integer)

$Address (string)

1005

DnsServerValidationFailure

-

ERROR

$AddressLength (integer)

$Address (string)

1007

DnsMissingPrimarySuffix

-

ERROR

$ErrorCode (integer)

$Location (integer)

$Context (integer)

1008

DnsMissingPrimarySuffixSystem

-

WARNING

$ErrorCode (integer)

$Location (integer)

$Context (integer)

1009

DnsNonMatchingSuffix

-

ERROR

$DnsSuffix (string)

$AdSuffix (string)

1010

DnsNonMatchingSuffixSystem

-

WARNING

$DnsSuffix (string)

$AdSuffix (string)

1011

DnsHostFileError

-

ERROR

$ErrorCode (integer)

$Location (integer)

$Context (integer)

1012

DnsHostFileErrorSystem

-

ERROR

$ErrorCode (integer)

$Location (integer)

$Context (integer)

1013

DnsAllServersTimeout

-

ERROR

$QueryName (string)

$AddressLength (integer)

$Address (string)

1014

DnsAllServersTimeoutSystem

-

WARNING

$QueryName (string)

$AddressLength (integer)

$Address (string)

1015

DnsServerTimeout

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

1016

DnsNameError

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

1017

DnsAuthoritativeResponse

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

1018

DnsLinkLocal

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

$DnsAddressLength (integer)

$DnsAddress (string)

1019

DnsNoServerConfigV6

-

INFO

$Location (integer)

$Context (integer)

1020

DnsReadPolicyTable

-

INFO

$KeyName (string)

$DnsSecValidationRequired (integer)

$DnsQueryOverIPSec (integer)

$DnsEncryption (integer)

$DirectAccessServerList (string)

$RemoteIPSEC (integer)

$RemoteEncryption (integer)

$ProxyType (integer)

$ProxyName (string)

1021

DnsMatchPolicyInfo

-

INFO

$QueryName (string)

$KeyName (string)

$DnsSecValidationRequired (integer)

$DnsQueryOverIPSec (integer)

$DnsEncryption (integer)

$DirectAccessServerList (string)

$ProxyType (integer)

$ProxyName (string)

1022

DnsSecureNoFallback

-

INFO

$QueryName (string)

1023

DnsPolicySystemReadError

-

ERROR

$RuleName (string)

$ErrorCode (integer)

1024

DnsQueryBadXid

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

1025

DnsQueryInvalidServerIp

-

INFO

$QueryName (string)

$AddressLength (integer)

$Address (string)

1026

DnsQueryInvalidQuestion

-

INFO

$QueryName (string)

$ResponseQuestion (string)

$AddressLength (integer)

$Address (string)

1027

task_0

-

INFO

$QueryName (string)

1028

DnsMatchPolicyInfo

-

INFO

$QueryName (string)

$KeyName (string)

$DnsSecValidationRequired (integer)

$DnsQueryOverIPSec (integer)

$DnsEncryption (integer)

$DirectAccessServerList (string)

$ProxyType (integer)

$ProxyName (string)

$GenericServerList (string)

$IdnConfig (integer)

3000

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

3001

task_0

-

INFO

$Status (integer)

3002

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

3003

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$Status (integer)

3004

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

3005

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$Status (integer)

3006

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

$ServerList (string)

$IsNetworkQuery (integer)

$NetworkQueryIndex (integer)

$InterfaceIndex (integer)

$IsAsyncQuery (integer)

3007

task_0

-

INFO

$QueryName (string)

3008

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

$QueryStatus (integer)

$QueryResults (string)

3009

task_0

-

INFO

$QueryName (string)

$IsParallelNetworkQuery (integer)

$NetworkIndex (integer)

$InterfaceCount (integer)

$AdapterName (string)

$LocalAddress (string)

$DNSServerAddress (string)

3010

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$DnsServerIpAddress (string)

3011

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$DnsServerIpAddress (string)

$ResponseStatus (integer)

3012

task_0

-

INFO

$QueryName (string)

$NetworkIndex (integer)

$InterfaceCount (integer)

$AdapterName (string)

$LocalAddress (string)

3013

task_0

-

INFO

$QueryName (string)

$Status (integer)

$QueryResults (string)

3014

task_0

-

INFO

$QueryName (string)

3015

task_0

-

INFO

$QueryName (string)

3016

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

$InterfaceIndex (integer)

3018

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$QueryOptions (integer)

$Status (integer)

$QueryResults (string)

3019

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$InterfaceIndex (integer)

$NetworkIndex (integer)

3020

task_0

-

INFO

$QueryName (string)

$QueryType (integer)

$NetworkIndex (integer)

$InterfaceIndex (integer)

$Status (integer)

$QueryResults (string)

8001

DnsGenericError

-

ERROR

$ErrorCode (integer)

8002

DnsGenericError

-

ERROR

$ErrorCode (integer)

8003

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8004

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8005

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8006

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8007

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8008

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8009

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8010

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8011

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8012

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8013

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8014

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8015

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8016

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8017

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8018

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8019

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8020

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8021

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8022

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8023

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8024

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8025

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8026

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8027

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8028

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8029

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8030

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8031

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8032

DnsRegistration

-

INFO

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8033

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8034

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8035

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8036

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8037

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8038

DnsRegistration

-

WARNING

$AdapterName (string)

$HostName (string)

$AdapterSuffixName (string)

$DnsServerList (string)

$SentUpdateServer (string)

$Ipaddress (string)

$ErrorCode (integer)

8040

DnsInterception

-

WARNING

$DllName (string)

8042

DnsInterception

-

ERROR

$DllName (string)

60004

DnsNetError

-

ERROR

$ErrorCode (integer)

$Location (integer)

$Context (integer)

60005

DnsNetWarning

-

WARNING

$WarningCode (integer)

$Location (integer)

$Context (integer)

60006

DnsStateTransition

-

INFO

$NextState (integer)

$Context (integer)

60007

DnsContextUpdate

-

INFO

$Context (integer)

$UpdateReasonCode (integer)

60008

DnsPolicyReadError

-

ERROR

$RuleName (string)

$ErrorCode (integer)

60101

DnsV4Tuple

-

INFO

$SourceAddress (integer)

$SourcePort (integer)

$DestinationAddress (integer)

$DestinationPort (integer)

$Protocol (integer)

$ReferenceContext (integer)

60102

DnsV6Tuple

-

INFO

$SourceAddress (string)

$SourcePort (integer)

$DestinationAddress (string)

$DestinationPort (integer)

$Protocol (integer)

$ReferenceContext (integer)

60103

DnsInterfaceInfo

-

INFO

$IfGuid (string)

$IfIndex (integer)

$IfLuid (integer)

$ReferenceContext (integer)

Microsoft-Windows-Firewall-CPL

101

FwCplInitialize

win:Start

INFO

102

FwCplInitialize

win:Stop

INFO

103

LoadExceptionsInitialize

win:Start

INFO

104

LoadExceptionsInitialize

win:Stop

INFO

105

SetFirewallOn

win:Start

INFO

106

SetFirewallOn

win:Stop

INFO

107

SetFirewallOff

win:Start

INFO

108

SetFirewallOff

win:Stop

INFO

109

AddAppException

win:Start

INFO

110

AddAppException

win:Stop

INFO

111

AddPortException

win:Start

INFO

112

AddPortException

win:Stop

INFO

113

QUInitialize

win:Start

INFO

114

QUInitialize

win:Stop

INFO

115

QUUnblock

win:Start

INFO

116

QUUnblock

win:Stop

INFO

117

QUAskLater

win:Start

INFO

118

QUAskLater

win:Stop

INFO

Microsoft-Windows-Firewall

6400

task_0

-

ERROR

$CallerProcessName (string)

$ProcessId (integer)

$Publisher (string)

Microsoft-Windows-Kernel-Power

1

PowerTransition

win:Start

CRITICAL

$Reason (integer)

$Flags (integer)

$Time (string)

2

PowerTransition

win:Stop

CRITICAL

$Status (integer)

$Time (string)

3

QueryApps

PhaseStart

INFO

4

QueryApps

PhaseStop

INFO

$Status (integer)

5

QueryServices

PhaseStart

INFO

6

QueryServices

PhaseStop

INFO

$Status (integer)

7

Irp

win:Start

INFO

$Irp (string)

$PowerStateType (integer)

$MinorFunction (integer)

$TargetDevice (string)

$InstanceNameLength (integer)

$InstanceName (string)

7

Irp

win:Start

INFO

$Irp (string)

$PowerStateType (integer)

$MinorFunction (integer)

$TargetDevice (string)

$InstanceNameLength (integer)

$InstanceName (string)

$PowerState (integer)

8

Irp

win:Stop

INFO

$Irp (string)

$Status (integer)

$FailedDriver (string)

9

QueryApps

Veto

INFO

$Pid (integer)

$Window (string)

$AppNameLength (integer)

$AppName (string)

10

QueryServices

Veto

INFO

$Pid (integer)

$ServiceNameLength (integer)

$ServiceName (string)

11

IrpWaiting

-

INFO

$Irp (string)

12

QueryApps

win:Start

INFO

$Pid (integer)

$NameLength (integer)

$Name (string)

13

QueryApps

win:Stop

INFO

$Pid (integer)

14

QueryServices

win:Start

INFO

$NameLength (integer)

$Name (string)

15

QueryServices

win:Stop

INFO

$NameLength (integer)

$Name (string)

16

SuspendApps

win:Start

INFO

$Pid (integer)

$NameLength (integer)

$Name (string)

17

SuspendApps

win:Stop

INFO

$Pid (integer)

18

SuspendServices

win:Start

INFO

$NameLength (integer)

$Name (string)

19

SuspendServices

win:Stop

INFO

$NameLength (integer)

$Name (string)

20

Driver

win:Start

INFO

$Irp (string)

$Device (string)

$DriverName (string)

21

Driver

win:Stop

INFO

$Irp (string)

$Device (string)

22

SuspendApps

PhaseStart

INFO

23

SuspendApps

PhaseStop

INFO

24

SuspendServices

PhaseStart

INFO

25

SuspendServices

PhaseStop

INFO

26

ResumeApps

PhaseStart

INFO

27

ResumeServices

PhaseStart

INFO

28

ResumeApps

win:Start

INFO

$Pid (integer)

$NameLength (integer)

$Name (string)

29

ResumeServices

win:Start

INFO

$NameLength (integer)

$Name (string)

30

QueryFailedApps

-

INFO

31

QueryFailedServices

-

INFO

32

QueryFailedApp

-

INFO

$Pid (integer)

$NameLength (integer)

$Name (string)

33

QueryFailedService

-

INFO

$NameLength (integer)

$Name (string)

34

Hibernate

-

INFO

$Status (integer)

35

SuspendDevices

PhaseStart

INFO

$Query (boolean)

$TargetState (integer)

$EffectiveState (integer)

36

SuspendDevices

PhaseStop

INFO

37

WakeDevices

PhaseStart

INFO

38

WakeDevices

PhaseStop

INFO

39

PowerTransition

-

INFO

$SleepTime (integer)

$ResumeTime (integer)

$DriverWakeTime (integer)

$HiberWriteTime (integer)

$HiberReadTime (integer)

$HiberPagesWritten (integer)

$BiosInitTime (integer)

40

QueryDrivers

Veto

INFO

$DriverNameLength (integer)

$DriverName (string)

$InstanceNameLength (integer)

$InstanceName (string)

41

DirtyTransition

-

CRITICAL

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter (string)

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter1 (string)

$BugcheckParameter2 (string)

$BugcheckParameter3 (string)

$BugcheckParameter4 (string)

$SleepInProgress (boolean)

$PowerButtonTimestamp (integer)

$BootAppStatus (integer)

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter1 (string)

$BugcheckParameter2 (string)

$BugcheckParameter3 (string)

$BugcheckParameter4 (string)

$SleepInProgress (integer)

$PowerButtonTimestamp (integer)

$BootAppStatus (integer)

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter1 (string)

$BugcheckParameter2 (string)

$BugcheckParameter3 (string)

$BugcheckParameter4 (string)

$SleepInProgress (integer)

$PowerButtonTimestamp (integer)

$BootAppStatus (integer)

$Checkpoint (integer)

$ConnectedStandbyInProgress (boolean)

$SystemSleepTransitionsToOn (integer)

$CsEntryScenarioInstanceId (integer)

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter1 (string)

$BugcheckParameter2 (string)

$BugcheckParameter3 (string)

$BugcheckParameter4 (string)

$SleepInProgress (integer)

$PowerButtonTimestamp (integer)

$BootAppStatus (integer)

$Checkpoint (integer)

$ConnectedStandbyInProgress (boolean)

$SystemSleepTransitionsToOn (integer)

$CsEntryScenarioInstanceId (integer)

$BugcheckInfoFromEFI (boolean)

41

DirtyTransition

-

CRITICAL

$BugcheckCode (integer)

$BugcheckParameter1 (string)

$BugcheckParameter2 (string)

$BugcheckParameter3 (string)

$BugcheckParameter4 (string)

$SleepInProgress (integer)

$PowerButtonTimestamp (integer)

$BootAppStatus (integer)

$Checkpoint (integer)

$ConnectedStandbyInProgress (boolean)

$SystemSleepTransitionsToOn (integer)

$CsEntryScenarioInstanceId (integer)

$BugcheckInfoFromEFI (boolean)

$CheckpointStatus (integer)

42

PreSleepNotification

-

INFO

$TargetState (integer)

$EffectiveState (integer)

42

PreSleepNotification

-

INFO

$TargetState (integer)

$EffectiveState (integer)

$Reason (integer)

$Flags (integer)

42

PreSleepNotification

-

INFO

$TargetState (integer)

$EffectiveState (integer)

$Reason (integer)

$Flags (integer)

$TransitionsToOn (integer)

43

ZeroHiberFile

win:Start

INFO

44

ZeroHiberFile

win:Stop

INFO

45

FlushVolumes

win:Start

INFO

46

FlushVolumes

win:Stop

INFO

47

GracefulShutdown

win:Start

INFO

48

GracefulShutdown

win:Stop

INFO

49

ZeroPageFile

win:Start

INFO

50

ZeroPageFile

win:Stop

INFO

51

IoShutdownSystem

win:Start

INFO

52

IoShutdownSystem

win:Stop

INFO

53

WaitForProcesses

win:Start

INFO

54

WaitForProcesses

win:Stop

INFO

55

CmShutdownSystem

win:Start

INFO

56

CmShutdownSystem

win:Stop

INFO

57

ShowUI

PhaseStart

INFO

58

ShowUI

PhaseStop

INFO

59

AwayMode

-

INFO

60

UserQueryAllowed

-

INFO

$Value (boolean)

61

KernelQueryAllowed

-

INFO

$Value (boolean)

62

SetExecutionState

-

INFO

$ExecutionState (integer)

$AppNameLength (integer)

$AppName (string)

62

SetExecutionState

-

INFO

$ExecutionState (integer)

$AppNameLength (integer)

$AppName (string)

$Pid (integer)

$Tid (integer)

63

SystemTimeResolutionChange

-

INFO

$ExecutionState (integer)

$AppNameLength (integer)

$AppName (string)

63

SystemTimeResolutionChange

-

INFO

$RequestedResolution (integer)

$Pid (integer)

$AppNameLength (integer)

$AppName (string)

$SubProcessTag (integer)

64

Superfetch

PhaseStart

INFO

65

Superfetch

PhaseStop

INFO

66

Winlogon

PhaseStart

INFO

67

Winlogon

PhaseStop

INFO

68

PreSleepCallbacks

PhaseStart

INFO

69

PreSleepCallbacks

PhaseStop

INFO

70

HideUI

PhaseStart

INFO

71

HideUI

PhaseStop

INFO

72

IdleCheck

-

INFO

$Threshold (integer)

$LowestIdleness (integer)

$AverageIdleness (integer)

$AccruedIdleTime (integer)

$NonIdleIgnored (boolean)

$IdleToSleep (boolean)

$NonIdleReferences (boolean)

73

SetSystemState

-

INFO

$ExecutionState (integer)

74

RegisterSystemState

-

INFO

$ExecutionState (integer)

$StateHandle (string)

75

DeviceIdle

win:Start

INFO

76

DeviceIdle

win:Stop

INFO

77

DeviceIdleCheck

-

INFO

$Device (string)

$Pdo (string)

$InstancePathLength (integer)

$InstancePath (string)

$ConservativeTimeout (integer)

$PerformanceTimeout (integer)

$IdleTime (integer)

$BusyCount (integer)

$TotalBusyCount (integer)

$IdlePowerState (integer)

$CurrentPowerState (integer)

78

DiskIdleCheck

-

INFO

$Device (string)

$Timeout (integer)

$IgnoreThreshold (integer)

$IdleTime (integer)

$NonIdleTime (integer)

79

SkipTick

-

INFO

$Disabled (boolean)

$Overridden (boolean)

80

CoolingModeChange

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$CoolingModeLength (integer)

$CoolingMode (string)

81

PassiveCoolingDiagnostic

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingStateLength (integer)

$PassiveCoolingState (string)

$AffinityCount (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

$_PSL (boolean)

82

PassiveCoolingOperational

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingStateLength (integer)

$PassiveCoolingState (string)

$AffinityCount (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

$_PSL (boolean)

83

ActiveCoolingDiagnostic

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$ActiveCoolingStateLength (integer)

$ActiveCoolingState (string)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_TMP (integer)

84

ActiveCoolingOperational

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$ActiveCoolingStateLength (integer)

$ActiveCoolingState (string)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_TMP (integer)

85

CriticalTripPointExceededDiagnostic

-

ERROR

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$ShutdownTime (string)

$_CRT (integer)

86

CriticalTripPointExceededSystem

-

ERROR

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$ShutdownTime (string)

$_CRT (integer)

87

S4TripPointExceededDiagnostic

-

ERROR

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$HibernateTime (string)

$_HOT (integer)

88

S4TripPointExceededSystem

-

ERROR

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$HibernateTime (string)

$_HOT (integer)

89

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$AffinityCount (integer)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

$_PSL (string)

90

IllegalProcessorThrottleDiagnostic

-

WARNING

$ProcessorId (integer)

$ThrottleMSR (string)

$ElapsedTime (integer)

$LogInterval (integer)

91

IllegalProcessorThrottleOperational

-

WARNING

$ProcessorId (integer)

$ThrottleMSR (string)

$ElapsedTime (integer)

$LogInterval (integer)

92

CreatePowerRequest

-

INFO

$Token (string)

$Type (integer)

$ProcessID (integer)

$SessionID (integer)

$Legacy (boolean)

$SystemAllowed (boolean)

$DisplayAllowed (boolean)

$AwayModeAllowed (boolean)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

$CallerLength (integer)

$ContextLength (integer)

$Caller (string)

$Context (string)

92

CreatePowerRequest

-

INFO

$Token (string)

$Type (integer)

$ProcessID (integer)

$SessionID (integer)

$Legacy (boolean)

$SystemAllowed (boolean)

$DisplayAllowed (boolean)

$AwayModeAllowed (boolean)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

$CallerLength (integer)

$ContextLength (integer)

$Caller (string)

$Context (string)

$ExecutionRequiredAllowed (boolean)

$PerformanceBoostAllowed (boolean)

$FullScreenVideoAllowed (boolean)

$ExecutionRequiredCount (integer)

$PerformanceBoostCount (integer)

$FullScreenVideoCount (integer)

93

ChangePowerRequest

-

INFO

$Token (string)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

93

ChangePowerRequest

-

INFO

$Token (string)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

$ExecutionRequiredCount (integer)

$PerformanceBoostCount (integer)

$FullScreenVideoCount (integer)

94

ClosePowerRequest

-

INFO

$Token (string)

95

SystemTimeResolutionUpdate

-

INFO

$NewResolution (integer)

96

SystemTimeResolutionRundown

-

INFO

$CurrentPeriod (integer)

$MinimumPeriod (integer)

$MaximumPeriod (integer)

$KernelRequestCount (integer)

$KernelRequestedPeriod (integer)

96

SystemTimeResolutionRundown

-

INFO

$CurrentPeriod (integer)

$MinimumPeriod (integer)

$MaximumPeriod (integer)

$KernelRequestCount (integer)

$KernelRequestedPeriod (integer)

$InternalSetPeriod (integer)

97

SystemTimeResolutionRequestRundown

-

INFO

$RequestedPeriod (integer)

$Pid (integer)

$AppNameLength (integer)

$AppName (string)

98

SystemTimeResolutionKernelChange

-

INFO

$RequestedResolution (integer)

98

SystemTimeResolutionKernelChange

-

INFO

$RequestedResolution (integer)

$Tag (integer)

99

PowerRequestRundown

-

INFO

$Token (string)

$Type (integer)

$ProcessID (integer)

$SessionID (integer)

$Legacy (boolean)

$SystemAllowed (boolean)

$DisplayAllowed (boolean)

$AwayModeAllowed (boolean)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

$CallerLength (integer)

$ContextLength (integer)

$Caller (string)

$Context (string)

99

PowerRequestRundown

-

INFO

$Token (string)

$Type (integer)

$ProcessID (integer)

$SessionID (integer)

$Legacy (boolean)

$SystemAllowed (boolean)

$DisplayAllowed (boolean)

$AwayModeAllowed (boolean)

$SystemCount (integer)

$DisplayCount (integer)

$AwayModeCount (integer)

$CallerLength (integer)

$ContextLength (integer)

$Caller (string)

$Context (string)

$ExecutionRequiredAllowed (boolean)

$PerformanceBoostAllowed (boolean)

$FullScreenVideoAllowed (boolean)

$ExecutionRequiredCount (integer)

$PerformanceBoostCount (integer)

$FullScreenVideoCount (integer)

100

FlushAllPages

PhaseStart

INFO

101

FlushAllPages

PhaseStop

INFO

102

BuildNotifyList

PhaseStart

INFO

103

BuildNotifyList

PhaseStop

INFO

104

SleepDisableReasonRundown

-

INFO

$AffectedState (integer)

$PowerReasonCode (integer)

$PowerReasonLength (integer)

$PowerReasonInfo (string)

105

AcDcStateChange

-

INFO

$AcOnline (boolean)

105

AcDcStateChange

-

INFO

$AcOnline (boolean)

$RemainingCapacity (integer)

$FullChargeCapacity (integer)

106

AcDcStateRundown

-

INFO

$AcOnline (boolean)

107

PostSleepNotification

-

INFO

$TargetState (integer)

$EffectiveState (integer)

$WakeFromState (integer)

107

PostSleepNotification

-

INFO

$TargetState (integer)

$EffectiveState (integer)

$WakeFromState (integer)

$ProgrammedWakeTimeAc (string)

$ProgrammedWakeTimeDc (string)

$WakeRequesterTypeAc (integer)

$WakeRequesterTypeDc (integer)

108

PowerTransition

-

INFO

$CopyBytes (integer)

$ElapsedTime (integer)

$IoTime (integer)

$InitTime (integer)

$CopyTime (integer)

$PagesWritten (integer)

$PagesProcessed (integer)

$DumpCount (integer)

$FileRuns (integer)

$ReadTime (integer)

$ResumeAppTime (integer)

$CompressTime (integer)

109

ShutdownAction

-

INFO

$ShutdownActionType (integer)

$ShutdownEventCode (integer)

$ShutdownReason (integer)

110

SystemTimerResolutionStackRundown

-

INFO

$RequestedPeriod (integer)

$Pid (integer)

$AppNameLength (integer)

$AppName (string)

$StackSize (integer)

$Stack (string)

111

PowerSettingRundown

-

INFO

$SettingGuid (string)

$DataSize (integer)

$Data (string)

111

PowerSettingRundown

-

INFO

$SettingGuid (string)

$DataSize (integer)

$Data (string)

$Override (boolean)

112

PowerSettingChange

-

INFO

$SettingGuid (string)

$DataSize (integer)

$Data (string)

112

PowerSettingChange

-

INFO

$SettingGuid (string)

$DataSize (integer)

$Data (string)

$Override (boolean)

113

PassiveCoolingDiagnostic

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingState (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

113

PassiveCoolingDiagnostic

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingState (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

$MinimumThrottle (integer)

114

PassiveCoolingOperational

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingState (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

114

PassiveCoolingOperational

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$PassiveCoolingState (integer)

$_PSV (integer)

$_TMP (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$DeltaP (integer)

$MinimumThrottle (integer)

115

ActiveCoolingDiagnostic

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$ActiveCoolingState (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_TMP (integer)

116

ActiveCoolingOperational

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$EventTime (string)

$ActiveCoolingState (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_TMP (integer)

117

PowerTransition

-

INFO

$TotalResumeTime (integer)

$POSTTime (integer)

$ResumeBootMgrTime (integer)

$ResumeAppTime (integer)

$ResumeAppStartTime (integer)

$ResumeLibraryInitTime (integer)

$ResumeInitTime (integer)

$ResumeHiberFileTime (integer)

$ResumeRestoreImageStartTimestamp (integer)

$ResumeIoTime (integer)

$ResumeDecompressTime (integer)

$ResumeMapTime (integer)

$ResumeUnmapTime (integer)

$ResumeUserInOutTime (integer)

$ResumeAllocateTime (integer)

$ResumeKernelSwitchTimestamp (integer)

$KernelReturnFromHandlerTimestamp (integer)

$SleeperThreadEndTimestamp (integer)

$TimeStampCounterAtSwitchTime (integer)

$KernelReturnSystemPowerStateTimestamp (integer)

$HiberHiberFileTime (integer)

$InitTime (integer)

$HiberSharedBufferTime (integer)

$TotalHibernateTime (integer)

$KernelResumeHiberFileTime (integer)

$KernelResumeInitTime (integer)

$KernelResumeSharedBufferTime (integer)

$DeviceResumeTime (integer)

$KernelAnimationTime (integer)

$KernelPagesProcessed (integer)

$KernelPagesWritten (integer)

$BootPagesProcessed (integer)

$BootPagesWritten (integer)

$HiberWriteRate (integer)

$HiberCompressRate (integer)

$ResumeReadRate (integer)

$ResumeDecompressRate (integer)

$FileRuns (integer)

$NoMultiStageResumeReason (integer)

$MaxHuffRatio (integer)

117

PowerTransition

-

INFO

$TotalResumeTime (integer)

$POSTTime (integer)

$ResumeBootMgrTime (integer)

$ResumeAppTime (integer)

$ResumeAppStartTime (integer)

$ResumeLibraryInitTime (integer)

$ResumeInitTime (integer)

$ResumeHiberFileTime (integer)

$ResumeRestoreImageStartTimestamp (integer)

$ResumeIoTime (integer)

$ResumeDecompressTime (integer)

$ResumeMapTime (integer)

$ResumeUnmapTime (integer)

$ResumeUserInOutTime (integer)

$ResumeAllocateTime (integer)

$ResumeKernelSwitchTimestamp (integer)

$KernelReturnFromHandlerTimestamp (integer)

$SleeperThreadEndTimestamp (integer)

$TimeStampCounterAtSwitchTime (integer)

$KernelReturnSystemPowerStateTimestamp (integer)

$HiberHiberFileTime (integer)

$InitTime (integer)

$HiberSharedBufferTime (integer)

$TotalHibernateTime (integer)

$KernelResumeHiberFileTime (integer)

$KernelResumeInitTime (integer)

$KernelResumeSharedBufferTime (integer)

$DeviceResumeTime (integer)

$KernelAnimationTime (integer)

$KernelPagesProcessed (integer)

$KernelPagesWritten (integer)

$BootPagesProcessed (integer)

$BootPagesWritten (integer)

$HiberWriteRate (integer)

$HiberCompressRate (integer)

$ResumeReadRate (integer)

$ResumeDecompressRate (integer)

$FileRuns (integer)

$NoMultiStageResumeReason (integer)

$MaxHuffRatio (integer)

$SecurePagesProcessed (integer)

$HiberChecksumTime (integer)

$HiberChecksumIoTime (integer)

$ResumeChecksumTime (integer)

$ResumeChecksumIoTime (integer)

$KernelChecksumTime (integer)

$KernelChecksumIoTime (integer)

118

IdleResiliencyStart

-

INFO

$RequestedResolution (integer)

$Flags (integer)

$Ticks (integer)

119

IdleResiliencyEnd

-

INFO

$RequestedResolution (integer)

$Flags (integer)

$Ticks (integer)

120

PowerTransition

-

INFO

$HiberfileSizeKB (integer)

$TotalHibernateTime (integer)

$HiberHiberFileTime (integer)

121

PowerTransition

-

INFO

$DriverWakeTime (integer)

$TotalResumeTime (integer)

$BiosInitTime (integer)

121

PowerTransition

-

INFO

$DriverWakeTime (integer)

$TotalResumeTime (integer)

$BiosInitTime (integer)

$ResumeAppsTime (integer)

$ResumeServicesTime (integer)

122

PowerTransition

-

INFO

$TotalResumeTime (integer)

$PhasePagesWrittenMB (integer)

$ResumeAppAndKernelResumeHiberFileTime (integer)

$POSTAndDeviceResumeTime (integer)

$RatesAndResumeAppsServicesTime (integer)

$PhasePagesProcessedMB (integer)

123

PowerTransition

-

INFO

$HiberfileSize (integer)

$TotalHybridShutdownTime (integer)

$HiberfileCreateTime (integer)

$SystemShutdownTime (integer)

124

PowerTransition

-

INFO

$TotalResumeTime (integer)

$PhasePagesWrittenMB (integer)

$ResumeAppAndKernelResumeHiberFileTime (integer)

$POSTAndDeviceResumeTime (integer)

$RatesAndResumeAppsServicesTime (integer)

$PhasePagesProcessedMB (integer)

125

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

125

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

$MinimumThrottle (integer)

125

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

$MinimumThrottle (integer)

$_CR3 (integer)

$OverThrottleThreshold (integer)

125

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

$MinimumThrottle (integer)

$_CR3 (integer)

$OverThrottleThreshold (integer)

$DescriptionLength (integer)

$Description (string)

125

ThermalZoneEnumerated

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$_PSV (integer)

$_TC1 (integer)

$_TC2 (integer)

$_TSP (integer)

$_AC0 (integer)

$_AC1 (integer)

$_AC2 (integer)

$_AC3 (integer)

$_AC4 (integer)

$_AC5 (integer)

$_AC6 (integer)

$_AC7 (integer)

$_AC8 (integer)

$_AC9 (integer)

$_CRT (integer)

$_HOT (integer)

$MinimumThrottle (integer)

$_CR3 (integer)

$OverThrottleThreshold (integer)

$DescriptionLength (integer)

$Description (string)

$_TZP (integer)

126

task_0

-

INFO

$Level (integer)

$MinorFunction (integer)

127

task_0

-

INFO

$Level (integer)

$MinorFunction (integer)

128

task_0

-

INFO

$Level (integer)

$MinorFunction (integer)

129

task_0

-

INFO

$Level (integer)

$MinorFunction (integer)

130

PowerTransition

-

INFO

$SuspendStart (integer)

$SuspendEnd (integer)

131

PowerTransition

-

INFO

$ResumeCount (integer)

$FullResume (integer)

$AverageResume (integer)

132

FirmwarePlatformRoleRundown

-

INFO

$PlatformRole (integer)

133

ResumeApps

PhaseStop

INFO

134

ResumeServices

PhaseStop

INFO

135

task_0

-

INFO

$DisplayState (integer)

136

DeviceRundown

-

INFO

$DeviceNode (string)

$PowerState (integer)

$InstancePathLength (integer)

$InstancePath (string)

$FriendlyNameLength (integer)

$FriendlyName (string)

137

task_0

-

ERROR

$SleepState (integer)

138

ThermalPerfTrack

-

INFO

$Throttle (integer)

$Temperature (integer)

$ZoneLength (integer)

$Zone (string)

139

ThermalDurationPerfTrack

-

INFO

$ThrottleDuration (integer)

$ZoneLength (integer)

$Zone (string)

140

CsConsumptionPerfTrack

-

INFO

$EnergyDrain (integer)

$Duration (integer)

$DripsTransitions (integer)

$Flags (integer)

141

CsFanPerfTrack

-

INFO

$FanDuration (integer)

$ActivationDelay (integer)

142

AbnormalReset

-

CRITICAL

$ResetReasonMask (integer)

143

CsDripsWatchdogPerfTrack

-

INFO

$ResiliencyPhaseNonActivatedNoDripsMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$ActionsTakenAndOnAc (integer)

144

ThermalEvent

-

INFO

$InitiatorLength (integer)

$Initiator (string)

$Type (integer)

$Temperature (integer)

$TripPointTemperature (integer)

145

ThermalZoneRundown

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$ActiveCoolingState (integer)

$ActivePoint (integer)

$PassiveCoolingState (integer)

$ThrottleLimit (integer)

145

ThermalZoneRundown

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$ActiveCoolingState (integer)

$ActivePoint (integer)

$PassiveCoolingState (integer)

$ThrottleLimit (integer)

$ThermalStandby (boolean)

$OverThrottled (boolean)

145

ThermalZoneRundown

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$ActiveCoolingState (integer)

$ActivePoint (integer)

$PassiveCoolingState (integer)

$ThrottleLimit (integer)

$ThermalStandby (boolean)

$OverThrottled (boolean)

$DescriptionLength (integer)

$Description (string)

146

PowerSettingCallback

win:Start

INFO

$Callback (string)

$SettingGuid (string)

$DataSize (integer)

$Data (string)

147

PowerSettingCallback

win:Stop

INFO

$Callback (string)

$SettingGuid (string)

148

EnergySaverState

-

INFO

$State (integer)

$Reason (integer)

149

SessionDisplayOff

-

INFO

$Session (integer)

$Console (boolean)

$Reason (integer)

150

SessionDisplayOn

-

INFO

$Session (integer)

$Console (boolean)

$Reason (integer)

151

CoolingExtensionAdd

-

INFO

$PassiveSupported (boolean)

$ActiveSupported (boolean)

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$DeviceId (string)

152

CoolingExtensionRundown

-

INFO

$PassiveSupported (boolean)

$ActiveSupported (boolean)

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$DeviceId (string)

153

CoolingExtensionRemove

-

INFO

$PassiveSupported (boolean)

$ActiveSupported (boolean)

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$DeviceId (string)

154

CoolingExtensionPassiveUpdate

-

INFO

$Throttle (integer)

$Token (string)

155

CoolingExtensionActiveUpdate

-

INFO

$ActiveEngaged (boolean)

$Token (string)

156

ThermalRequestAdd

-

INFO

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$CallerLength (integer)

$ContextLength (integer)

$PolicyLength (integer)

$DeviceId (string)

$Caller (string)

$Context (string)

$Policy (string)

157

ThermalRequestRundown

-

INFO

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$CallerLength (integer)

$ContextLength (integer)

$PolicyLength (integer)

$DeviceId (string)

$Caller (string)

$Context (string)

$Policy (string)

158

ThermalRequestRemove

-

INFO

$Throttle (integer)

$ActiveEngaged (boolean)

$Token (string)

$DeviceIdLength (integer)

$CallerLength (integer)

$ContextLength (integer)

$PolicyLength (integer)

$DeviceId (string)

$Caller (string)

$Context (string)

$Policy (string)

159

ThermalRequestPassiveUpdate

-

INFO

$Throttle (integer)

$Token (string)

160

ThermalRequestActiveUpdate

-

INFO

$ActiveEngaged (boolean)

$Token (string)

161

CsDripsWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDripsMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$EnergyDrainMw (integer)

$DeviceConstraint (boolean)

$ActionsTaken (integer)

$DeviceServiceNameLength (integer)

$DeviceServiceName (string)

$ChildServiceNameLength (integer)

$ChildServiceName (string)

161

CsDripsWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDripsMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$EnergyDrainMw (integer)

$DeviceConstraint (boolean)

$ActionsTaken (integer)

$DeviceServiceNameLength (integer)

$DeviceServiceName (string)

$ChildServiceNameLength (integer)

$ChildServiceName (string)

$PepPreVeto (integer)

161

CsDripsWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDripsMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$EnergyDrainMw (integer)

$DeviceConstraint (boolean)

$ActionsTaken (integer)

$DeviceServiceNameLength (integer)

$DeviceServiceName (string)

$ChildServiceNameLength (integer)

$ChildServiceName (string)

$PepPreVeto (integer)

$InvocationCount (integer)

161

CsDripsWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDripsMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$EnergyDrainMw (integer)

$DeviceConstraint (boolean)

$ActionsTaken (integer)

$DeviceServiceNameLength (integer)

$DeviceServiceName (string)

$ChildServiceNameLength (integer)

$ChildServiceName (string)

$PepPreVeto (integer)

$InvocationCount (integer)

162

ThermalZoneThermalStandbyUpdate

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$Engaged (boolean)

163

ThermalZoneOverthrottledUpdate

-

INFO

$ThermalZoneDeviceInstanceLength (integer)

$ThermalZoneDeviceInstance (string)

$Engaged (boolean)

164

ThermalStandbyNotification

-

INFO

165

SystemIdle

-

INFO

$IdleInformationUpdated (boolean)

$TimeoutSource (integer)

$Action (integer)

$MinState (integer)

$Timeout (integer)

$Flags (integer)

165

SystemIdle

-

INFO

$IdleInformationUpdated (boolean)

$TimeoutSource (integer)

$Action (integer)

$MinState (integer)

$Timeout (integer)

$Flags (integer)

$Reason (integer)

166

SystemIdle

-

INFO

$AccumulatedIdleTime (integer)

$SystemIdle (boolean)

$Flags (integer)

$Action (integer)

$MinState (integer)

$DozeS4Timeout (integer)

166

SystemIdle

-

INFO

$AccumulatedIdleTime (integer)

$SystemIdle (boolean)

$Flags (integer)

$Action (integer)

$MinState (integer)

$DozeS4Timeout (integer)

$PredictedUserReturnTime (string)

167

SystemIdle

-

INFO

$Reason (integer)

$S0LowPowerDozeTimerCancelled (boolean)

168

SystemIdle

-

INFO

$CancelledDueToUserInput (boolean)

169

SystemIdle

win:Start

INFO

$Source (integer)

$Time (string)

170

SystemIdle

win:Stop

INFO

$Reason (integer)

171

CsDeepSleepWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDeepSleepMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$ActionsTaken (integer)

$PowerSettingPending (boolean)

171

CsDeepSleepWatchdog

-

INFO

$ResiliencyPhaseNonActivatedNoDeepSleepMs (integer)

$NonActivatedCpuTimeMs (integer)

$DurationThisPeriodMs (integer)

$OnAc (boolean)

$ActionsTaken (integer)

$PowerSettingPending (boolean)

172

StandbyConnectivityUpdate

-

INFO

$State (integer)

$Reason (integer)

173

FlushSleepStudyLogger

win:Start

INFO

174

FlushSleepStudyLogger

win:Stop

INFO

175

StandbyConnectivityRundown

-

INFO

$State (integer)

$Reason (integer)

176

CsComplianceRundown

-

INFO

$Type (integer)

$State (integer)

177

CsComplianceUpdate

-

INFO

$Type (integer)

$State (integer)

178

BackgroundActivityPolicyUpdate

-

INFO

$PreviousPolicy (integer)

$NewPolicy (integer)

179

ForceIdleStateChange

-

INFO

$PrevState (integer)

$NewState (integer)

180

ForceIdleReset

-

INFO

$Reason (integer)

181

DeepSleepSetConstraint

-

INFO

$Constraint (integer)

182

DeepSleepClearConstraint

-

INFO

$Constraint (integer)

183

DeepSleepConstraintRundown

-

INFO

$ConstraintCount (integer)

$Constraints (string)

184

IRTimerExpiries

-

INFO

$ExpiryCount (integer)

$RelativeId (integer)

$ComponentName (string)

185

RtcWakeInfo

-

INFO

$WokeSystem (boolean)

$RejectReason (integer)

$Uncertain (boolean)

$Spurious (boolean)

$FixedWakeSourceMask (integer)

$AcAlarmSignaled (boolean)

$DcAlarmSignaled (boolean)

$RtcSignaled (boolean)

$AcProgrammedTime (string)

$DcProgrammedTime (string)

$UsingAcTime (boolean)

$WakeTime (string)

$AdjustedWakeTime (string)

$FullWake (boolean)

186

Irp

Pended

INFO

$Irp (string)

187

NtInitiatePowerActionApiCall

-

INFO

$ApiCallerNameLength (integer)

$ApiCallerName (string)

$SystemAction (integer)

$LightestSystemState (integer)

200

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmSid (string)

$SqmWindowsSessionId (integer)

$SqmSessionFlags (integer)

201

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

202

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmDWORDDatapointValue (integer)

203

task_0

win:Stop

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmDWORDDatapointValue (integer)

204

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmDWORDDatapointValue (integer)

205

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmDWORDDatapointValue (integer)

206

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmDWORDDatapointValue (integer)

207

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmStringDatapointValue (string)

208

task_0

-

INFO

$SqmType (integer)

$SqmSessionGuid (string)

$SqmID (integer)

$SqmStreamRowLength (integer)

$SqmStreamRow (integer)

300

PluginRegistration

-

INFO

$Plugin (string)

$Attributes (integer)

301

PluginRegistrationRundown

-

INFO

$Plugin (string)

$Attributes (integer)

302

DevicePreparation

-

INFO

$Token (string)

$Plugin (string)

$IdLength (integer)

$Id (string)

$Prepared (boolean)

303

DeviceRegistration

-

INFO

$Token (string)

$Plugin (string)

$PowerState (integer)

$Status (integer)

$IdLength (integer)

$Id (string)

$ComponentCount (integer)

303

DeviceRegistration

-

INFO

$Token (string)

$Plugin (string)

$PowerState (integer)

$Status (integer)

$IdLength (integer)

$Id (string)

$ComponentCount (integer)

$VetoMasks (integer)

304

DeviceRegistrationRundown

-

INFO

$Token (string)

$Plugin (string)

$PowerState (integer)

$Status (integer)

$IdLength (integer)

$Id (string)

$ComponentCount (integer)

304

DeviceRegistrationRundown

-

INFO

$Token (string)

$Plugin (string)

$PowerState (integer)

$Status (integer)

$IdLength (integer)

$Id (string)

$ComponentCount (integer)

$VetoMasks (integer)

305

DeviceUnregistration

-

INFO

$Token (string)

306

StartDevicePowerManagement

-

INFO

$Token (string)

307

DevicePowerRequirementToDevice

-

INFO

$Token (string)

$PowerRequired (boolean)

308

DevicePowerState

-

INFO

$Token (string)

$PowerState (integer)

309

DevicePowered

-

INFO

$Token (string)

310

ComponentRegistration

-

INFO

$Token (string)

$Component (integer)

$Active (boolean)

$IdleState (integer)

$IdleStateCount (integer)

$IdleStates (integer)

310

ComponentRegistration

-

INFO

$Token (string)

$Component (integer)

$Active (boolean)

$IdleState (integer)

$IdleStateCount (integer)

$IdleStates (integer)

311

ComponentRegistrationRundown

-

INFO

$Token (string)

$Component (integer)

$Active (boolean)

$IdleState (integer)

$IdleStateCount (integer)

$IdleStates (integer)

311

ComponentRegistrationRundown

-

INFO

$Token (string)

$Component (integer)

$Active (boolean)

$IdleState (integer)

$IdleStateCount (integer)

$IdleStates (integer)

312

ComponentCondition

-

INFO

$Token (string)

$Component (integer)

$Active (boolean)

313

ComponentIdleState

-

INFO

$Token (string)

$Component (integer)

$IdleState (integer)

314

ComponentLatency

-

INFO

$Token (string)

$Component (integer)

$Latency (integer)

315

ComponentResidency

-

INFO

$Token (string)

$Component (integer)

$Residency (integer)

316

ComponentWake

-

INFO

$Token (string)

$Component (integer)

$ArmedForWake (boolean)

317

DevicePowerRequirementFromPep

-

INFO

$Token (string)

$PowerRequired (boolean)

318

DeviceIdleConstraints

-

INFO

$Token (string)

$StateCount (integer)

$MinimumDStates (integer)

319

ComponentIdleConstraints

-

INFO

$Token (string)

$Component (integer)

$StateCount (integer)

$MinimumFStates (integer)

320

DeviceVerboseRundown

-

INFO

$DeviceNode (string)

$DeviceIdLength (integer)

$DeviceId (string)

$InstancePathLength (integer)

$InstancePath (string)

$ServiceNameLength (integer)

$ServiceName (string)

$PlatformStateDependents (integer)

320

DeviceVerboseRundown

-

INFO

$DeviceNode (string)

$DeviceIdLength (integer)

$DeviceId (string)

$InstancePathLength (integer)

$InstancePath (string)

$ServiceNameLength (integer)

$ServiceName (string)

$PlatformStateDependents (integer)

$Pdo (string)

$ParentDeviceNode (string)

320

DeviceVerboseRundown

-

INFO

$DeviceNode (string)

$DeviceIdLength (integer)

$DeviceId (string)

$InstancePathLength (integer)

$InstancePath (string)

$ServiceNameLength (integer)

$ServiceName (string)

$PlatformStateDependents (integer)

$Pdo (string)

$ParentDeviceNode (string)

$Flags (integer)

321

PerformanceStateRegistration

-

INFO

$Token (string)

$Component (integer)

$SetCount (integer)

322

PerformanceStateRegistrationRundown

-

INFO

$Token (string)

$Component (integer)

$SetCount (integer)

323

PerformanceStateSetRegistration

-

INFO

$Token (string)

$Component (integer)

$Set (integer)

$NameLength (integer)

$Name (string)

$Type (integer)

$Unit (integer)

$Minimum (integer)

$Maximum (integer)

$StateCount (integer)

$StateValues (integer)

$CurrentState (integer)

324

PerformanceStateSetRegistrationRundown

-

INFO

$Token (string)

$Component (integer)

$Set (integer)

$NameLength (integer)

$Name (string)

$Type (integer)

$Unit (integer)

$Minimum (integer)

$Maximum (integer)

$StateCount (integer)

$StateValues (integer)

$CurrentState (integer)

325

ComponentPerformanceState

-

INFO

$Token (string)

$Component (integer)

$PerformanceStateSetCount (integer)

$PerformanceStateSets (integer)

326

ComponentPerformanceState

-

INFO

$Token (string)

$Component (integer)

$Progress (integer)

327

ComponentPerformanceState

-

INFO

$Token (string)

$Component (integer)

$Succeeded (boolean)

328

ComponentPerformanceState

-

INFO

$Token (string)

$Component (integer)

$DeviceTransition (boolean)

$PowerState (integer)

$PerformanceStateSetCount (integer)

$PerformanceStateSets (integer)

329

DebuggerTransitionRequirements

-

INFO

$Token (string)

$StateCount (integer)

$TransitionRequired (integer)

330

DefaultPepWorker

win:Start

INFO

$StartDevice (string)

331

DefaultPepWorker

win:Stop

INFO

$EndDevice (string)

$WorkType (integer)

$Phase (integer)

$NumberExtraDevices (integer)

332

DefaultPepWorkerDeviceRecovered

-

CRITICAL

$EndDevice (string)

$WorkType (integer)

$Phase (integer)

$NumberExtraDevices (integer)

333

DefaultPepWorkerDeviceOrphaned

-

CRITICAL

$EndDevice (string)

$WorkType (integer)

$Phase (integer)

$NumberExtraDevices (integer)

400

SessionCreated

-

INFO

$SessionId (integer)

$Console (boolean)

401

SessionClosed

-

INFO

$SessionId (integer)

$Console (boolean)

402

SessionConnected

-

INFO

$SessionId (integer)

$Console (boolean)

403

SessionDisconnected

-

INFO

$SessionId (integer)

$Console (boolean)

404

ActiveInput

-

INFO

$SessionId (integer)

$Console (boolean)

405

PassiveInput

-

INFO

$SessionId (integer)

$Console (boolean)

406

SessionLocked

-

INFO

$SessionId (integer)

$Console (boolean)

407

SessionUnlocked

-

INFO

$SessionId (integer)

$Console (boolean)

408

SensorInput

-

INFO

$UserPresence (integer)

409

SensorInvalid

-

INFO

$Code (integer)

410

SensorSmoothing

-

INFO

$Engaged (integer)

411

SensorWatchdog

-

INFO

$Engaged (integer)

412

DisplaySessionStatus

-

INFO

$SessionId (integer)

$State (integer)

413

UserSessionStatus

-

INFO

$SessionId (integer)

$State (integer)

414

UserGlobalStatus

-

INFO

$SessionId (integer)

$State (integer)

414

UserGlobalStatus

-

INFO

$SessionId (integer)

$State (integer)

$TransitionCount (integer)

415

SensorInputChanged

-

INFO

$Old (integer)

$New (integer)

416

InputState

-

INFO

$Value (integer)

$Zeroed (integer)

$Computed (integer)

417

DisplayState

-

INFO

$Value (integer)

$Zeroed (integer)

$Computed (integer)

418

PolicyChange

-

INFO

$SensorDisplayTimeout (integer)

$DisplayTimeout (integer)

$SensorInputTimeout (integer)

$InputTimeout (integer)

$SessionLockedTimeout (integer)

$SensorEnabled (integer)

500

IoCoalescingOn

-

INFO

$SpindownTimeout (integer)

$TimerInterval (integer)

$FlushInterval (integer)

$Flags (integer)

501

IoCoalescingOff

-

INFO

502

IoCoalescingFlush

-

INFO

503

IoCoalescingDiskIdle

-

INFO

$DiskDeviceObject (string)

504

SystemLatencyUpdate

-

INFO

$SystemLatency (integer)

505

SystemLatencyRundown

-

INFO

$SystemLatency (integer)

506

CsEnterReason

-

INFO

$Reason (integer)

506

CsEnterReason

-

INFO

$Reason (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

506

CsEnterReason

-

INFO

$Reason (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

$BatteryRemainingCapacityOnEnter (integer)

$BatteryFullChargeCapacityOnEnter (integer)

506

CsEnterReason

-

INFO

$Reason (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

$BatteryRemainingCapacityOnEnter (integer)

$BatteryFullChargeCapacityOnEnter (integer)

$ScenarioInstanceIdV2 (integer)

$BootId (integer)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

$IsCsSessionInProgressOnExit (boolean)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

$IsCsSessionInProgressOnExit (boolean)

$BatteryRemainingCapacityOnExit (integer)

$BatteryFullChargeCapacityOnExit (integer)

507

CsExitReason

-

INFO

$EnergyDrain (integer)

$ActiveResidencyInUs (integer)

$NonDripsTimeActivatedInUs (integer)

$FirstDripsEntryInUs (integer)

$DripsResidencyInUs (integer)

$DurationInUs (integer)

$DripsTransitions (integer)

$FullChargeCapacityRatio (integer)

$AudioPlaying (boolean)

$Reason (integer)

$AudioPlaybackInUs (integer)

$NonActivatedCpuInUs (integer)

$PowerStateAc (boolean)

$HwDripsResidencyInUs (integer)

$ExitLatencyInUs (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$LidOpenState (boolean)

$ExternalMonitorConnectedState (boolean)

$ScenarioInstanceId (integer)

$IsCsSessionInProgressOnExit (boolean)

$BatteryRemainingCapacityOnExit (integer)

$BatteryFullChargeCapacityOnExit (integer)

$ScenarioInstanceIdV2 (integer)

$BootId (integer)

$InputSuppressionActionCount (integer)

$NonResiliencyTimeInUs (integer)

$ResiliencyDripsTimeInUs (integer)

$ResiliencyHwDripsTimeInUs (integer)

508

DynamicTickDisabled

-

INFO

$Reason (integer)

509

DynamicTickStatusRundown

-

INFO

$Flags (integer)

510

SpmStatusUpdate

-

INFO

$SpmStatus (integer)

511

SpmStatusRundown

-

INFO

$SpmStatus (integer)

512

SpmPolicyAliasRundown

-

INFO

$PolicyGuid (string)

$PolicyAliasLength (integer)

$PolicyAlias (string)

513

SpmScenarioPolicyRundown

-

INFO

$ScenarioGuid (string)

$ScenarioNameLength (integer)

$ScenarioName (string)

$Flags (integer)

$DefaultSettingsScenarioGuid (string)

$PolicyCount (integer)

$PolicySettings (integer)

514

ComponentAccounting

-

INFO

$ScenarioInstanceId (integer)

$DeviceNode (string)

$Component (integer)

$ActiveTime (integer)

515

SpmScenarioStart

-

INFO

$ScenarioGuid (string)

$ScenarioInstanceId (integer)

515

SpmScenarioStart

-

INFO

$ScenarioGuid (string)

$ScenarioInstanceId (integer)

$CsEnterReason (integer)

515

SpmScenarioStart

-

INFO

$ScenarioGuid (string)

$ScenarioInstanceId (integer)

$CsEnterReason (integer)

$BatteryRemainingCapacityOnEnter (integer)

$BatteryFullChargeCapacityOnEnter (integer)

515

SpmScenarioStart

-

INFO

$ScenarioGuid (string)

$ScenarioInstanceId (integer)

$CsEnterReason (integer)

$BatteryRemainingCapacityOnEnter (integer)

$BatteryFullChargeCapacityOnEnter (integer)

$ScenarioInstanceIdV2 (integer)

$BootId (integer)

$CurrentSystemTime (string)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$EnergySaverPolicy (boolean)

$VideoTimeoutInSec (integer)

$LockConsoleTimeoutInSec (integer)

$StandbyTimeoutInSec (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$EnergySaverPolicy (boolean)

$VideoTimeoutInSec (integer)

$LockConsoleTimeoutInSec (integer)

$StandbyTimeoutInSec (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$EnergySaverPolicy (boolean)

$VideoTimeoutInSec (integer)

$LockConsoleTimeoutInSec (integer)

$StandbyTimeoutInSec (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$EnergyDrainV2Flags (integer)

$EnergyDrainV2 (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$EnergySaverPolicy (boolean)

$VideoTimeoutInSec (integer)

$LockConsoleTimeoutInSec (integer)

$StandbyTimeoutInSec (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$EnergyDrainV2Flags (integer)

$EnergyDrainV2 (integer)

$DirectedDripsTransitionCount (integer)

$IsHibernateEnabled (boolean)

$HibernateTimeoutInSec (integer)

$HibernateBudgetPercentage (integer)

516

SpmScenarioStop

-

INFO

$EnergyDrain (integer)

$DripsResidencyInUs (integer)

$OnAc (boolean)

$HwDripsResidencyInUs (integer)

$PreVetoCount (integer)

$VetoCount (integer)

$DurationInUs (integer)

$FullChargeCapacity (integer)

$NonActivatedCpuInUs (integer)

$IRTruncatePercentage (integer)

$DesignCapacity (integer)

$AudioDurationInUs (integer)

$Reason (integer)

$DisconnectedStandby (boolean)

$AoAcCompliantNic (boolean)

$NonAttributedCpuInUs (integer)

$EnergySaverPolicy (boolean)

$VideoTimeoutInSec (integer)

$LockConsoleTimeoutInSec (integer)

$StandbyTimeoutInSec (integer)

$ModernSleepEnabledActionsBitmask (integer)

$ModernSleepAppliedActionsBitmask (integer)

$EnergyDrainV2Flags (integer)

$EnergyDrainV2 (integer)

$DirectedDripsTransitionCount (integer)

$IsHibernateEnabled (boolean)

$HibernateTimeoutInSec (integer)

$HibernateBudgetPercentage (integer)

$IsLockConsoleTimeoutActive (boolean)

517

DeviceAccounting

-

INFO

$ScenarioInstanceId (integer)

$DeviceNode (string)

$ActiveTime (integer)

518

IoShutdownFileSystems

win:Start

INFO

519

IoShutdownFileSystems

win:Stop

INFO

520

BrightnessEngineSwap

-

INFO

521

BatteryCountChange

-

INFO

$ValidBatteryCount (integer)

$ErrorBatteryCount (integer)

$AbandonedBatteryCount (integer)

522

CsDripsDivergence

-

INFO

$HwDripsTotalTimeValid (boolean)

$DripsTotalTimeThisPeriodUs (integer)

$HwDripsTotalTimeThisPeriodUs (integer)

$PopDripsSwHwDivergenceThreshold (integer)

523

Irp

-

INFO

$Irp (string)

$Status (integer)

$FailedDriver (string)

$ElapsedTime (integer)

524

BatteryTriggerMet

-

INFO

$Index (integer)

$ActiveBatteryCount (integer)

$RemainingPercentage (integer)

$IsAcOnline (integer)

$BatteryActionInternalFlags (string)

$IsPowerActionCallIgnored (integer)

$IsPowerPolicyEnabled (integer)

$PowerPolicyAction (integer)

$PowerPolicyBatteryLevel (integer)

$PowerPolicyEventCode (integer)

$PowerPolicyMinState (integer)

525

NetRefreshTimerArmed

-

INFO

$DurationInUs (integer)

526

NetRefreshTimerDisarmed

-

INFO

527

PowerStateEventRundown

-

INFO

$Event (integer)

$Class (integer)

$Count (integer)

528

PowerStateEvent

-

INFO

$Event (integer)

$Intent (integer)

529

PowerAggregatorQueueOverflow

-

INFO

$Intent (integer)

$Class (integer)

$PowerEvent (integer)

530

PowerAggregatorRequest

-

INFO

$SessionId (integer)

$RequestQueueId (integer)

$Intent (integer)

$Class (integer)

$PowerEvent (integer)

$VetoReason (integer)

531

PowerAggregatorValidationEvent

-

INFO

$SessionId (integer)

$Action (integer)

$Result (integer)

532

PowerAggregatorCompletionEvent

-

INFO

$SessionId (integer)

$Result (integer)

533

PowerAggregatorSessionBegin

-

INFO

$SessionId (integer)

$PowerEvent (integer)

$Action (integer)

$AudioActivity (boolean)

$DisconnectedStandbyMode (integer)

$DsEnabled (boolean)

534

PowerAggregatorSessionEnd

-

INFO

$SessionId (integer)

$Result (integer)

535

DirectedDripsEngaged

-

INFO

$CsSessionId (integer)

$Engaged (boolean)

536

DirectedDripsWorker

-

INFO

$CsSessionId (integer)

$WorkFlags (integer)

537

DirectedDripsMarkDevice

-

INFO

$CsSessionId (integer)

$DeviceObject (string)

538

DirectedDripsNotifyAppsAndServices

-

INFO

$CsSessionId (integer)

$Suspended (boolean)

$Result (integer)

$DurationMs (integer)

539

DirectedDripsNotifyDevices

-

INFO

$CsSessionId (integer)

$Suspended (boolean)

$Result (integer)

$DurationMs (integer)

540

DirectedDripsInitialization

-

INFO

$EnableResult (integer)

$InitializationResult (integer)

541

SIdleUpdateNotificationWorker

-

INFO

$SystemIdle (boolean)

542

PowerAggregatorInvalidRequestIndex

-

INFO

$RequestIndex (integer)

$NumberOfRequests (integer)

$QueueSize (integer)

543

DripsWakeAccountingSummary

-

INFO

$CsSessionId (integer)

$Count (integer)

$IdleMinDurationInUs (integer)

$IdleMaxDurationInUs (integer)

$IdleTotalDurationInUs (integer)

$ReasonDescriptionLength (integer)

$ReasonDescription (string)

$GroupCount (integer)

$Group (integer)

544

DirectedDripsDisengageMaskChange

-

INFO

$OldMask (integer)

$NewMask (integer)

$SetFlags (integer)

$ClearedFlags (integer)

545

DirectedDripsDeviceVisit

-

INFO

$BroadcastTreeId (integer)

$IsRootDevice (boolean)

$DeviceNode (string)

$InstancePathLength (integer)

$InstancePath (string)

546

DirectedDripsProblemDevice

-

INFO

$BroadcastTreeId (integer)

$DeviceNode (string)

$Reason (integer)

547

DirectedPowerTransitionStart

-

INFO

$DeviceNode (string)

$PowerDown (boolean)

548

DirectedPowerTransitionEnd

-

INFO

$DeviceNode (string)

$PowerDown (boolean)

Microsoft-Windows-Kernel-PowerTrigger

1

task_0

-

INFO

$AoAc (boolean)

Microsoft-Windows-Kernel-Processor-Power

1

IdleStatesError

-

ERROR

$Processor (integer)

2

PerfStatesError

-

ERROR

$Processor (integer)

3

ThrottleStatesError

-

ERROR

$Processor (integer)

4

Summary

-

INFO

$Processor (integer)

$IdleStateCount (integer)

$PerfStateCount (integer)

$ThrottleStateCount (integer)

$IdleState (integer)

$PerfState (integer)

5

IdleStatesErrata

-

ERROR

6

PerfStatesErrata

-

ERROR

7

LongCapInfo

-

WARNING

$Processor (integer)

$CapDurationInSeconds (integer)

$PpcChanges (integer)

$TpcChanges (integer)

8

QuickCapInfo

-

WARNING

$Processor (integer)

$CapDurationInSeconds (integer)

$PpcChanges (integer)

$TpcChanges (integer)

9

DomainPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$GroupCount (integer)

$Group (integer)

9

DomainPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$GroupCount (integer)

$Group (integer)

$Performance (integer)

9

DomainPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$GroupCount (integer)

$Group (integer)

$Performance (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

9

DomainPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$GroupCount (integer)

$Group (integer)

$Performance (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$Autonomous (boolean)

10

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

10

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

10

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

$TolerancePercent (integer)

10

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

$TolerancePercent (integer)

$MinPercent (integer)

$MaxPercent (integer)

$EppPercent (integer)

$ActivityWindow (integer)

$Autonomous (boolean)

$Initiated (boolean)

$VirtualLittle (boolean)

10

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

$TolerancePercent (integer)

$MinPercent (integer)

$MaxPercent (integer)

$EppPercent (integer)

$ActivityWindow (integer)

$Autonomous (boolean)

$Initiated (boolean)

$QosClass (integer)

11

PerfCheck

win:Start

-

$PpmCheckTime (integer)

11

PerfCheck

win:Start

-

$PpmCheckTime (integer)

$AdjustedCheckTime (integer)

$StartPhase (integer)

12

RecordedUtility

-

-

$PpmCheckTime (integer)

$IdleTime (integer)

$BusyTime (integer)

$Frequency (integer)

$Group (integer)

$Number (integer)

12

RecordedUtility

-

-

$PpmCheckTime (integer)

$IdleTime (integer)

$BusyTime (integer)

$Frequency (integer)

$Group (integer)

$Number (integer)

$DeliveredPerformance (integer)

$Utility (integer)

$AffinitizedUtility (integer)

$FrequencySensitivity (integer)

12

RecordedUtility

-

-

$PpmCheckTime (integer)

$IdleTime (integer)

$BusyTime (integer)

$Frequency (integer)

$Group (integer)

$Number (integer)

$DeliveredPerformance (integer)

$Utility (integer)

$AffinitizedUtility (integer)

$FrequencySensitivity (integer)

$BufferingPercent (integer)

$StallTime (integer)

13

ExpectedUtility

-

INFO

$PpmCheckTime (integer)

$IdleTimeInMs (integer)

$BusyTimeInMs (integer)

$ExcessBusyTimeInMs (integer)

$Frequency (integer)

$Group (integer)

$Number (integer)

14

ParkCore

-

INFO

$PpmCheckTime (integer)

$Group (integer)

$Number (integer)

15

UnparkCore

-

INFO

$PpmCheckTime (integer)

$Group (integer)

$Number (integer)

16

PerfCheck

win:Stop

-

$PpmCheckTime (integer)

18

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

18

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

18

ProcessorPerfStateChange

-

INFO

$State (integer)

$Speed (integer)

$Group (integer)

$Number (integer)

$Performance (integer)

$TolerancePercent (integer)

19

IdleAccountingRundown

-

INFO

$StateCount (integer)

$TotalTransitions (integer)

$ResetCount (integer)

$Pad (integer)

$StartTime (integer)

$State (integer)

$Group (integer)

$Number (integer)

19

IdleAccountingRundown

-

INFO

$StateCount (integer)

$TotalTransitions (integer)

$ResetCount (integer)

$AbortCount (integer)

$StartTime (integer)

$State (integer)

$Group (integer)

$Number (integer)

$IdleTime (integer)

19

IdleAccountingRundown

-

INFO

$StateCount (integer)

$TotalTransitions (integer)

$ResetCount (integer)

$AbortCount (integer)

$StartTime (integer)

$State (string)

$Group (integer)

$Number (integer)

$IdleTime (integer)

$SelectionCount (integer)

$SelectionAccounting (string)

20

ProcessorFirmwareRundown

-

INFO

$FeaturesPresent (integer)

$FeaturesAccessed (integer)

$FeaturesValidated (integer)

$Group (integer)

$Number (integer)

21

CStateDomainFirmwareRundown

-

INFO

$DomainId (integer)

$MemberCount (integer)

$MembersEnumerated (integer)

22

PTStateDomainFirmwareRundown

-

INFO

$DomainId (integer)

$MemberCount (integer)

$MembersEnumerated (integer)

23

Summary

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$PerfStateCount (integer)

$ThrottleStateCount (integer)

$IdleState (integer)

$PerfState (integer)

24

IdleStatesErrata

-

ERROR

25

PerfStatesErrata

-

ERROR

26

Summary

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$PerfStateCount (integer)

$ThrottleStateCount (integer)

$IdleState (integer)

$PerfState (integer)

26

Summary

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$PerfStateCount (integer)

$ThrottleStateCount (integer)

$IdleState (integer)

$PerfState (integer)

27

ThrottleStatesErrata

-

ERROR

28

ThrottleStatesErrata

-

ERROR

29

PccSummary

-

INFO

$MajorVersion (integer)

$MinorVersion (integer)

$MinPerfPercent (integer)

$MinThrottlePercent (integer)

30

PccSummary

-

INFO

$MajorVersion (integer)

$MinorVersion (integer)

$MinPerfPercent (integer)

$MinThrottlePercent (integer)

31

PccErrata

-

ERROR

32

PccErrata

-

ERROR

33

PccError

-

ERROR

$Group (integer)

$Number (integer)

34

IdleStatesError

-

ERROR

$Group (integer)

$Number (integer)

34

IdleStatesError

-

ERROR

$Group (integer)

$Number (integer)

35

PerfStatesError

-

ERROR

$Group (integer)

$Number (integer)

35

PerfStatesError

-

ERROR

$Group (integer)

$Number (integer)

36

ThrottleStatesError

-

ERROR

$Group (integer)

$Number (integer)

36

ThrottleStatesError

-

ERROR

$Group (integer)

$Number (integer)

37

LongCapInfo

-

WARNING

$Group (integer)

$Number (integer)

$CapDurationInSeconds (integer)

$PpcChanges (integer)

$TpcChanges (integer)

$PccChanges (integer)

37

LongCapInfo

-

WARNING

$Group (integer)

$Number (integer)

$CapDurationInSeconds (integer)

$PpcChanges (integer)

$TpcChanges (integer)

$PccChanges (integer)

38

QuickCapInfo

-

WARNING

$Group (integer)

$Number (integer)

$CapDurationInSeconds (integer)

$PpcChanges (integer)

$TpcChanges (integer)

$PccChanges (integer)

39

NotifyPStates

-

INFO

$Group (integer)

$Number (integer)

$Cap (integer)

40

NotifyCStates

-

INFO

$Group (integer)

$Number (integer)

41

NotifyTStates

-

INFO

$Group (integer)

$Number (integer)

$Cap (integer)

42

PerfStatesRundown

-

INFO

$Group (integer)

$Number (integer)

$StateCount (integer)

$States (integer)

43

BiosPStatesRundown

-

INFO

$Group (integer)

$Number (integer)

$PBlockAddress (integer)

$PBlockLength (integer)

$ProcessorId (integer)

$ApicId (integer)

$Ppc (integer)

$PctControl (string)

$PctStatus (string)

$StateCount (integer)

$PssStates (string)

44

BiosCStatesRundown

-

INFO

$Group (integer)

$Number (integer)

$FadtC2Latency (integer)

$FadtC3Latency (integer)

$CStateVersionInUse (integer)

$StateCount (integer)

$CstStates (integer)

45

BiosTStatesRundown

-

INFO

$Group (integer)

$Number (integer)

$FadtDutyWidth (integer)

$FadtDutyOffset (integer)

$Tpc (integer)

$TStateVersionInUse (integer)

$PtcControl (integer)

$PtcStatus (string)

$StateCount (integer)

$TssStates (string)

46

PccCapChange

-

INFO

$Group (integer)

$Number (integer)

$Cap (integer)

47

BiosCapChange

-

INFO

$Group (integer)

$Number (integer)

$Cap (integer)

48

ThermalCapChange

-

INFO

$Group (integer)

$Number (integer)

$Cap (integer)

49

PerfCheck

Makeup

-

50

LogicalProcessorIdlingCorePark

-

INFO

$Cap (integer)

$IsApplied (boolean)

51

LogicalProcessorIdlingRundown

-

INFO

$Cap (integer)

$IsApplied (boolean)

52

LatencySensitivityHint

-

INFO

$HintType (integer)

53

ParkNodeRecordedStats

-

-

$Group (integer)

$Affinity (string)

$ConcurrentCores (integer)

$HistogramSize (integer)

$ConcurrencyHistogram (integer)

53

ParkNodeRecordedStats

-

-

$Group (integer)

$Affinity (string)

$ConcurrentCores (integer)

$HistogramSize (integer)

$ConcurrencyHistogram (integer)

$DistributeCores (integer)

54

CpcError

-

ERROR

$Group (integer)

$Number (integer)

55

Summary2

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$IdleImplementation (integer)

$NominalFrequency (integer)

$MaximumPerformancePercent (integer)

$MinimumPerformancePercent (integer)

$MinimumThrottlePercent (integer)

$PerformanceImplementation (integer)

55

Summary2

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$IdleImplementation (integer)

$NominalFrequency (integer)

$MaximumPerformancePercent (integer)

$MinimumPerformancePercent (integer)

$MinimumThrottlePercent (integer)

$PerformanceImplementation (integer)

56

Summary2

-

INFO

$Group (integer)

$Number (integer)

$IdleStateCount (integer)

$IdleImplementation (integer)

$NominalFrequency (integer)

$MaximumPerformancePercent (integer)

$MinimumPerformancePercent (integer)

$MinimumThrottlePercent (integer)

$PerformanceImplementation (integer)

57

PepGetIdleStates

-

INFO

$Group (integer)

$Number (integer)

$MaximumCoordinatedProcessors (integer)

$StateCount (integer)

$States (integer)

58

PepGetIdleStates

-

INFO

$Group (integer)

$Number (integer)

$MaximumCoordinatedProcessors (integer)

$StateCount (integer)

$States (integer)

59

PepQueryCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCounterCount (integer)

$IdleStateCount (integer)

$PerformanceStatesSupported (boolean)

$ParkingSupported (boolean)

59

PepQueryCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCounterCount (integer)

$IdleStateCount (integer)

$PerformanceStatesSupported (boolean)

$ParkingSupported (boolean)

$DiscretePerformanceStateCount (integer)

60

PepQueryCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCounterCount (integer)

$IdleStateCount (integer)

$PerformanceStatesSupported (boolean)

$ParkingSupported (boolean)

60

PepQueryCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCounterCount (integer)

$IdleStateCount (integer)

$PerformanceStatesSupported (boolean)

$ParkingSupported (boolean)

$DiscretePerformanceStateCount (integer)

61

PepPerfConstraintChange

-

INFO

$Group (integer)

$Number (integer)

$GuaranteedPerformance (integer)

$LimitReasons (integer)

62

PepPerfCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCount (integer)

$Feedback (integer)

$HighestPerformance (integer)

$NominalPerformance (integer)

$LowestNonlinearPerformance (integer)

$LowestPerformance (integer)

$DomainId (integer)

$DomainMembers (integer)

62

PepPerfCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCount (integer)

$Feedback (string)

$HighestPerformance (integer)

$NominalPerformance (integer)

$LowestNonlinearPerformance (integer)

$LowestPerformance (integer)

$DomainId (integer)

$DomainMembers (integer)

$PerfStateCount (integer)

$PerfStates (string)

63

PepPerfCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCount (integer)

$Feedback (integer)

$HighestPerformance (integer)

$NominalPerformance (integer)

$LowestNonlinearPerformance (integer)

$LowestPerformance (integer)

$DomainId (integer)

$DomainMembers (integer)

63

PepPerfCapabilities

-

INFO

$Group (integer)

$Number (integer)

$FeedbackCount (integer)

$Feedback (string)

$HighestPerformance (integer)

$NominalPerformance (integer)

$LowestNonlinearPerformance (integer)

$LowestPerformance (integer)

$DomainId (integer)

$DomainMembers (integer)

$PerfStateCount (integer)

$PerfStates (string)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$DeliveredPerformance (integer)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$DeliveredPerformance (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

$Autonomous (boolean)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$DeliveredPerformance (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

$Autonomous (boolean)

$EppPercent (integer)

$ActivityWindow (integer)

$VirtualLittle (boolean)

$RelativePerformance (integer)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$DeliveredPerformance (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

$Autonomous (boolean)

$EppPercent (integer)

$ActivityWindow (integer)

$QosClass (integer)

$RelativePerformance (integer)

64

ProcessorPerformanceRundown

-

INFO

$Group (integer)

$Number (integer)

$Parked (boolean)

$BiosCap (integer)

$ThermalCap (integer)

$DesiredPerformance (integer)

$NominalFrequency (integer)

$MinPercent (integer)

$MaxPercent (integer)

$TolerancePercent (integer)

$DeliveredPerformance (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

$Autonomous (boolean)

$EppPercent (integer)

$ActivityWindow (integer)

$QosClass (integer)

$RelativePerformance (integer)

$EfficiencySchedulingClass (integer)

65

ParkNodeRundown

-

INFO

$Group (integer)

$Affinity (string)

$Parked (string)

$LpiCap (integer)

65

ParkNodeRundown

-

INFO

$Group (integer)

$Affinity (string)

$Parked (string)

$LpiCap (integer)

$ThermalCap (integer)

65

ParkNodeRundown

-

INFO

$Group (integer)

$Affinity (string)

$Parked (string)

$LpiCap (integer)

$ThermalCap (integer)

$ParkHint (string)

66

ParkNodeCapChange

-

INFO

$Group (integer)

$Affinity (string)

$LpiCap (integer)

66

ParkNodeCapChange

-

INFO

$Group (integer)

$Affinity (string)

$LpiCap (integer)

$ThermalCap (integer)

67

ProcessorIdleRundown

-

INFO

$Group (integer)

$Number (integer)

$Type (integer)

$StateCount (integer)

67

ProcessorIdleRundown

-

INFO

$Group (integer)

$Number (integer)

$Type (integer)

$StateCount (integer)

$States (integer)

68

ProcessorIdRundown

-

INFO

$Group (integer)

$Number (integer)

$AcpiId (integer)

$InterruptControllerId (integer)

68

ProcessorIdRundown

-

INFO

$Group (integer)

$Number (integer)

$AcpiId (integer)

$InterruptControllerId (integer)

$ProcessorIndex (integer)

69

PepGetPlatformIdleStates

-

INFO

$PlatformIdleStateCount (integer)

70

PepGetPlatformIdleStates

-

INFO

$PlatformIdleStateCount (integer)

71

PerfCheck

FailedStart

-

$AdjustedCheckTime (integer)

72

PlatformIdleAccountingRundown

-

INFO

$StateCount (integer)

$ResetCount (integer)

$TotalTransitions (integer)

$StartTime (integer)

$Reserved (integer)

$State (integer)

$Group (integer)

$Number (integer)

72

PlatformIdleAccountingRundown

-

INFO

$StateCount (integer)

$ResetCount (integer)

$TotalTransitions (integer)

$StartTime (integer)

$Reserved (integer)

$State (integer)

$Group (integer)

$Number (integer)

$SelectionCount (integer)

$SelectionAccounting (string)

73

PlatformParkingPreference

-

INFO

$Group (integer)

$Affinity (string)

$UnparkCount (integer)

$OSPreferencePark (string)

$OSPreferenceUnpark (string)

$PlatformPreferencePark (string)

$PlatformPreferenceUnpark (string)

74

LowPowerScenarioChange

-

INFO

$PreviousActiveScenarioId (integer)

$NewActiveScenarioId (integer)

75

LowPowerScenarioRundown

-

INFO

$CurrentActiveScenarioId (integer)

76

LowPowerScenarioInformationRundown

-

INFO

$ScenarioId (integer)

$PlatformIdleStateIndex (integer)

77

PepGetIdleStatesV2

-

INFO

$Group (integer)

$Number (integer)

$StateCount (integer)

$States (integer)

78

PepGetIdleStatesV2Rundown

-

INFO

$Group (integer)

$Number (integer)

$StateCount (integer)

$States (integer)

79

PepGetPlatformIdleState

-

INFO

$StateIndex (integer)

$InitiatingProcessor (integer)

$OneInitiator (boolean)

$Latency (integer)

$BreakEvenDuration (integer)

$DependencyCount (integer)

$Dependencies (integer)

80

PepGetPlatformIdleStateRundown

-

INFO

$StateIndex (integer)

$InitiatingProcessor (integer)

$OneInitiator (boolean)

$Latency (integer)

$BreakEvenDuration (integer)

$DependencyCount (integer)

$Dependencies (integer)

81

DripsAccountingSnapshot

-

INFO

$ScenarioInstanceId (integer)

$DripsBucketsCount (integer)

$TotalTimes (string)

82

PlatformAccountingBucketIntervalsRundown

-

INFO

$IntervalLimitsCount (integer)

$IntervalLimits (string)

83

PlatformIdleVetoIncrement

-

INFO

$StateIndex (integer)

$VetoReason (integer)

84

PlatformIdleVetoDecrement

-

INFO

$StateIndex (integer)

$VetoReason (integer)

85

ProcessorIdleVetoIncrement

-

INFO

$Group (integer)

$Number (integer)

$StateIndex (integer)

$VetoReason (integer)

86

ProcessorIdleVetoDecrement

-

INFO

$Group (integer)

$Number (integer)

$StateIndex (integer)

$VetoReason (integer)

87

PlatformIdleVetoRundown

-

INFO

$StateIndex (integer)

$VetoReason (integer)

$VetoCount (integer)

88

ProcessorIdleVetoRundown

-

INFO

$Group (integer)

$Number (integer)

$StateIndex (integer)

$VetoReason (integer)

$VetoCount (integer)

89

StaticPolicyRundown

-

INFO

$PerfBoostAtGuaranteed (boolean)

$PerfIdealAggressiveIncreasePolicyThreshold (integer)

$PerfSingleStepSize (integer)

$PerfCalculateActualUtilization (integer)

$PerfArtificialDomain (boolean)

$LowLatencyScalingPercentage (integer)

$ParkWithCoreGranularity (boolean)

$MultiparkGranularity (integer)

89

StaticPolicyRundown

-

INFO

$PerfBoostAtGuaranteed (boolean)

$PerfIdealAggressiveIncreasePolicyThreshold (integer)

$PerfSingleStepSize (integer)

$PerfCalculateActualUtilization (integer)

$PerfArtificialDomain (boolean)

$LowLatencyScalingPercentage (integer)

$ParkWithCoreGranularity (boolean)

$MultiparkGranularity (integer)

$QosManagesIdleProcessors (boolean)

$QosHysteresis (integer)

90

PerfSelectProcessorState

-

INFO

$Group (integer)

$Number (integer)

$ResolvedUtilization (integer)

$Target (integer)

$ResolvedTarget (integer)

$Flags (integer)

91

VetoNameRundown

-

INFO

$VetoReason (integer)

$Name (string)

92

PepGetCoordinatedIdleStates

-

INFO

$StateCount (integer)

$CoordinatedStates (string)

93

PepGetCoordinatedIdleStatesRundown

-

INFO

$StateCount (integer)

$CoordinatedStates (string)

94

PepGetCoordinatedDependency

-

INFO

$StateIndex (integer)

$DependencyIndex (integer)

$ProcessorDependency (boolean)

$TargetProcessor (integer)

$OptionCount (integer)

$Options (integer)

95

PepGetCoordinatedDependencyRundown

-

INFO

$StateIndex (integer)

$DependencyIndex (integer)

$ProcessorDependency (boolean)

$TargetProcessor (integer)

$OptionCount (integer)

$Options (integer)

96

MediaBufferingNotify

-

INFO

$Engaged (boolean)

97

ComputeEnergy

-

INFO

$EfficiencyClass (integer)

$EnergyInMicroJoules (integer)

98

CoordinatedIdleRundown

-

INFO

$StateCount (integer)

$States (string)

99

HeteroResponse

-

-

$Group (integer)

$Affinity (string)

$ProcCount (integer)

$ActualUtility (integer)

$EstimatedUtility (integer)

$ActiveTime (integer)

$CheckCount (integer)

$Decision (integer)

$IdealClass1Count (integer)

$ActualClass1Count (integer)

$Flags (integer)

100

PerfCheck

win:Start

-

$PpmCheckTime (integer)

$AdjustedCheckTime (integer)

$PipelineId (integer)

101

HeteroDistributeUtility

-

-

$Group (integer)

$Affinity (string)

$Class0FloorPerf (integer)

$Class1MinimumPerf (integer)

102

ProfileRegistered

-

INFO

$Name (string)

$Id (integer)

$Priority (integer)

$Flags (integer)

$Guid (string)

$ActiveCount (integer)

$MaxActiveDurationInUs (integer)

$MinActiveDurationInUs (integer)

$TotalActiveDurationInUs (integer)

103

ProfileRundown

-

INFO

$Name (string)

$Id (integer)

$Priority (integer)

$Flags (integer)

$Guid (string)

$ActiveCount (integer)

$MaxActiveDurationInUs (integer)

$MinActiveDurationInUs (integer)

$TotalActiveDurationInUs (integer)

104

ProfileChange

-

INFO

$PreviousProfileId (integer)

$NextProfileId (integer)

105

ProfileSettingChange

-

INFO

$ProfileId (integer)

$Name (string)

$Type (integer)

$Class (integer)

$Guid (string)

$ValueSize (integer)

$Value (string)

106

ProfileSettingRundown

-

INFO

$ProfileId (integer)

$Name (string)

$Type (integer)

$Class (integer)

$Guid (string)

$ValueSize (integer)

$Value (string)

107

ProfileStatusRundown

-

INFO

$Flags (integer)

108

ProfileEnabled

-

INFO

$ProfileId (integer)

109

ProfileDisabled

-

INFO

$ProfileId (integer)

110

IdleDurationExpiration

-

INFO

$GroupCount (integer)

$Group (string)

111

DeliveredPerfChange

-

INFO

$Group (integer)

$Number (integer)

$DeliveredPerformance (integer)

111

DeliveredPerfChange

-

INFO

$Group (integer)

$Number (integer)

$DeliveredPerformance (integer)

$DurationInUs (integer)

111

DeliveredPerfChange

-

INFO

$Group (integer)

$Number (integer)

$DeliveredPerformance (integer)

$DurationInUs (integer)

$DeliveredFrequency (integer)

112

ParkSelection

-

-

$Group (integer)

$Processors (string)

$OldPark (string)

$NewPark (string)

$OverUtilizedSet (string)

$IsolatedCores (string)

$IdealUnparked (integer)

$UnparkCount (integer)

$ParkReason (integer)

113

ProcessorEnergyCounter

-

-

$Group (integer)

$Number (integer)

$CounterId (integer)

$CounterValue (string)

114

PackageEnergyCounter

-

-

$CounterId (integer)

$CounterValue (string)

115

ProcessorPreVetoAccountingRundown

-

-

$Group (integer)

$Number (integer)

$StateIndex (integer)

$VetoCodeCount (integer)

$Accounting (integer)

116

PlatformPreVetoAccountingRundown

-

-

$StateIndex (integer)

$VetoCodeCount (integer)

$Accounting (integer)

117

NotifyCpcHighest

-

INFO

$Group (integer)

$Number (integer)

118

ProcessorClassUpdate

-

INFO

$Group (integer)

$Number (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

118

ProcessorClassUpdate

-

INFO

$Group (integer)

$Number (integer)

$EfficiencyClass (integer)

$SchedulingClass (integer)

$EfficiencySchedulingClass (integer)

119

HeterogeneousPoliciesChanged

-

INFO

$HeterogeneousPolicy (integer)

$HeterogeneousSystemType (integer)

$DefaultPolicy (integer)

$DefaultDynamicPolicy (integer)

$DynamicCpuPolicyMask (integer)

$DynamicCpuPolicyImportant (integer)

$DynamicCpuPolicyImportantShort (integer)

$DynamicCpuPolicyImportantPriority (integer)

$DynamicCpuPolicyExpectedRuntime (integer)

120

HeterogeneousPoliciesRundown

-

INFO

$HeterogeneousPolicy (integer)

$HeterogeneousSystemType (integer)

$DefaultPolicy (integer)

$DefaultDynamicPolicy (integer)

$DynamicCpuPolicyMask (integer)

$DynamicCpuPolicyImportant (integer)

$DynamicCpuPolicyImportantShort (integer)

$DynamicCpuPolicyImportantPriority (integer)

$DynamicCpuPolicyExpectedRuntime (integer)

121

AutonomousModeChange

-

INFO

$Group (integer)

$Number (integer)

$Autonomous (boolean)

122

ProcessorLpiStatesRundown

-

INFO

$Group (integer)

$Number (integer)

$Revision (integer)

$LevelId (integer)

$StateCount (integer)

$States (integer)

123

ProcessorContainerLpiStatesRundown

-

INFO

$NamespacePath (string)

$Revision (integer)

$LevelId (integer)

$StateCount (integer)

$States (integer)

124

VirtualHeterogeneityRundown

-

INFO

$VirtualHeterogeneitySupported (boolean)

$VirtualHeterogeneityOn (boolean)

$DisableReasons (integer)

125

VirtualHeterogeneitySupportChanged

-

INFO

$VirtualHeterogeneitySupported (boolean)

$VirtualHeterogeneityOn (boolean)

$DisableReasons (integer)

126

QosSupportRundown

-

INFO

$SchedulerDirectedPerfStatesSupported (boolean)

$PpmQosEnabled (boolean)

$PpmQosDisableReasons (integer)

127

QosSupportChanged

-

INFO

$SchedulerDirectedPerfStatesSupported (boolean)

$PpmQosEnabled (boolean)

$PpmQosDisableReasons (integer)

128

PepPerfDomainInfo

-

INFO

$DomainId (integer)

$CoordinationType (integer)

$IdleProcessorsDiscounted (boolean)

$SchedulerDirectedTransitionsSupported (boolean)

$WorstCaseTransitionLatency (integer)

$WorstCaseTransitionOverhead (integer)

128

PepPerfDomainInfo

-

INFO

$DomainId (integer)

$CoordinationType (integer)

$IdleProcessorsDiscounted (boolean)

$SchedulerDirectedTransitionsSupported (boolean)

$WorstCaseTransitionLatency (integer)

$WorstCaseTransitionOverhead (integer)

$AffinitizePerfSet (boolean)

129

PepPerfDomainInfoRundown

-

INFO

$DomainId (integer)

$CoordinationType (integer)

$IdleProcessorsDiscounted (boolean)

$SchedulerDirectedTransitionsSupported (boolean)

$WorstCaseTransitionLatency (integer)

$WorstCaseTransitionOverhead (integer)

129

PepPerfDomainInfoRundown

-

INFO

$DomainId (integer)

$CoordinationType (integer)

$IdleProcessorsDiscounted (boolean)

$SchedulerDirectedTransitionsSupported (boolean)

$WorstCaseTransitionLatency (integer)

$WorstCaseTransitionOverhead (integer)

$AffinitizePerfSet (boolean)

130

HgsUpdate

-

INFO

131

ParkNodeClassRecordedStats

-

-

$Group (integer)

$Affinity (string)

$Class (integer)

$DistributeCores (integer)

$HistogramSize (integer)

$ConcurrencyHistogram (integer)

132

ParkNodeParkHintChange

-

-

$Group (integer)

$Affinity (string)

$ParkHint (string)

133

HiddenProcessorPerfRundown

-

INFO

$DomainMasterGroup (integer)

$DomainMasterNumber (integer)

$ProcessorId (integer)

$BiosCap (integer)

$ThermalCap (integer)

134

HiddenProcessorBiosCapChange

-

INFO

$DomainMasterGroup (integer)

$DomainMasterNumber (integer)

$ProcessorId (integer)

$Cap (integer)

135

HiddenProcessorThermalCapChange

-

INFO

$DomainMasterGroup (integer)

$DomainMasterNumber (integer)

$ProcessorId (integer)

$Cap (integer)

136

PerfStatesDegraded

-

ERROR

Microsoft-Windows-NetworkSecurity

801

task_0

-

-

$SaContextID (integer)

$Reason (integer)

802

task_0

-

-

$SaContextID (integer)

$Result (integer)

803

task_0

-

-

$SaContextID (integer)

$LocalAddr (string)

$LocalMask (string)

$LocalPort (integer)

$RemoteAddress (string)

$RemoteMask (string)

$RemotePort (integer)

$IPProtocol (integer)

$LocalTunnelEndpt (string)

$RemoteTunnelEndpt (string)

804

task_0

-

-

$SaContextID (integer)

805

task_0

-

-

$SaContextID (integer)

$SPI (integer)

806

SaContextOperation

win:Start

-

807

SaContextOperation

win:Stop

-

808

SaContextOperation

-

-

$SaContextID (integer)

Microsoft-Windows-Power-Meter-Polling

1

PowerMeterRundown

-

INFO

$MeterId (string)

$DefaultSamplingPeriodInMs (integer)

$MeterNameLength (integer)

$MeterName (string)

$MeteredHardwareCount (integer)

$MeteredHardwareName (string)

2

EnergyMeterRundown

-

INFO

$MeterId (string)

$DefaultSamplingPeriodInMs (integer)

$ChannelNameLength (integer)

$ChannelName (string)

3

PowerMeterData

-

INFO

$MeterId (string)

$Value (integer)

4

EnergyMeterData

-

INFO

$MeterId (string)

$AbsoluteEnergy (integer)

$AbsoluteTime (integer)

5

SamplingPeriodRundown

-

INFO

$MeterType (integer)

$PeriodInMs (integer)

6

SamplingPeriodChange

-

INFO

$MeterType (integer)

$PeriodInMs (integer)

Microsoft-Windows-Power-Troubleshooter

1

task_0

-

INFO

$SleepTime (string)

$WakeTime (string)

$SleepDuration (integer)

$WakeDuration (integer)

$DriverInitDuration (integer)

$BiosInitDuration (integer)

$HiberWriteDuration (integer)

$HiberReadDuration (integer)

$HiberPagesWritten (integer)

$Attributes (integer)

$TargetState (integer)

$EffectiveState (integer)

$WakeSourceType (integer)

$WakeSourceTextLength (integer)

$WakeSourceText (string)

1

task_0

-

INFO

$SleepTime (string)

$WakeTime (string)

$SleepDuration (integer)

$WakeDuration (integer)

$DriverInitDuration (integer)

$BiosInitDuration (integer)

$HiberWriteDuration (integer)

$HiberReadDuration (integer)

$HiberPagesWritten (integer)

$Attributes (integer)

$TargetState (integer)

$EffectiveState (integer)

$WakeSourceType (integer)

$WakeSourceTextLength (integer)

$WakeSourceText (string)

$WakeTimerOwnerLength (integer)

$WakeTimerContextLength (integer)

$WakeTimerOwner (string)

$WakeTimerContext (string)

1

task_0

-

INFO

$SleepTime (string)

$WakeTime (string)

$SleepDuration (integer)

$WakeDuration (integer)

$DriverInitDuration (integer)

$BiosInitDuration (integer)

$HiberWriteDuration (integer)

$HiberReadDuration (integer)

$HiberPagesWritten (integer)

$Attributes (integer)

$TargetState (integer)

$EffectiveState (integer)

$WakeSourceType (integer)

$WakeSourceTextLength (integer)

$WakeSourceText (string)

$WakeTimerOwnerLength (integer)

$WakeTimerContextLength (integer)

$NoMultiStageResumeReason (integer)

$WakeTimerOwner (string)

$WakeTimerContext (string)

Microsoft-Windows-PowerCfg

101

PowerCpl_LoadAdvancedUI

win:Start

INFO

102

PowerCpl_LoadAdvancedUI

win:Stop

INFO

103

PowerCpl_SelectPlan

win:Start

INFO

104

PowerCpl_SelectPlan

win:Stop

INFO

105

PowerCpl_SaveAll

win:Start

INFO

106

PowerCpl_SaveAll

win:Stop

INFO

107

PowerCpl_SettingInit

win:Start

INFO

108

PowerCpl_SettingInit

win:Stop

INFO

109

PowerCpl_ShowHelp

win:Start

INFO

110

PowerCpl_ShowHelp

win:Stop

INFO

111

PowerCpl_ExpandOrContractSetting

win:Start

INFO

112

PowerCpl_ExpandOrContractSetting

win:Stop

INFO

113

PowerCpl_HoverSetting

win:Start

INFO

114

PowerCpl_HoverSetting

win:Stop

INFO

115

PowerCpl_SpinnerOverrideTime

win:Start

INFO

116

PowerCpl_SpinnerOverrideTime

win:Stop

INFO

117

PowerCpl_ComboOverrideTime

win:Start

INFO

118

PowerCpl_ComboOverrideTime

win:Stop

INFO

119

PowerCpl_ShowGroupPolicy

win:Start

INFO

120

PowerCpl_ShowGroupPolicy

win:Stop

INFO

Microsoft-Windows-PowerCpl

101

PowerCpl_InitializePage

win:Start

INFO

102

PowerCpl_InitializePage

win:Stop

INFO

103

PowerCpl_Initialize

win:Start

INFO

104

PowerCpl_Initialize

win:Stop

INFO

105

PowerCpl_InitializePage

win:Start

INFO

106

PowerCpl_InitializePage

win:Stop

INFO

107

PowerCpl_InitializePage

win:Start

INFO

108

PowerCpl_InitializePage

win:Stop

INFO

109

PowerCpl_InitializePage

win:Start

INFO

110

PowerCpl_InitializePage

win:Stop

INFO

111

PowerCpl_InitializePage

win:Start

INFO

112

PowerCpl_InitializePage

win:Stop

INFO

113

PowerCpl_InitPlanList

win:Start

INFO

114

PowerCpl_InitPlanList

win:Stop

INFO

115

PowerCpl_InitBrightness

win:Start

INFO

116

PowerCpl_InitBrightness

win:Stop

INFO

117

PowerCpl_UpdatePage

win:Start

INFO

118

PowerCpl_UpdatePage

win:Stop

INFO

119

PowerCpl_Launch

win:Stop

INFO

120

PowerCpl_InitializeCreateNewPlanPage

win:Start

INFO

121

PowerCpl_InitializeCreateNewPlanPage

win:Stop

INFO

122

PowerCpl_InitializeGlobalSettingsPage

win:Start

INFO

123

PowerCpl_InitializeGlobalSettingsPage

win:Stop

INFO

124

PowerCpl_InitializePlanSettingsPage

win:Start

INFO

125

PowerCpl_InitializePlanSettingsPage

win:Stop

INFO

126

PowerCpl_InitializePowerPlansPage

win:Start

INFO

127

PowerCpl_InitializePowerPlansPage

win:Stop

INFO

Microsoft-Windows-PowerShell-DesiredStateConfiguration-FileDownloadManager

4097

ValidaterequestinFileDownloadManager

-

INFO

$ExceptionSeen (string)

4098

DownloadrequestinFileDownloadManager

-

INFO

$ExceptionSeen (string)

4099

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

4100

ValidaterequestinFileDownloadManager

-

ERROR

$FileName (string)

4101

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

4102

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

4103

ValidaterequestinFileDownloadManager

-

ERROR

$FileName (string)

4104

ValidaterequestinFileDownloadManager

-

INFO

$Checksum (string)

$FileName (string)

4106

ValidaterequestinFileDownloadManager

-

ERROR

$FileName (string)

4107

ValidaterequestinFileDownloadManager

-

ERROR

$GeneratedChecksum (string)

$ExpectedChecksum (string)

$FileName (string)

4108

ValidaterequestinFileDownloadManager

-

INFO

$FileName (string)

4109

ValidaterequestinFileDownloadManager

-

ERROR

$FileName (string)

4110

ValidaterequestinFileDownloadManager

-

INFO

$FileName (string)

4111

DownloadrequestinFileDownloadManager

-

INFO

$SourceFile (string)

$DestFile (string)

4112

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

4113

DownloadrequestinFileDownloadManager

-

INFO

$FileName (string)

4114

DownloadrequestinFileDownloadManager

-

INFO

$FileName (string)

4115

DownloadrequestinFileDownloadManager

-

INFO

$FileName (string)

4116

DownloadrequestinFileDownloadManager

-

INFO

$FileName (string)

4117

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

4118

ValidaterequestinFileDownloadManager

-

ERROR

$ExceptionSeen (string)

4119

DownloadrequestinFileDownloadManager

-

ERROR

$ExceptionSeen (string)

4120

DownloadrequestinFileDownloadManager

-

ERROR

$FileName (string)

Microsoft-Windows-PowerShell

4097

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

4098

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

4099

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

4100

None

Tobeusedwhenanexceptionisraised

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

4101

None

Tobeusedwhenanexceptionisraised

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

4102

None

Tobeusedwhenanexceptionisraised

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

4103

None

Tobeusedwhenanexceptionisraised

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

4104

StartingCommand

Oncreatecalls

-

$MessageNumber (integer)

$MessageTotal (integer)

$ScriptBlockText (string)

$ScriptBlockId (string)

$Path (string)

4105

StartingCommand

Open(async)

-

$ScriptBlockId (string)

$RunspaceId (string)

4106

StoppingCommand

Close(Async)

-

$ScriptBlockId (string)

$RunspaceId (string)

7937

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

7938

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

7939

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

7940

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ContextInfo (string)

$UserData (string)

$Payload (string)

7941

task_0

Tobeusedwhenoperationisjustexecutingamethod

-

$currentActivityId (string)

$parentActivityId (string)

7942

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ClassName (string)

$MethodName (string)

$WorkflowGuid (string)

$Message (string)

$JobData (string)

$ActivityName (string)

$ActivityGuid (string)

$Parameters (string)

8193

Connect

tobeusedwhenanobjectisconstructed

-

$param1 (string)

8194

Connect

tobeusedwhenanobjectisconstructed

-

$InstanceId (string)

$MaxRunspaces (string)

$MinRunspaces (string)

8195

Connect

Open(async)

-

8196

Connect

Open(async)

-

8197

Connect

Open(async)

-

$param1 (string)

8198

Connect

Open(async)

-

$param1 (string)

$param2 (string)

$param3 (string)

12033

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

$param1 (string)

12034

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

$param1 (string)

12035

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

$param1 (string)

12036

Connect

Tobeusedwhenoperationisjustexecutingamethod

-

$param1 (string)

12037

Connect

Tobeusedwhenoperationisjustexecutingamethod

INFO

12038

Connect

Tobeusedwhenoperationisjustexecutingamethod

INFO

$uri (string)

$shell (string)

$userName (string)

$opentimeout (string)

$idletimeout (string)

$canceltimeout (string)

$auth (integer)

$thumbPrint (string)

$redircount (string)

$recvdDataSize (string)

$recvdObjSize (string)

12039

Connect

Open(async)

-

24577

PowerShellISEOperation

-

INFO

$FileName (string)

24578

PowerShellISEOperation

-

INFO

$FileName (string)

24579

PowerShellISEOperation

-

INFO

24580

PowerShellISEOperation

-

INFO

24581

PowerShellISEOperation

-

INFO

24582

PowerShellISEOperation

-

INFO

24583

PowerShellISEOperation

-

INFO

24584

PowerShellISEOperation

-

INFO

24592

PowerShellISEOperation

-

INFO

24593

None

-

INFO

24594

PowerShellISEOperation

-

INFO

24595

PowerShellISEOperation

-

INFO

$CurrentLine (integer)

$FileName (string)

24596

PowerShellISEOperation

-

INFO

$CurrentLine (integer)

$FileName (string)

24597

PowerShellISEOperation

-

INFO

$CurrentLine (integer)

$FileName (string)

24598

PowerShellISEOperation

-

INFO

$CurrentLine (integer)

$FileName (string)

24599

PowerShellISEOperation

-

INFO

$CurrentLine (integer)

$FileName (string)

28673

Serializeordeserializeremotingpayload

Rehydration

-

$DeserializedType (string)

$CastedToType (string)

$RehydratedType (string)

28674

Serializeordeserializeremotingpayload

Rehydration

ERROR

$DeserializedType (string)

$CastedToType (string)

$TypeCastException (string)

$TypeCastInnerException (string)

28675

Serializeordeserializeremotingpayload

Serializationsettings

-

$SerializedType (string)

$OriginalDepth (integer)

$OverridenDepth (integer)

$CurrentDepthBelowTopLevel (integer)

28676

Serializeordeserializeremotingpayload

Serializationsettings

-

$SerializedType (string)

$OverridenMode (integer)

28677

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

WARNING

$PropertyName (string)

$PropertyOwnerType (string)

$GetterScript (string)

28678

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

WARNING

$PropertyName (string)

$PropertyOwnerType (string)

$Exception (string)

$InnerException (string)

28679

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

WARNING

$TypeBeingEnumerated (string)

$Exception (string)

28680

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

WARNING

$Type (string)

$Exception (string)

28682

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

ERROR

$TypeOfObjectAtMaxDepth (string)

$PropertyNameAtMaxDepth (string)

$Depth (integer)

28683

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

ERROR

$LineNumber (integer)

$LinePosition (integer)

$Exception (string)

28684

Serializeordeserializeremotingpayload

Tobeusedwhenanexceptionisraised

WARNING

$TypeOfObjectWithMissingProperty (string)

$PropertyName (string)

32769

task_0

Receive(Async)

INFO

$Runspace_InstanceId (string)

$PowerShell_InstanceId (string)

$Destination (integer)

$DataType (integer)

$TargetInterface (integer)

32775

task_0

Open(async)

ERROR

$param1 (string)

$param2 (string)

$param3 (string)

32776

task_0

Open(async)

ERROR

$SessionId (string)

$PipelineId (string)

$ErrorCode (string)

$ErrorMessage (string)

$StackTrace (string)

32777

task_0

Open(async)

ERROR

$param1 (string)

$param2 (string)

$param3 (string)

32784

task_0

Open(async)

ERROR

$SessionId (string)

$PipelineId (string)

$ErrorCode (string)

$ErrorMessage (string)

$StackTrace (string)

32785

task_0

connect

INFO

$param1 (string)

32786

task_0

connect

INFO

$param1 (string)

32787

task_0

Disconnect

INFO

$param1 (string)

32788

task_0

Disconnect

INFO

$param1 (string)

32789

task_0

Send(Async)

INFO

$SessionId (string)

$PipelineId (string)

$DataSize (string)

32790

task_0

Send(Async)

INFO

$SessionId (string)

$PipelineId (string)

32791

task_0

Receive(Async)

INFO

$SessionId (string)

$PipelineId (string)

32792

task_0

Receive(Async)

INFO

$SessionId (string)

$PipelineId (string)

$DataSize (string)

32793

task_0

connect

INFO

$SessionId (string)

$PipelineId (string)

32800

task_0

connect

INFO

$SessionId (string)

$PipelineId (string)

32801

task_0

Disconnect

INFO

$SessionId (string)

$PipelineId (string)

32802

task_0

Disconnect

INFO

$SessionId (string)

$PipelineId (string)

32803

task_0

Disconnect

INFO

$SessionId (string)

$PipelineId (string)

$SignalCode (string)

32804

task_0

Disconnect

INFO

$SessionId (string)

$PipelineId (string)

32805

task_0

connect

INFO

$SessionId (string)

$Uri (string)

32849

task_0

Send(Async)

INFO

$Runspace_InstanceId (string)

$PowerShell_InstanceId (string)

$DataSize (string)

$DataType (integer)

$TargetInterface (integer)

32850

task_0

connect

INFO

$param1 (string)

$param2 (string)

$param3 (string)

32851

task_0

connect

INFO

$param1 (string)

$param2 (string)

32852

task_0

connect

INFO

$param1 (string)

$param2 (string)

$param3 (string)

$param4 (string)

32853

task_0

connect

INFO

$param1 (string)

$param2 (string)

32854

task_0

Disconnect

INFO

$param1 (string)

$param2 (string)

$param3 (string)

32855

task_0

Open(async)

INFO

$param1 (string)

$param2 (string)

$param3 (string)

32856

task_0

Open(async)

INFO

$param1 (string)

$param2 (string)

$param3 (string)

32857

task_0

Disconnect

INFO

$param1 (string)

$param2 (string)

$param3 (string)

32865

task_0

connect

INFO

$param1 (string)

$param2 (string)

32866

task_0

connect

INFO

$param1 (string)

$param2 (string)

32867

task_0

Receive(Async)

-

$ObjectId (integer)

$FragmentId (integer)

$sFlag (integer)

$eFlag (integer)

$FragmentLength (integer)

$FragmentPayload (string)

32868

task_0

Send(Async)

-

$ObjectId (integer)

$FragmentId (integer)

$sFlag (integer)

$eFlag (integer)

$FragmentLength (integer)

$FragmentPayload (string)

32869

task_0

Shuttingdown

-

40961

PowerShellConsoleStartup

win:Start

INFO

40962

PowerShellConsoleStartup

win:Stop

INFO

45057

None

Tobeusedwhenanexceptionisraised

ERROR

$Message (string)

$Category (string)

$Reason (string)

$TargetName (string)

$FullyQualifiedErrorId (string)

$ExceptionMessage (string)

$ExceptionStackTrace (string)

$ExceptionInnerException (string)

45058

None

Tobeusedwhenanexceptionisraised

ERROR

$param1 (string)

$param2 (string)

$param3 (string)

45059

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

45060

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$Id (string)

$InstanceId (string)

$Name (string)

$Location (string)

$State (string)

$Command (string)

45061

None

-

INFO

$param1 (string)

45062

None

Tobeusedwhenoperationisjustexecutingamethod

INFO

$uri (string)

$shell (string)

$userName (string)

$opentimeout (string)

$idletimeout (string)

$canceltimeout (string)

$auth (integer)

$thumbPrint (string)

$redircount (string)

$recvdDataSize (string)

$recvdObjSize (string)

45063

WorkflowHosting

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$user (string)

$hostingMode (string)

$protocol (string)

$configuration (string)

45064

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$managedNodes (string)

45065

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$newState (string)

$oldState (string)

45072

WorkflowHosting

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

45073

WorkflowHosting

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

45074

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45075

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$configName (string)

$allowedValue (string)

$valueInQuestion (string)

45076

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45078

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$managedNode (string)

45079

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$activityName (string)

45080

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$activityName (string)

$activityTypeName (string)

45081

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$xamlFile (string)

45082

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$xamlFile (string)

45083

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$errorDescription (string)

45084

WorkflowValidation

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45085

WorkflowValidation

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45086

WorkflowValidation

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45087

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$activityDisplayName (string)

$activityType (string)

45088

WorkflowValidation

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$activityDisplayName (string)

$activityType (string)

45089

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$activityName (string)

$failureDescription (string)

45090

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$runspaceId (string)

$availability (string)

45091

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$runspaceId (string)

$newState (string)

$oldState (string)

45092

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45093

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45094

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45095

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45096

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45097

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$path (string)

45098

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$path (string)

45100

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$jobId (string)

45101

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$jobId (integer)

$workflowId (string)

$newState (string)

$oldState (string)

45102

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$jobId (integer)

$workflowId (string)

$errorDescription (string)

45104

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$parentJobId (string)

$childJobId (string)

$childWorkflowId (string)

45105

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$jobId (string)

45106

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$jobId (string)

$workflowId (string)

45107

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$parentJobId (string)

$childJobId (string)

$workflowId (string)

45108

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$parentJobId (string)

$childJobId (string)

$workflowId (string)

$error (string)

45109

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45110

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45111

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45112

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$reason (string)

45113

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45114

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45115

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45116

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$errorDescription (string)

45117

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$persistPath (string)

45118

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

45119

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$activityName (string)

45120

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$workflowId (string)

$errorDescription (string)

45121

Configuration

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$endpointType (string)

$registeredBy (string)

45122

Configuration

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$modifiedBy (string)

45123

Configuration

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$unregisteredBy (string)

45124

Configuration

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$disabledBy (string)

45125

Configuration

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

$enabledBy (string)

45126

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$command (string)

45127

WorkflowExecution

Tobeusedwhenoperationisjustexecutingamethod

-

$parameters (string)

$computers (string)

45128

WorkflowHosting

Tobeusedwhenoperationisjustexecutingamethod

-

$endpointName (string)

45129

None

-

INFO

$checkpointPath (string)

$configProviderId (string)

$userName (string)

$path (string)

46337

None

-

INFO

$TrackingId (string)

46338

None

-

INFO

$TrackingId (string)

46339

None

-

INFO

$TrackingId (string)

46340

None

-

INFO

$TrackingId (string)

46341

None

-

INFO

$TrackingId (string)

$ContainerParentJobInstanceId (string)

46342

None

-

INFO

$WorkflowJobJobInstanceId (string)

46343

None

-

INFO

$WorkflowJobJobInstanceId (string)

46344

None

-

INFO

$WorkflowJobJobInstanceId (string)

46345

None

-

INFO

$WorkflowJobJobInstanceId (string)

46346

None

-

INFO

$WorkflowJobInstanceId (string)

$ContainerParentJobInstanceId (string)

46347

None

-

INFO

$ProxyJobInstanceId (string)

$ContainerParentJobInstanceId (string)

46348

None

-

INFO

$ContainerParentJobInstanceId (string)

46349

None

-

INFO

$ContainerParentJobInstanceId (string)

46350

None

-

INFO

$ProxyJobInstanceId (string)

46351

None

-

INFO

$ProxyJobInstanceId (string)

46352

None

-

INFO

$ProxyJobInstanceId (string)

46353

None

-

INFO

$ProxyJobInstanceId (string)

46354

None

-

INFO

$ProxyChildJobInstanceId (string)

46355

None

-

INFO

$ProxyChildJobInstanceId (string)

46356

None

-

INFO

46357

None

-

INFO

46358

None

-

WARNING

49152

None

-

INFO

$message (string)

49153

None

-

INFO

$param1 (string)

$param2 (string)

53249

PowerShellScheduledJobs

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ScheduledJobDefName (string)

$StartTime (string)

53250

PowerShellScheduledJobs

Tobeusedwhenoperationisjustexecutingamethod

INFO

$ScheduledJobDefName (string)

$StopTime (string)

$State (string)

53251

PowerShellScheduledJobs

Tobeusedwhenanexceptionisraised

ERROR

$Name (string)

$Message (string)

$StackTrace (string)

$InnerException (string)

53504

PowerShellNamedPipeIPC

Open(async)

-

$param1 (string)

$param2 (string)

53505

PowerShellNamedPipeIPC

Close(Async)

-

$param1 (string)

$param2 (string)

53506

PowerShellNamedPipeIPC

Tobeusedwhenanexceptionisraised

-

$param1 (string)

$param2 (string)

$param3 (string)

53507

PowerShellNamedPipeIPC

connect

-

$param1 (string)

$param2 (string)

$param3 (string)

53508

PowerShellNamedPipeIPC

Close(Async)

-

$param1 (string)

$param2 (string)

$param3 (string)

Microsoft-Windows-RPC-FirewallManager

2

task_0

opcode_128

-

$FilterKey (string)

$ErrorStatus (string)

3

task_0

opcode_128

-

$FilterKey (string)

$ErrorStatus (string)

4

task_0

opcode_128

-

$FilterKey (string)

$ErrorStatus (string)

Microsoft-Windows-Security-Audit-Configuration-Client

100

task_0

win:Start

INFO

101

task_0

win:Stop

ERROR

$ErrorCode (integer)

102

task_0

-

INFO

$GPOList (string)

103

task_0

win:Start

INFO

104

task_0

-

ERROR

$ErrorCode (integer)

105

task_0

-

INFO

$GPOName (string)

$GPOID (string)

$SysvolPath (string)

106

task_0

-

INFO

$RemoteFile (string)

$LocalFile (string)

$GPOName (string)

107

task_0

-

ERROR

$RemoteFile (string)

$LocalFile (string)

$GPOName (string)

$ErrorCode (integer)

108

task_0

-

INFO

109

task_0

-

ERROR

$ErrorCode (integer)

110

task_0

-

INFO

111

task_0

-

ERROR

$ErrorCode (integer)

112

task_0

win:Stop

INFO

113

task_0

win:Stop

ERROR

$ErrorCode (integer)

114

task_0

-

INFO

115

task_0

-

ERROR

$ErrorCode (integer)

200

task_0

win:Start

INFO

201

task_0

win:Stop

ERROR

$ErrorCode (integer)

202

task_0

-

INFO

$GPOList (string)

203

task_0

win:Start

INFO

204

task_0

-

ERROR

$ErrorCode (integer)

205

task_0

-

INFO

$GPOName (string)

$GPOID (string)

$SysvolPath (string)

206

task_0

-

INFO

$RemoteFile (string)

$LocalFile (string)

$GPOName (string)

207

task_0

-

ERROR

$RemoteFile (string)

$LocalFile (string)

$GPOName (string)

$ErrorCode (integer)

208

task_0

-

INFO

209

task_0

-

ERROR

$ErrorCode (integer)

210

task_0

-

INFO

211

task_0

-

ERROR

$ErrorCode (integer)

212

task_0

win:Stop

INFO

213

task_0

win:Stop

ERROR

$ErrorCode (integer)

214

task_0

-

INFO

215

task_0

-

ERROR

$ErrorCode (integer)

Microsoft-Windows-Security-Auditing

4608

task_0

-

INFO

4609

task_0

-

INFO

4610

task_0

-

INFO

$AuthenticationPackageName (string)

4611

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$LogonProcessName (string)

4612

task_0

-

INFO

$AuditsDiscarded (integer)

4614

task_0

-

INFO

$NotificationPackageName (string)

4615

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$InvalidCallName (string)

$ServerPortName (string)

$ProcessId (string)

$ProcessName (string)

4616

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PreviousDate (string)

$PreviousTime (string)

$NewDate (string)

$NewTime (string)

$ProcessId (string)

$ProcessName (string)

4616

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PreviousTime (string)

$NewTime (string)

$ProcessId (string)

$ProcessName (string)

4618

task_0

-

INFO

$EventId (integer)

$ComputerName (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetUserDomain (string)

$TargetLogonId (string)

$EventCount (integer)

$Duration (string)

4621

task_0

-

INFO

$CrashOnAuditFailValue (string)

4622

task_0

-

INFO

$SecurityPackageName (string)

4624

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

$LogonProcessName (string)

$AuthenticationPackageName (string)

$WorkstationName (string)

$LogonGuid (string)

$TransmittedServices (string)

$LmPackageName (string)

$KeyLength (integer)

$ProcessId (string)

$ProcessName (string)

$IpAddress (string)

$IpPort (string)

4624

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

$LogonProcessName (string)

$AuthenticationPackageName (string)

$WorkstationName (string)

$LogonGuid (string)

$TransmittedServices (string)

$LmPackageName (string)

$KeyLength (integer)

$ProcessId (string)

$ProcessName (string)

$IpAddress (string)

$IpPort (string)

$ImpersonationLevel (string)

4624

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

$LogonProcessName (string)

$AuthenticationPackageName (string)

$WorkstationName (string)

$LogonGuid (string)

$TransmittedServices (string)

$LmPackageName (string)

$KeyLength (integer)

$ProcessId (string)

$ProcessName (string)

$IpAddress (string)

$IpPort (string)

$ImpersonationLevel (string)

$RestrictedAdminMode (string)

$TargetOutboundUserName (string)

$TargetOutboundDomainName (string)

$VirtualAccount (string)

$TargetLinkedLogonId (string)

$ElevatedToken (string)

4625

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$Status (string)

$FailureReason (string)

$SubStatus (string)

$LogonType (integer)

$LogonProcessName (string)

$AuthenticationPackageName (string)

$WorkstationName (string)

$TransmittedServices (string)

$LmPackageName (string)

$KeyLength (integer)

$ProcessId (string)

$ProcessName (string)

$IpAddress (string)

$IpPort (string)

4626

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

$EventIdx (integer)

$EventCountTotal (integer)

$UserClaims (string)

$DeviceClaims (string)

4627

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

$EventIdx (integer)

$EventCountTotal (integer)

$GroupMembership (string)

4634

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$LogonType (integer)

4646

task_0

-

INFO

$notification (string)

4647

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

4648

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$LogonGuid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonGuid (string)

$TargetServerName (string)

$TargetInfo (string)

$ProcessId (string)

$ProcessName (string)

$IpAddress (string)

$IpPort (string)

4649

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserName (string)

$TargetDomainName (string)

$RequestType (string)

$LogonProcessName (string)

$AuthenticationPackage (string)

$WorkstationName (string)

$TransmittedServices (string)

$ProcessId (string)

$ProcessName (string)

4650

task_0

-

INFO

$LocalMMPrincipalName (string)

$RemoteMMPrincipalName (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$KeyModName (string)

$MMAuthMethod (string)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

4651

task_0

-

INFO

$LocalMMPrincipalName (string)

$LocalMMCertHash (string)

$LocalMMIssuingCA (string)

$LocalMMRootCA (string)

$RemoteMMPrincipalName (string)

$RemoteMMCertHash (string)

$RemoteMMIssuingCA (string)

$RemoteMMRootCA (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$KeyModName (string)

$MMAuthMethod (string)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

4652

task_0

-

INFO

$LocalMMPrincipalName (string)

$LocalMMCertHash (string)

$LocalMMIssuingCA (string)

$LocalMMRootCA (string)

$RemoteMMPrincipalName (string)

$RemoteMMCertHash (string)

$RemoteMMIssuingCA (string)

$RemoteMMRootCA (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$KeyModName (string)

$FailurePoint (string)

$FailureReason (string)

$MMAuthMethod (string)

$State (string)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$InitiatorCookie (string)

$ResponderCookie (string)

4653

task_0

-

INFO

$LocalMMPrincipalName (string)

$RemoteMMPrincipalName (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$KeyModName (string)

$FailurePoint (string)

$FailureReason (string)

$MMAuthMethod (string)

$State (string)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$InitiatorCookie (string)

$ResponderCookie (string)

4654

task_0

-

INFO

$LocalAddress (string)

$LocalAddressMask (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemoteAddressMask (string)

$RemotePort (integer)

$RemoteTunnelEndpoint (string)

$Protocol (integer)

$RemotePrivateAddress (string)

$KeyModName (string)

$FailurePoint (string)

$FailureReason (string)

$Mode (string)

$State (string)

$Role (string)

$MessageID (integer)

$QMFilterID (integer)

$MMSAID (integer)

4654

task_0

-

INFO

$LocalAddress (string)

$LocalAddressMask (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemoteAddressMask (string)

$RemotePort (integer)

$RemoteTunnelEndpoint (string)

$Protocol (integer)

$RemotePrivateAddress (string)

$KeyModName (string)

$FailurePoint (string)

$FailureReason (string)

$Mode (string)

$State (string)

$Role (string)

$MessageID (integer)

$QMFilterID (integer)

$MMSAID (integer)

$TunnelId (integer)

$TrafficSelectorId (integer)

4655

task_0

-

INFO

$LocalAddress (string)

$RemoteAddress (string)

$KeyModName (string)

$MMSAID (integer)

4656

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$TransactionId (string)

$AccessList (string)

$AccessMask (string)

$PrivilegeList (string)

$RestrictedSidCount (integer)

$ProcessId (string)

$ProcessName (string)

4656

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$TransactionId (string)

$AccessList (string)

$AccessReason (string)

$AccessMask (string)

$PrivilegeList (string)

$RestrictedSidCount (integer)

$ProcessId (string)

$ProcessName (string)

$ResourceAttributes (string)

4657

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectName (string)

$ObjectValueName (string)

$HandleId (string)

$OperationType (string)

$OldValueType (string)

$OldValue (string)

$NewValueType (string)

$NewValue (string)

$ProcessId (string)

$ProcessName (string)

4658

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$HandleId (string)

$ProcessId (string)

$ProcessName (string)

4659

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$TransactionId (string)

$AccessList (string)

$AccessMask (string)

$PrivilegeList (string)

$ProcessId (string)

4660

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$HandleId (string)

$ProcessId (string)

$ProcessName (string)

$TransactionId (string)

4661

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$TransactionId (string)

$AccessList (string)

$AccessMask (string)

$PrivilegeList (string)

$Properties (string)

$RestrictedSidCount (integer)

$ProcessId (string)

$ProcessName (string)

4661

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$TransactionId (string)

$AccessList (string)

$AccessReason (string)

$AccessMask (string)

$PrivilegeList (string)

$Properties (string)

$RestrictedSidCount (integer)

$ProcessId (string)

$ProcessName (string)

4662

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$OperationType (string)

$HandleId (string)

$AccessList (string)

$AccessMask (string)

$Properties (string)

$AdditionalInfo (string)

$AdditionalInfo2 (string)

4663

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$AccessList (string)

$AccessMask (string)

$ProcessId (string)

$ProcessName (string)

4663

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$AccessList (string)

$AccessMask (string)

$ProcessId (string)

$ProcessName (string)

$ResourceAttributes (string)

4664

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$FileName (string)

$LinkName (string)

$TransactionId (string)

4665

task_0

-

INFO

$AppName (string)

$AppInstance (integer)

$ClientName (string)

$ClientDomain (string)

$ClientLogonId (integer)

$Status (integer)

4666

task_0

-

INFO

$AppName (string)

$AppInstance (integer)

$ObjectName (string)

$ScopeName (string)

$ClientName (string)

$ClientDomain (string)

$ClientLogonId (integer)

$Role (string)

$Group (string)

$OperationName (string)

$OperationId (integer)

4667

task_0

-

INFO

$AppName (string)

$AppInstance (integer)

$ClientName (string)

$ClientDomain (string)

$ClientLogonId (integer)

4668

task_0

-

INFO

$AppName (string)

$AppInstance (integer)

$ClientName (string)

$ClientDomain (string)

$ClientLogonId (integer)

$StoreUrl (string)

4670

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$OldSd (string)

$NewSd (string)

$ProcessId (string)

$ProcessName (string)

4671

task_0

-

INFO

$CallerUserSid (string)

$CallerUserName (string)

$CallerDomainName (string)

$CallerLogonId (string)

$Ordinal (integer)

4672

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4673

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$Service (string)

$PrivilegeList (string)

$ProcessId (string)

$ProcessName (string)

4674

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$AccessMask (string)

$PrivilegeList (string)

$ProcessId (string)

$ProcessName (string)

4675

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TdoDirection (integer)

$TdoAttributes (integer)

$TdoType (integer)

$TdoSid (string)

$SidList (string)

4688

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$NewProcessId (string)

$NewProcessName (string)

$TokenElevationType (string)

$ProcessId (string)

4688

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$NewProcessId (string)

$NewProcessName (string)

$TokenElevationType (string)

$ProcessId (string)

$CommandLine (string)

4688

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$NewProcessId (string)

$NewProcessName (string)

$TokenElevationType (string)

$ProcessId (string)

$CommandLine (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$ParentProcessName (string)

$MandatoryLabel (string)

4689

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Status (string)

$ProcessId (string)

$ProcessName (string)

4690

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$SourceHandleId (string)

$SourceProcessId (string)

$TargetHandleId (string)

$TargetProcessId (string)

4691

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectType (string)

$ObjectName (string)

$AccessList (string)

$AccessMask (string)

$ProcessId (string)

4692

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$MasterKeyId (string)

$RecoveryServer (string)

$RecoveryKeyId (string)

$FailureReason (string)

4693

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$MasterKeyId (string)

$RecoveryReason (string)

$RecoveryServer (string)

$RecoveryKeyId (string)

$FailureId (string)

4694

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DataDescription (string)

$MasterKeyId (string)

$ProtectedDataFlags (string)

$CryptoAlgorithms (string)

$FailureReason (string)

4695

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DataDescription (string)

$MasterKeyId (string)

$ProtectedDataFlags (string)

$CryptoAlgorithms (string)

$FailureReason (string)

4696

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$TargetProcessId (string)

$TargetProcessName (string)

$ProcessId (string)

$ProcessName (string)

4697

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ServiceName (string)

$ServiceFileName (string)

$ServiceType (string)

$ServiceStartType (integer)

$ServiceAccount (string)

4697

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ServiceName (string)

$ServiceFileName (string)

$ServiceType (string)

$ServiceStartType (integer)

$ServiceAccount (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

4698

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

4698

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

$RpcCallClientLocality (integer)

$FQDN (string)

4699

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

4699

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

$RpcCallClientLocality (integer)

$FQDN (string)

4700

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

4700

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

$RpcCallClientLocality (integer)

$FQDN (string)

4701

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

4701

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContent (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

$RpcCallClientLocality (integer)

$FQDN (string)

4702

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContentNew (string)

4702

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TaskName (string)

$TaskContentNew (string)

$ClientProcessStartKey (integer)

$ClientProcessId (integer)

$ParentProcessId (integer)

$RpcCallClientLocality (integer)

$FQDN (string)

4703

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$ProcessName (string)

$ProcessId (string)

$EnabledPrivilegeList (string)

$DisabledPrivilegeList (string)

4704

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetSid (string)

$PrivilegeList (string)

4705

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetSid (string)

$PrivilegeList (string)

4706

task_0

-

INFO

$DomainName (string)

$DomainSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TdoType (integer)

$TdoDirection (integer)

$TdoAttributes (integer)

$SidFilteringEnabled (string)

4707

task_0

-

INFO

$DomainName (string)

$DomainSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4709

task_0

-

INFO

$param1 (string)

$param2 (string)

$param3 (string)

4710

task_0

-

INFO

$param1 (string)

$param2 (string)

4711

task_0

-

INFO

$param1 (string)

4712

task_0

-

INFO

$param1 (string)

4713

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$KerberosPolicyChange (string)

4714

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$EfsPolicyChange (string)

4715

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$OldSd (string)

$NewSd (string)

4716

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DomainName (string)

$DomainSid (string)

$TdoType (integer)

$TdoDirection (integer)

$TdoAttributes (integer)

$SidFilteringEnabled (string)

4717

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetSid (string)

$AccessGranted (string)

4718

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetSid (string)

$AccessRemoved (string)

4719

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$CategoryId (string)

$SubcategoryId (string)

$SubcategoryGuid (string)

$AuditPolicyChanges (string)

4720

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$DisplayName (string)

$UserPrincipalName (string)

$HomeDirectory (string)

$HomePath (string)

$ScriptPath (string)

$ProfilePath (string)

$UserWorkstations (string)

$PasswordLastSet (string)

$AccountExpires (string)

$PrimaryGroupId (string)

$AllowedToDelegateTo (string)

$OldUacValue (string)

$NewUacValue (string)

$UserAccountControl (string)

$UserParameters (string)

$SidHistory (string)

$LogonHours (string)

4722

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4723

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4724

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4725

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4726

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4727

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4728

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4728

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4729

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4730

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4731

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4732

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4732

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4733

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4734

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4735

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4737

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4738

task_0

-

INFO

$Dummy (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$DisplayName (string)

$UserPrincipalName (string)

$HomeDirectory (string)

$HomePath (string)

$ScriptPath (string)

$ProfilePath (string)

$UserWorkstations (string)

$PasswordLastSet (string)

$AccountExpires (string)

$PrimaryGroupId (string)

$AllowedToDelegateTo (string)

$OldUacValue (string)

$NewUacValue (string)

$UserAccountControl (string)

$UserParameters (string)

$SidHistory (string)

$LogonHours (string)

4739

task_0

-

INFO

$DomainPolicyChanged (string)

$DomainName (string)

$DomainSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MinPasswordAge (string)

$MaxPasswordAge (string)

$ForceLogoff (string)

$LockoutThreshold (string)

$LockoutObservationWindow (string)

$LockoutDuration (string)

$PasswordProperties (string)

$MinPasswordLength (string)

$PasswordHistoryLength (string)

$MachineAccountQuota (string)

$MixedDomainMode (string)

$DomainBehaviorVersion (string)

$OemInformation (string)

4740

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4741

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$DisplayName (string)

$UserPrincipalName (string)

$HomeDirectory (string)

$HomePath (string)

$ScriptPath (string)

$ProfilePath (string)

$UserWorkstations (string)

$PasswordLastSet (string)

$AccountExpires (string)

$PrimaryGroupId (string)

$AllowedToDelegateTo (string)

$OldUacValue (string)

$NewUacValue (string)

$UserAccountControl (string)

$UserParameters (string)

$SidHistory (string)

$LogonHours (string)

$DnsHostName (string)

$ServicePrincipalNames (string)

4742

task_0

-

INFO

$ComputerAccountChange (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$DisplayName (string)

$UserPrincipalName (string)

$HomeDirectory (string)

$HomePath (string)

$ScriptPath (string)

$ProfilePath (string)

$UserWorkstations (string)

$PasswordLastSet (string)

$AccountExpires (string)

$PrimaryGroupId (string)

$AllowedToDelegateTo (string)

$OldUacValue (string)

$NewUacValue (string)

$UserAccountControl (string)

$UserParameters (string)

$SidHistory (string)

$LogonHours (string)

$DnsHostName (string)

$ServicePrincipalNames (string)

4743

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4744

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4745

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4746

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4746

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4747

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4748

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4749

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4750

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4751

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4751

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4752

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4753

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4754

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4755

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4756

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4756

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4757

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4758

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4759

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4760

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4761

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4761

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4762

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4763

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4764

task_0

-

INFO

$GroupTypeChange (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4765

task_0

-

INFO

$SourceUserName (string)

$SourceSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SidList (string)

4766

task_0

-

INFO

$SourceUserName (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4767

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4768

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$ServiceName (string)

$ServiceSid (string)

$TicketOptions (string)

$Status (string)

$TicketEncryptionType (string)

$PreAuthType (string)

$IpAddress (string)

$IpPort (string)

$CertIssuerName (string)

$CertSerialNumber (string)

$CertThumbprint (string)

4769

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$ServiceName (string)

$ServiceSid (string)

$TicketOptions (string)

$TicketEncryptionType (string)

$IpAddress (string)

$IpPort (string)

$Status (string)

$LogonGuid (string)

$TransmittedServices (string)

4770

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$ServiceName (string)

$ServiceSid (string)

$TicketOptions (string)

$TicketEncryptionType (string)

$IpAddress (string)

$IpPort (string)

4771

task_0

-

INFO

$TargetUserName (string)

$TargetSid (string)

$ServiceName (string)

$TicketOptions (string)

$Status (string)

$PreAuthType (string)

$IpAddress (string)

$IpPort (string)

$CertIssuerName (string)

$CertSerialNumber (string)

$CertThumbprint (string)

4772

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$ServiceName (string)

$TicketOptions (string)

$FailureCode (string)

$IpAddress (string)

$IpPort (string)

4773

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$ServiceName (string)

$TicketOptions (string)

$FailureCode (string)

$IpAddress (string)

$IpPort (string)

4774

task_0

-

INFO

$MappingBy (string)

$ClientUserName (string)

$MappedName (string)

4775

task_0

-

INFO

$ClientUserName (string)

$MappingBy (string)

4776

task_0

-

INFO

$PackageName (string)

$TargetUserName (string)

$Workstation (string)

$Status (string)

4777

task_0

-

INFO

$ClientUserName (string)

$TargetUserName (string)

$Workstation (string)

$Status (string)

4778

task_0

-

INFO

$AccountName (string)

$AccountDomain (string)

$LogonID (string)

$SessionName (string)

$ClientName (string)

$ClientAddress (string)

4779

task_0

-

INFO

$AccountName (string)

$AccountDomain (string)

$LogonID (string)

$SessionName (string)

$ClientName (string)

$ClientAddress (string)

4780

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4781

task_0

-

INFO

$OldTargetUserName (string)

$NewTargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4782

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4783

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4784

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4785

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4785

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$MembershipExpirationTime (string)

4786

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4787

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4788

task_0

-

INFO

$MemberName (string)

$MemberSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4789

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4790

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4791

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SamAccountName (string)

$SidHistory (string)

4792

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

4793

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Workstation (string)

$TargetUserName (string)

$Status (string)

4794

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Workstation (string)

$Status (string)

4797

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Workstation (string)

$TargetUserName (string)

$TargetDomainName (string)

4798

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$CallerProcessId (string)

$CallerProcessName (string)

4799

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$CallerProcessId (string)

$CallerProcessName (string)

4800

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$SessionId (integer)

4801

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$SessionId (integer)

4802

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$SessionId (integer)

4803

task_0

-

INFO

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$SessionId (integer)

4816

task_0

-

INFO

$param1 (string)

$param2 (string)

$param3 (string)

4816

task_0

-

INFO

$PeerName (string)

$ProtocolSequence (string)

$SecurityError (integer)

4817

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$OldSd (string)

$NewSd (string)

4818

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$ProcessId (string)

$ProcessName (string)

$AccessReason (string)

$StagingReason (string)

4819

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$AddedCAPs (string)

$DeletedCAPs (string)

$ModifiedCAPs (string)

$AsIsCAPs (string)

4820

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$DeviceName (string)

$ServiceName (string)

$ServiceSid (string)

$TicketOptions (string)

$Status (string)

$TicketEncryptionType (string)

$PreAuthType (string)

$IpAddress (string)

$IpPort (string)

$CertIssuerName (string)

$CertSerialNumber (string)

$CertThumbprint (string)

$SiloName (string)

$PolicyName (string)

$TGTLifetime (integer)

4821

task_0

-

INFO

$TargetUserName (string)

$TargetDomainName (string)

$DeviceName (string)

$ServiceName (string)

$ServiceSid (string)

$TicketOptions (string)

$TicketEncryptionType (string)

$IpAddress (string)

$IpPort (string)

$Status (string)

$LogonGuid (string)

$TransitedServices (string)

$SiloName (string)

$PolicyName (string)

4822

task_0

-

INFO

$AccountName (string)

$DeviceName (string)

$Status (string)

4823

task_0

-

INFO

$AccountName (string)

$DeviceName (string)

$Status (string)

$SiloName (string)

$PolicyName (string)

4824

task_0

-

INFO

$TargetUserName (string)

$TargetSid (string)

$ServiceName (string)

$TicketOptions (string)

$Status (string)

$PreAuthType (string)

$IpAddress (string)

$IpPort (string)

$CertIssuerName (string)

$CertSerialNumber (string)

$CertThumbprint (string)

4825

task_0

-

INFO

$AccountName (string)

$AccountDomain (string)

$LogonID (string)

$ClientAddress (string)

4826

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$LoadOptions (string)

$AdvancedOptions (string)

$ConfigAccessPolicy (string)

$RemoteEventLogging (string)

$KernelDebug (string)

$VsmLaunchType (string)

$TestSigning (string)

$FlightSigning (string)

$DisableIntegrityChecks (string)

$HypervisorLoadOptions (string)

$HypervisorLaunchType (string)

$HypervisorDebug (string)

4830

task_0

-

INFO

$SourceUserName (string)

$SourceSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PrivilegeList (string)

$SidList (string)

4864

task_0

-

INFO

$CollisionTargetType (integer)

$CollisionTargetName (string)

$ForestRoot (string)

$TopLevelName (string)

$DnsName (string)

$NetbiosName (string)

$DomainSid (string)

$Flags (integer)

4865

task_0

-

INFO

$ForestRoot (string)

$ForestRootSid (string)

$OperationId (string)

$EntryType (integer)

$Flags (integer)

$TopLevelName (string)

$DnsName (string)

$NetbiosName (string)

$DomainSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4866

task_0

-

INFO

$ForestRoot (string)

$ForestRootSid (string)

$OperationId (string)

$EntryType (integer)

$Flags (integer)

$TopLevelName (string)

$DnsName (string)

$NetbiosName (string)

$DomainSid (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4867

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ForestRoot (string)

$ForestRootSid (string)

$OperationId (string)

$EntryType (integer)

$Flags (integer)

$TopLevelName (string)

$DnsName (string)

$NetbiosName (string)

$DomainSid (string)

4868

task_0

-

INFO

$RequestId (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4869

task_0

-

INFO

$RequestId (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4870

task_0

-

INFO

$CertificateSerialNumber (string)

$RevocationReason (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4871

task_0

-

INFO

$NextUpdate (string)

$NextPublishForBaseCRL (string)

$NextPublishForDeltaCRL (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4872

task_0

-

INFO

$IsBaseCRL (string)

$CRLNumber (string)

$KeyContainer (string)

$NextPublish (string)

$PublishURLs (string)

4873

task_0

-

INFO

$RequestId (string)

$ExtensionName (string)

$ExtensionDataType (string)

$ExtensionPolicyFlags (string)

$ExtensionData (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4874

task_0

-

INFO

$RequestId (string)

$Attributes (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4875

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4876

task_0

-

INFO

$BackupType (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4877

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4878

task_0

-

INFO

4879

task_0

-

INFO

4880

task_0

-

INFO

$CertificateDatabaseHash (string)

$PrivateKeyUsageCount (string)

$CACertificateHash (string)

$CAPublicKeyHash (string)

4881

task_0

-

INFO

$CertificateDatabaseHash (string)

$PrivateKeyUsageCount (string)

$CACertificateHash (string)

$CAPublicKeyHash (string)

4882

task_0

-

INFO

$SecuritySettings (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4883

task_0

-

INFO

$RequestId (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4884

task_0

-

INFO

$Certificate (string)

$RequestId (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4885

task_0

-

INFO

$AuditFilter (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4886

task_0

-

INFO

$RequestId (string)

$Requester (string)

$Attributes (string)

4887

task_0

-

INFO

$RequestId (string)

$Requester (string)

$Attributes (string)

$Disposition (string)

$SubjectKeyIdentifier (string)

$Subject (string)

4888

task_0

-

INFO

$RequestId (string)

$Requester (string)

$Attributes (string)

$Disposition (string)

$SubjectKeyIdentifier (string)

$Subject (string)

4889

task_0

-

INFO

$RequestId (string)

$Requester (string)

$Attributes (string)

$Disposition (string)

$SubjectKeyIdentifier (string)

$Subject (string)

4890

task_0

-

INFO

$EnableRestrictedPermissions (string)

$RestrictedPermissions (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4891

task_0

-

INFO

$Node (string)

$Entry (string)

$Value (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4892

task_0

-

INFO

$PropertyName (string)

$PropertyIndex (string)

$PropertyType (string)

$PropertyValue (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4893

task_0

-

INFO

$RequestId (string)

$Requester (string)

$KRAHashes (string)

4894

task_0

-

INFO

$RequestId (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4895

task_0

-

INFO

$CertificateHash (string)

$ValidFrom (string)

$ValidTo (string)

4896

task_0

-

INFO

$TableId (string)

$Filter (string)

$RowsDeleted (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

4897

task_0

-

INFO

$RoleSeparationEnabled (string)

4898

task_0

-

INFO

$TemplateInternalName (string)

$TemplateVersion (string)

$TemplateSchemaVersion (string)

$TemplateOID (string)

$TemplateDSObjectFQDN (string)

$DCDNSName (string)

$TemplateContent (string)

$SecurityDescriptor (string)

4899

task_0

-

INFO

$TemplateInternalName (string)

$TemplateVersion (string)

$TemplateSchemaVersion (string)

$TemplateOID (string)

$TemplateDSObjectFQDN (string)

$DCDNSName (string)

$NewTemplateContent (string)

$OldTemplateContent (string)

4900

task_0

-

INFO

$TemplateInternalName (string)

$TemplateVersion (string)

$TemplateSchemaVersion (string)

$TemplateOID (string)

$TemplateDSObjectFQDN (string)

$DCDNSName (string)

$NewTemplateContent (string)

$NewSecurityDescriptor (string)

$OldTemplateContent (string)

$OldSecurityDescriptor (string)

4902

task_0

-

INFO

$PuaCount (integer)

$PuaPolicyId (string)

4904

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$AuditSourceName (string)

$EventSourceId (string)

$ProcessId (string)

$ProcessName (string)

4905

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$AuditSourceName (string)

$EventSourceId (string)

$ProcessId (string)

$ProcessName (string)

4906

task_0

-

INFO

$CrashOnAuditFailValue (integer)

4907

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$OldSd (string)

$NewSd (string)

$ProcessId (string)

$ProcessName (string)

4908

task_0

-

INFO

$SidList (string)

4909

task_0

-

INFO

$OldBlockedOrdinals (string)

$NewBlockedOrdinals (string)

4910

task_0

-

INFO

$OldIgnoreDefaultSettings (integer)

$NewIgnoreDefaultSettings (integer)

$OldIgnoreLocalSettings (integer)

$NewIgnoreLocalSettings (integer)

$OldBlockedOrdinals (string)

$NewBlockedOrdinals (string)

4911

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$OldSd (string)

$NewSd (string)

$ProcessId (string)

$ProcessName (string)

4912

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetUserSid (string)

$CategoryId (string)

$SubcategoryId (string)

$SubcategoryGuid (string)

$AuditPolicyChanges (string)

4913

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectServer (string)

$ObjectType (string)

$ObjectName (string)

$HandleId (string)

$OldSd (string)

$NewSd (string)

$ProcessId (string)

$ProcessName (string)

4928

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4928

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4929

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4929

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4930

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4930

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4931

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4931

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$SourceAddr (string)

$NamingContext (string)

$Options (integer)

$StatusCode (integer)

4932

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$NamingContext (string)

$Options (integer)

$SessionID (integer)

$StartUSN (string)

4932

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$NamingContext (string)

$Options (integer)

$SessionID (integer)

$StartUSN (string)

4933

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$NamingContext (string)

$Options (integer)

$SessionID (integer)

$EndUSN (string)

$StatusCode (integer)

4933

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$NamingContext (string)

$Options (integer)

$SessionID (integer)

$EndUSN (string)

$StatusCode (integer)

4934

task_0

-

INFO

$SessionID (integer)

$Object (string)

$Attribute (string)

$TypeOfChange (integer)

$NewValue (string)

$USN (string)

$StatusCode (integer)

4935

task_0

-

INFO

$ReplicationEvent (integer)

$AuditStatusCode (integer)

4936

task_0

-

INFO

$ReplicationEvent (integer)

$AuditStatusCode (integer)

$ReplicationStatusCode (integer)

4937

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$Object (string)

$Options (integer)

$StatusCode (integer)

4937

task_0

-

INFO

$DestinationDRA (string)

$SourceDRA (string)

$Object (string)

$Options (integer)

$StatusCode (integer)

4944

task_0

-

INFO

$GroupPolicyApplied (string)

$Profile (string)

$OperationMode (string)

$RemoteAdminEnabled (string)

$MulticastFlowsEnabled (string)

$LogDroppedPacketsEnabled (string)

$LogSuccessfulConnectionsEnabled (string)

4945

task_0

-

INFO

$ProfileUsed (string)

$RuleId (string)

$RuleName (string)

4946

task_0

-

INFO

$ProfileChanged (string)

$RuleId (string)

$RuleName (string)

4947

task_0

-

INFO

$ProfileChanged (string)

$RuleId (string)

$RuleName (string)

4948

task_0

-

INFO

$ProfileChanged (string)

$RuleId (string)

$RuleName (string)

4949

task_0

-

INFO

4950

task_0

-

INFO

$ProfileChanged (string)

$SettingType (string)

$SettingValue (string)

4951

task_0

-

INFO

$Profile (string)

$RuleId (string)

$RuleName (string)

4952

task_0

-

INFO

$Profile (string)

$RuleId (string)

$RuleName (string)

4953

task_0

-

INFO

$Profile (string)

$ReasonForRejection (string)

$RuleId (string)

$RuleName (string)

4954

task_0

-

INFO

4956

task_0

-

INFO

$ActiveProfile (string)

4957

task_0

-

INFO

$RuleId (string)

$RuleName (string)

$RuleAttr (string)

4958

task_0

-

INFO

$RuleId (string)

$RuleName (string)

$Error (string)

$Reason (string)

4960

task_0

-

INFO

$RemoteAddress (string)

$SPI (integer)

4961

task_0

-

INFO

$RemoteAddress (string)

$SPI (integer)

4962

task_0

-

INFO

$RemoteAddress (string)

$SPI (integer)

4963

task_0

-

INFO

$RemoteAddress (string)

$SPI (integer)

4964

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$LogonGuid (string)

$TargetUserSid (string)

$TargetUserName (string)

$TargetDomainName (string)

$TargetLogonId (string)

$TargetLogonGuid (string)

$SidList (string)

4965

task_0

-

INFO

$RemoteAddress (string)

$SPI (integer)

4976

task_0

-

INFO

$LocalAddress (string)

$RemoteAddress (string)

$KeyModName (string)

4977

task_0

-

INFO

$LocalAddress (string)

$RemoteAddress (string)

$KeyModName (string)

4978

task_0

-

INFO

$LocalAddress (string)

$RemoteAddress (string)

$KeyModName (string)

4979

task_0

-

INFO

$LocalMMPrincipalName (string)

$RemoteMMPrincipalName (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$MMAuthMethod (string)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

$LocalEMPrincipalName (string)

$RemoteEMPrincipalName (string)

$EMAuthMethod (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4980

task_0

-

INFO

$LocalMMPrincipalName (string)

$RemoteMMPrincipalName (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$MMAuthMethod (string)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

$LocalEMPrincipalName (string)

$LocalEMCertHash (string)

$LocalEMIssuingCA (string)

$LocalEMRootCA (string)

$RemoteEMPrincipalName (string)

$RemoteEMCertHash (string)

$RemoteEMIssuingCA (string)

$RemoteEMRootCA (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4981

task_0

-

INFO

$LocalMMPrincipalName (string)

$LocalMMCertHash (string)

$LocalMMIssuingCA (string)

$LocalMMRootCA (string)

$RemoteMMPrincipalName (string)

$RemoteMMCertHash (string)

$RemoteMMIssuingCA (string)

$RemoteMMRootCA (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

$LocalEMPrincipalName (string)

$RemoteEMPrincipalName (string)

$EMAuthMethod (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4982

task_0

-

INFO

$LocalMMPrincipalName (string)

$LocalMMCertHash (string)

$LocalMMIssuingCA (string)

$LocalMMRootCA (string)

$RemoteMMPrincipalName (string)

$RemoteMMCertHash (string)

$RemoteMMIssuingCA (string)

$RemoteMMRootCA (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$MMCipherAlg (string)

$MMIntegrityAlg (string)

$DHGroup (string)

$MMLifetime (integer)

$QMLimit (integer)

$Role (string)

$MMImpersonationState (string)

$MMFilterID (integer)

$MMSAID (integer)

$LocalEMPrincipalName (string)

$LocalEMCertHash (string)

$LocalEMIssuingCA (string)

$LocalEMRootCA (string)

$RemoteEMPrincipalName (string)

$RemoteEMCertHash (string)

$RemoteEMIssuingCA (string)

$RemoteEMRootCA (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4983

task_0

-

INFO

$LocalEMPrincipalName (string)

$LocalEMCertHash (string)

$LocalEMIssuingCA (string)

$LocalEMRootCA (string)

$RemoteEMPrincipalName (string)

$RemoteEMCertHash (string)

$RemoteEMIssuingCA (string)

$RemoteEMRootCA (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$FailurePoint (string)

$FailureReason (string)

$State (string)

$Role (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4984

task_0

-

INFO

$LocalEMPrincipalName (string)

$RemoteEMPrincipalName (string)

$LocalAddress (string)

$LocalKeyModPort (integer)

$RemoteAddress (string)

$RemoteKeyModPort (integer)

$FailurePoint (string)

$FailureReason (string)

$EMAuthMethod (string)

$State (string)

$Role (string)

$EMImpersonationState (string)

$QMFilterID (integer)

4985

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TransactionId (string)

$NewState (integer)

$ResourceManager (string)

$ProcessId (string)

$ProcessName (string)

5024

task_0

-

INFO

5025

task_0

-

INFO

5027

task_0

-

INFO

$ErrorCode (integer)

5028

task_0

-

INFO

$ErrorCode (integer)

5029

task_0

-

INFO

$ErrorCode (integer)

5030

task_0

-

INFO

$ErrorCode (integer)

5031

task_0

-

INFO

$Profiles (string)

$Application (string)

5032

task_0

-

INFO

$ErrorCode (integer)

5033

task_0

-

INFO

5034

task_0

-

INFO

5035

task_0

-

INFO

$ErrorCode (integer)

5037

task_0

-

INFO

$ErrorCode (integer)

5038

task_0

-

INFO

$param1 (string)

5039

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectPath (string)

$ObjectVirtualPath (string)

$ProcessId (string)

$ProcessName (string)

5040

task_0

-

INFO

$ProfileChanged (string)

$AuthenticationSetId (string)

$AuthenticationSetName (string)

5041

task_0

-

INFO

$ProfileChanged (string)

$AuthenticationSetId (string)

$AuthenticationSetName (string)

5042

task_0

-

INFO

$ProfileChanged (string)

$AuthenticationSetId (string)

$AuthenticationSetName (string)

5043

task_0

-

INFO

$ProfileChanged (string)

$ConnectionSecurityRuleId (string)

$ConnectionSecurityRuleName (string)

5044

task_0

-

INFO

$ProfileChanged (string)

$ConnectionSecurityRuleId (string)

$ConnectionSecurityRuleName (string)

5045

task_0

-

INFO

$ProfileChanged (string)

$ConnectionSecurityRuleId (string)

$ConnectionSecurityRuleName (string)

5046

task_0

-

INFO

$ProfileChanged (string)

$CryptographicSetId (string)

$CryptographicSetName (string)

5047

task_0

-

INFO

$ProfileChanged (string)

$CryptographicSetId (string)

$CryptographicSetName (string)

5048

task_0

-

INFO

$ProfileChanged (string)

$CryptographicSetId (string)

$CryptographicSetName (string)

5049

task_0

-

INFO

$ProfileChanged (string)

$IpSecSecurityAssociationId (string)

$IpSecSecurityAssociationName (string)

5050

task_0

-

INFO

$CallerProcessName (string)

$ProcessId (integer)

$Publisher (string)

5051

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$FileName (string)

$VirtualFileName (string)

$ProcessId (string)

$ProcessName (string)

5056

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Module (string)

$ReturnCode (string)

5057

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ProviderName (string)

$AlgorithmName (string)

$Reason (string)

$ReturnCode (string)

5058

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$KeyFilePath (string)

$Operation (string)

$ReturnCode (string)

5058

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ClientProcessId (integer)

$ClientCreationTime (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$KeyFilePath (string)

$Operation (string)

$ReturnCode (string)

5059

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$Operation (string)

$ReturnCode (string)

5059

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ClientProcessId (integer)

$ClientCreationTime (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$Operation (string)

$ReturnCode (string)

5060

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$Reason (string)

$ReturnCode (string)

5061

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ProviderName (string)

$AlgorithmName (string)

$KeyName (string)

$KeyType (string)

$Operation (string)

$ReturnCode (string)

5062

task_0

-

INFO

$Module (string)

$ReturnCode (integer)

5063

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$ProviderName (string)

$ModuleName (string)

$Operation (string)

$ReturnCode (integer)

5064

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$Operation (string)

$ReturnCode (integer)

5065

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$OldValue (integer)

$NewValue (integer)

$ReturnCode (integer)

5066

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$InterfaceId (string)

$FunctionName (string)

$Position (integer)

$Operation (string)

$ReturnCode (integer)

5067

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$InterfaceId (string)

$FunctionName (string)

$OldValue (integer)

$NewValue (integer)

$ReturnCode (integer)

5068

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$InterfaceId (string)

$FunctionName (string)

$ProviderName (string)

$Position (integer)

$Operation (string)

$ReturnCode (integer)

5069

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$InterfaceId (string)

$FunctionName (string)

$PropertyName (string)

$Operation (string)

$Value (string)

$ReturnCode (integer)

5070

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$Scope (string)

$ContextName (string)

$InterfaceId (string)

$FunctionName (string)

$PropertyName (string)

$OldValue (string)

$NewValue (string)

$ReturnCode (integer)

5071

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$SecurityDescriptor (string)

5120

task_0

-

INFO

5121

task_0

-

INFO

5122

task_0

-

INFO

$CAConfigurationId (string)

$NewValue (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5123

task_0

-

INFO

$PropertyName (string)

$NewValue (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5124

task_0

-

INFO

$NewSecuritySettings (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5125

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5125

task_0

-

INFO

$SerialNumber (string)

$CAName (string)

$Status (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5126

task_0

-

INFO

$CAConfigurationId (string)

$NewSigningCertificateHash (string)

5127

task_0

-

INFO

$CAConfigurationId (string)

$BaseCRLNumber (string)

$BaseCRLThisUpdate (string)

$BaseCRLHash (string)

$DeltaCRLNumber (string)

$DeltaCRLIndicator (string)

$DeltaCRLThisUpdate (string)

$DeltaCRLHash (string)

5136

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$ObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

$AttributeLDAPDisplayName (string)

$AttributeSyntaxOID (string)

$AttributeValue (string)

$OperationType (string)

5137

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$ObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

5138

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$OldObjectDN (string)

$NewObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

5139

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$OldObjectDN (string)

$NewObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

5140

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$IpAddress (string)

$IpPort (string)

$ShareName (string)

5140

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectType (string)

$IpAddress (string)

$IpPort (string)

$ShareName (string)

$ShareLocalPath (string)

$AccessMask (string)

$AccessList (string)

5141

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$ObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

$TreeDelete (string)

5142

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ShareName (string)

$ShareLocalPath (string)

5143

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectType (string)

$ShareName (string)

$ShareLocalPath (string)

$OldRemark (string)

$NewRemark (string)

$OldMaxUsers (string)

$NewMaxUsers (string)

$OldShareFlags (string)

$NewShareFlags (string)

$OldSD (string)

$NewSD (string)

5144

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ShareName (string)

$ShareLocalPath (string)

5145

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ObjectType (string)

$IpAddress (string)

$IpPort (string)

$ShareName (string)

$ShareLocalPath (string)

$RelativeTargetName (string)

$AccessMask (string)

$AccessList (string)

$AccessReason (string)

5146

task_0

-

INFO

$Direction (string)

$SourceAddress (string)

$DestAddress (string)

$EtherType (string)

$VlanTag (string)

$vSwitchID (string)

$SourcevSwitchPort (integer)

$DestinationvSwitchPort (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5147

task_0

-

INFO

$Direction (string)

$SourceAddress (string)

$DestAddress (string)

$EtherType (string)

$VlanTag (string)

$vSwitchID (string)

$SourcevSwitchPort (integer)

$DestinationvSwitchPort (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5148

task_0

-

INFO

$Type (string)

5149

task_0

-

INFO

$Type (string)

$PacketsDiscarded (integer)

5150

task_0

-

INFO

$Direction (string)

$SourceAddress (string)

$DestAddress (string)

$EtherType (string)

$MediaType (integer)

$InterfaceType (integer)

$VlanTag (string)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5151

task_0

-

INFO

$Direction (string)

$SourceAddress (string)

$DestAddress (string)

$EtherType (string)

$MediaType (integer)

$InterfaceType (integer)

$VlanTag (string)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5152

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5153

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5154

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$SourceAddress (string)

$SourcePort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5155

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$SourceAddress (string)

$SourcePort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5156

task_0

-

INFO

$ProcessID (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5156

task_0

-

INFO

$ProcessID (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

$RemoteUserID (string)

$RemoteMachineID (string)

5157

task_0

-

INFO

$ProcessID (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5157

task_0

-

INFO

$ProcessID (integer)

$Application (string)

$Direction (string)

$SourceAddress (string)

$SourcePort (string)

$DestAddress (string)

$DestPort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

$RemoteUserID (string)

$RemoteMachineID (string)

5158

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$SourceAddress (string)

$SourcePort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5159

task_0

-

INFO

$ProcessId (integer)

$Application (string)

$SourceAddress (string)

$SourcePort (string)

$Protocol (integer)

$FilterRTID (integer)

$LayerName (string)

$LayerRTID (integer)

5168

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$SpnName (string)

$ErrorCode (string)

$ServerNames (string)

$ConfiguredNames (string)

$IpAddresses (string)

5169

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$ObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

$AttributeLDAPDisplayName (string)

$AttributeSyntaxOID (string)

$AttributeValue (string)

$ExpirationTime (string)

$OperationType (string)

5170

task_0

-

INFO

$OpCorrelationID (string)

$AppCorrelationID (string)

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DSName (string)

$DSType (string)

$ObjectDN (string)

$ObjectGUID (string)

$ObjectClass (string)

$AttributeLDAPDisplayName (string)

$AttributeSyntaxOID (string)

$AttributeValue (string)

$ExpirationTime (string)

$OperationType (string)

5376

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5376

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$BackupFileName (string)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5377

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

5377

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$BackupFileName (string)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5378

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Package (string)

$UserUPN (string)

$TargetServer (string)

$CredType (string)

5379

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TargetName (string)

$Type (integer)

$CountOfCredentialsReturned (integer)

$ReadOperation (string)

$ReturnCode (integer)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5380

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$SearchString (string)

$SchemaFriendlyName (string)

$Schema (string)

$CountOfCredentialsReturned (integer)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5381

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$Flags (integer)

$CountOfCredentialsReturned (integer)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5382

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$SchemaFriendlyName (string)

$Schema (string)

$Resource (string)

$Identity (string)

$PackageSid (string)

$Flags (integer)

$ReturnCode (integer)

$ProcessCreationTime (string)

$ClientProcessId (integer)

5440

task_0

-

INFO

$ProviderKey (string)

$ProviderName (string)

$CalloutKey (string)

$CalloutName (string)

$CalloutType (string)

$CalloutId (integer)

$LayerKey (string)

$LayerName (string)

$LayerId (integer)

5441

task_0

-

INFO

$ProviderKey (string)

$ProviderName (string)

$FilterKey (string)

$FilterName (string)

$FilterType (string)

$FilterId (integer)

$LayerKey (string)

$LayerName (string)

$LayerId (integer)

$Weight (integer)

$Conditions (string)

$Action (string)

$CalloutKey (string)

$CalloutName (string)

5442

task_0

-

INFO

$ProviderKey (string)

$ProviderName (string)

$ProviderType (string)

5443

task_0

-

INFO

$ProviderKey (string)

$ProviderName (string)

$ProviderContextKey (string)

$ProviderContextName (string)

$ProviderContextType (string)

5444

task_0

-

INFO

$ProviderKey (string)

$ProviderName (string)

$SubLayerKey (string)

$SubLayerName (string)

$SubLayerType (string)

$Weight (integer)

5446

task_0

-

INFO

$ProcessId (integer)

$UserSid (string)

$UserName (string)

$ProviderKey (string)

$ProviderName (string)

$ChangeType (string)

$CalloutKey (string)

$CalloutName (string)

$CalloutType (string)

$CalloutId (integer)

$LayerKey (string)

$LayerName (string)

$LayerId (integer)

5447

task_0

-

INFO

$ProcessId (integer)

$UserSid (string)

$UserName (string)

$ProviderKey (string)

$ProviderName (string)

$ChangeType (string)

$FilterKey (string)

$FilterName (string)

$FilterType (string)

$FilterId (integer)

$LayerKey (string)

$LayerName (string)

$LayerId (integer)

$Weight (integer)

$Conditions (string)

$Action (string)

$CalloutKey (string)

$CalloutName (string)

5448

task_0

-

INFO

$ProcessId (integer)

$UserSid (string)

$UserName (string)

$ChangeType (string)

$ProviderKey (string)

$ProviderName (string)

$ProviderType (string)

5449

task_0

-

INFO

$ProcessId (integer)

$UserSid (string)

$UserName (string)

$ProviderKey (string)

$ProviderName (string)

$ChangeType (string)

$ProviderContextKey (string)

$ProviderContextName (string)

$ProviderContextType (string)

5450

task_0

-

INFO

$ProcessId (integer)

$UserSid (string)

$UserName (string)

$ProviderKey (string)

$ProviderName (string)

$ChangeType (string)

$SubLayerKey (string)

$SubLayerName (string)

$SubLayerType (string)

$Weight (integer)

5451

task_0

-

INFO

$LocalAddress (string)

$LocalAddressMask (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemoteAddressMask (string)

$RemotePort (integer)

$PeerPrivateAddress (string)

$RemoteTunnelEndpoint (string)

$IpProtocol (integer)

$KeyingModuleName (string)

$AhAuthType (string)

$EspAuthType (string)

$CipherType (string)

$LifetimeSeconds (integer)

$LifetimeKilobytes (integer)

$LifetimePackets (integer)

$Mode (string)

$Role (string)

$TransportFilterId (integer)

$MainModeSaId (integer)

$QuickModeSaId (integer)

$InboundSpi (integer)

$OutboundSpi (integer)

5451

task_0

-

INFO

$LocalAddress (string)

$LocalAddressMask (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemoteAddressMask (string)

$RemotePort (integer)

$PeerPrivateAddress (string)

$RemoteTunnelEndpoint (string)

$IpProtocol (integer)

$KeyingModuleName (string)

$AhAuthType (string)

$EspAuthType (string)

$CipherType (string)

$LifetimeSeconds (integer)

$LifetimeKilobytes (integer)

$LifetimePackets (integer)

$Mode (string)

$Role (string)

$TransportFilterId (integer)

$MainModeSaId (integer)

$QuickModeSaId (integer)

$InboundSpi (integer)

$OutboundSpi (integer)

$TunnelId (integer)

$TrafficSelectorId (integer)

5452

task_0

-

INFO

$LocalAddress (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemotePort (integer)

$RemoteTunnelEndpoint (string)

$IpProtocol (integer)

$QuickModeSaId (integer)

5452

task_0

-

INFO

$LocalAddress (string)

$LocalAddressMask (string)

$LocalPort (integer)

$LocalTunnelEndpoint (string)

$RemoteAddress (string)

$RemoteAddressMask (string)

$RemotePort (integer)

$RemoteTunnelEndpoint (string)

$IpProtocol (integer)

$QuickModeSaId (integer)

$TunnelId (integer)

$TrafficSelectorId (integer)

5453

task_0

-

INFO

5456

task_0

-

INFO

$Policy (string)

5457

task_0

-

INFO

$Policy (string)

$Error (string)

5458

task_0

-

INFO

$Policy (string)

5459

task_0

-

INFO

$Policy (string)

$Error (string)

5460

task_0

-

INFO

$Policy (string)

5461

task_0

-

INFO

$Policy (string)

$Error (string)

5462

task_0

-

INFO

$Policy (string)

$Error (string)

5463

task_0

-

INFO

5464

task_0

-

INFO

5465

task_0

-

INFO

5466

task_0

-

INFO

5467

task_0

-

INFO

5468

task_0

-

INFO

5471

task_0

-

INFO

$Policy (string)

5472

task_0

-

INFO

$Policy (string)

$Error (string)

5473

task_0

-

INFO

$Policy (string)

5474

task_0

-

INFO

$Policy (string)

$Error (string)

5477

task_0

-

INFO

$QuickModeFilter (string)

$Error (string)

5478

task_0

-

INFO

5479

task_0

-

INFO

5480

task_0

-

INFO

5483

task_0

-

INFO

$Error (string)

5484

task_0

-

INFO

$Error (string)

5485

task_0

-

INFO

5632

task_0

-

INFO

$SSID (string)

$Identity (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PeerMac (string)

$LocalMac (string)

$IntfGuid (string)

$ReasonCode (string)

$ReasonText (string)

$ErrorCode (string)

5632

task_0

-

INFO

$SSID (string)

$Identity (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$PeerMac (string)

$LocalMac (string)

$IntfGuid (string)

$ReasonCode (string)

$ReasonText (string)

$ErrorCode (string)

$EAPReasonCode (string)

$EapRootCauseString (string)

$EAPErrorCode (string)

5633

task_0

-

INFO

$InterfaceName (string)

$Identity (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ReasonCode (string)

$ReasonText (string)

$ErrorCode (string)

5712

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (integer)

$ProcessId (integer)

$ProcessName (string)

$RemoteIpAddress (string)

$RemotePort (string)

$InterfaceUuid (string)

$ProtocolSequence (string)

$AuthenticationService (integer)

$AuthenticationLevel (integer)

5888

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectUserDomainName (string)

$SubjectLogonId (integer)

$ObjectCollectionName (string)

$ObjectIdentifyingProperties (string)

$ModifiedObjectProperties (string)

5889

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectUserDomainName (string)

$SubjectLogonId (integer)

$ObjectCollectionName (string)

$ObjectIdentifyingProperties (string)

$ObjectProperties (string)

5890

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectUserDomainName (string)

$SubjectLogonId (integer)

$ObjectCollectionName (string)

$ObjectIdentifyingProperties (string)

$ObjectProperties (string)

6144

task_0

-

INFO

$ErrorCode (integer)

$GPOList (string)

6145

task_0

-

INFO

$ErrorCode (integer)

$GPOList (string)

6272

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$QuarantineState (string)

$QuarantineSessionIdentifier (string)

6272

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$QuarantineState (string)

$QuarantineSessionIdentifier (string)

$LoggingResult (string)

6272

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$LoggingResult (string)

6273

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

6273

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

$LoggingResult (string)

6273

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

$LoggingResult (string)

6274

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

6274

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

6275

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

6275

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$ReasonCode (string)

$Reason (string)

6276

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$QuarantineState (string)

$ExtendedQuarantineState (string)

$QuarantineSessionID (string)

$QuarantineHelpURL (string)

$QuarantineSystemHealthResult (string)

6277

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$QuarantineState (string)

$ExtendedQuarantineState (string)

$QuarantineSessionID (string)

$QuarantineHelpURL (string)

$QuarantineSystemHealthResult (string)

$QuarantineGraceTime (string)

6278

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

$SubjectMachineSID (string)

$SubjectMachineName (string)

$FullyQualifiedSubjectMachineName (string)

$MachineInventory (string)

$CalledStationID (string)

$CallingStationID (string)

$NASIPv4Address (string)

$NASIPv6Address (string)

$NASIdentifier (string)

$NASPortType (string)

$NASPort (string)

$ClientName (string)

$ClientIPAddress (string)

$ProxyPolicyName (string)

$NetworkPolicyName (string)

$AuthenticationProvider (string)

$AuthenticationServer (string)

$AuthenticationType (string)

$EAPType (string)

$AccountSessionIdentifier (string)

$QuarantineState (string)

$ExtendedQuarantineState (string)

$QuarantineSessionID (string)

$QuarantineHelpURL (string)

$QuarantineSystemHealthResult (string)

6279

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

6280

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$FullyQualifiedSubjectUserName (string)

6281

task_0

-

INFO

$param1 (string)

6400

task_0

-

INFO

$ClientIPAddress (string)

6401

task_0

-

INFO

$ClientIPAddress (string)

6402

task_0

-

INFO

$ClientIPAddress (string)

6403

task_0

-

INFO

$HostedCacheName (string)

6404

task_0

-

INFO

$HostedCacheName (string)

$ErrorCode (integer)

6405

task_0

-

INFO

$EventId (integer)

$Count (integer)

6406

task_0

-

INFO

$ProductName (string)

$Categories (string)

6407

task_0

-

INFO

$Message (string)

6408

task_0

-

INFO

$ProductName (string)

$Categories (string)

6409

task_0

-

INFO

$GUID (string)

6410

task_0

-

INFO

$param1 (string)

6416

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$ClassId (string)

$VendorIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6416

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$VendorIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6417

task_0

-

INFO

$ProcessId (string)

$ProcessName (string)

6418

task_0

-

INFO

$ProcessId (string)

$ProcessName (string)

$FatalCode (integer)

6419

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6420

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6421

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6422

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6423

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6424

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$DeviceId (string)

$DeviceDescription (string)

$ClassId (string)

$ClassName (string)

$HardwareIds (string)

$CompatibleIds (string)

$LocationInformation (string)

6425

task_0

-

INFO

$SubjectUserSid (string)

$SubjectUserName (string)

$SubjectDomainName (string)

$SubjectLogonId (string)

$TrustedDomainName (string)

$TrustedDomainId (string)

$ClientNetworkAddress (string)

$LegacyRPCMethodName (string)

8191

task_0

-

INFO

Microsoft-Windows-Security-EnterpriseData-FileRevocationManager

0

task_0

ProtectIdentityoperation.

INFO

$EntIDString (string)

$AppIDString (string)

1

task_0

ProtectIdentityoperation.

INFO

$EntIDString (string)

$AppIDString (string)

$ErrorCode (string)

17

task_0

RevokeIdentityoperation.

INFO

$EntIDString (string)

$AppIDString (string)

18

task_0

RevokeIdentityoperation.

INFO

$EntIDString (string)

$AppIDString (string)

19

task_0

RevokeIdentityoperation.

INFO

$EntIDString (string)

$AppIDString (string)

$ErrorCode (string)

20

task_0

Delegationoperation.

INFO

$PolicyString (string)

Microsoft-Windows-Security-ExchangeActiveSyncProvisioning

1

EAS_REGPROV

-

CRITICAL

$DllPath (string)

2

EAS_REGPROV

-

CRITICAL

$DllPath (string)

100

ExchangeActiveSyncProvisioningPerformance

win:Start

INFO

101

ExchangeActiveSyncProvisioningPerformance

win:Stop

INFO

$TimeSpent (integer)

Microsoft-Windows-Security-IdentityListener

0

task_0

-

INFO

$Number (integer)

1

task_0

-

ERROR

$LastError (integer)

2

task_0

-

INFO

$Sid (string)

3

task_0

-

ERROR

$Sid (string)

4

task_0

-

INFO

$Sid (string)

5

task_0

-

ERROR

$Sid (string)

6

task_0

-

INFO

$psz (string)

7

task_0

-

ERROR

$LastError (integer)

8

task_0

-

INFO

$psz (string)

9

task_0

-

ERROR

$RemoteMachineName (string)

$Errorcode (integer)

10

task_0

-

INFO

$ProviderGUID (string)

$IdentityUID (string)

$IdentityDisplayName (string)

11

task_0

-

ERROR

$LastError (integer)

12

task_0

-

INFO

13

task_0

-

ERROR

$LastError (integer)

14

task_0

-

ERROR

$psz (string)

15

task_0

-

ERROR

$RemoteMachineName (string)

$Errorcode (integer)

Microsoft-Windows-Security-IdentityStore

1

CreateConnectedUser

win:Start

INFO

2

CreateConnectedUser

win:Start

INFO

3

CreateConnectedUser

win:Stop

INFO

4

ConnectDisconnectUser

win:Start

INFO

5

ConnectDisconnectUser

win:Stop

INFO

6

ConnectDisconnectUser

win:Start

INFO

7

ConnectDisconnectUser

win:Stop

INFO

8

ConnectDisconnectUser

win:Start

INFO

9

ConnectDisconnectUser

win:Stop

INFO

10

ConnectDisconnectUser

win:Start

INFO

11

ConnectDisconnectUser

win:Stop

INFO

12

IdentityQuery

win:Start

INFO

13

IdentityQuery

win:Stop

INFO

14

IdentityQuery

win:Start

INFO

15

IdentityQuery

win:Stop

INFO

16

IdentityQuery

win:Start

INFO

17

IdentityQuery

win:Stop

INFO

18

IdentityQuery

win:Start

INFO

19

IdentityQuery

win:Stop

INFO

20

IdentityQuery

win:Start

INFO

21

IdentityQuery

win:Stop

INFO

22

CreateConnectedUser

win:Start

INFO

23

CreateConnectedUser

win:Stop

INFO

24

CreateConnectedUser

win:Start

INFO

25

CreateConnectedUser

win:Stop

INFO

26

ConnectDisconnectUser

win:Start

INFO

27

ConnectDisconnectUser

win:Stop

INFO

Microsoft-Windows-Security-Kerberos

3

task_0

opcode_128

-

$LogonSession (string)

$ClientTime (string)

$ServerTime (string)

$ErrorCode (string)

$ErrorMessage (string)

$ExtendedError (string)

$ClientRealm (string)

$ClientName (string)

$ServerRealm (string)

$ServerName (string)

$TargetName (string)

$ErrorText (string)

$File (string)

$Line (string)

$__binLength (integer)

$binary (string)

4

task_0

opcode_64

-

$Server (string)

$TargetRealm (string)

$Targetname (string)

$ClientRealm (string)

$__binLength (integer)

$binary (string)

5

task_0

opcode_64

-

$Server (string)

$KDCRealm (string)

$__binLength (integer)

$binary (string)

5

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

6

task_0

opcode_128

-

$NeededSize (string)

$ActualSize (string)

$ClientProcessID (string)

$ClientName (string)

$__binLength (integer)

$binary (string)

6

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

7

task_0

opcode_192

-

$ClientName (string)

$Realm (string)

$__binLength (integer)

$binary (string)

7

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

8

task_0

opcode_192

-

$Name (string)

$Message (string)

$__binLength (integer)

$binary (string)

8

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

9

task_0

opcode_192

-

$Name (string)

$Message (string)

$__binLength (integer)

$binary (string)

9

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

10

task_0

opcode_128

-

10

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

11

task_0

opcode_192

-

11

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

12

task_0

opcode_128

-

12

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

13

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

13

task_0

opcode_128

-

$Username (string)

$__binLength (integer)

$binary (string)

14

task_0

opcode_128

-

$Username (string)

$__binLength (integer)

$binary (string)

14

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

15

task_0

opcode_128

-

$NeededSize (string)

$ActualSize (string)

$ClientProcessID (string)

$RequiredSize (string)

$__binLength (integer)

$binary (string)

15

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

16

task_0

opcode_192

-

$Username (string)

$__binLength (integer)

$binary (string)

16

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

17

task_0

opcode_192

-

$Forest (string)

$__binLength (integer)

$binary (string)

17

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

18

task_0

opcode_128

-

$Luid (string)

$ClientPrincipalName (string)

$ServicePrincipalName (string)

$TicketFlags (string)

$StartTime (string)

$EndTime (string)

$RenewUntil (string)

$ErrorCode (string)

18

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

19

task_0

opcode_128

-

$ErrorCode (string)

19

task_0

-

-

$Error (string)

$__binLength (integer)

$binary (string)

20

task_0

opcode_128

-

$DomainName (string)

$ErrorCode (string)

100

task_0

-

ERROR

$SPN (string)

$ErrorCode (integer)

101

task_0

-

ERROR

$SPN (string)

$ErrorCode (integer)

102

task_0

-

ERROR

$DomainController (string)

$ErrorCode (integer)

103

task_0

-

ERROR

$ClientUpn (string)

$ErrorCode (integer)

104

task_0

-

ERROR

$TargetDomain (string)

$ErrorCode (integer)

105

task_0

-

ERROR

$LuidHighPart (integer)

$LuidLowPart (integer)

$DomainName (string)

$UserName (string)

$Refresh (boolean)

$CurrentFileTime (string)

$ErrorCode (integer)

106

task_0

-

ERROR

$ErrorCode (integer)

107

task_0

-

ERROR

$ExpectedDomainName (string)

$ErrorCode (integer)

108

task_0

-

ERROR

$ServerName (string)

$ServerPort (integer)

$ServerVdir (string)

$ErrorCode (integer)

$Status (integer)

109

task_0

-

ERROR

$Proxy (string)

$ProxyBypass (string)

$ProxyEpoch (integer)

$SupportedSchemes (integer)

$FirstScheme (integer)

$DigestCredInitialized (boolean)

$DigestCredDomainAndUserName (string)

$DigestCredEpoch (integer)

$BasicCredInitialized (boolean)

$BasicCredDomainAndUserName (string)

$BasicCredEpoch (integer)

200

task_0

-

WARNING

$TargetDomain (string)

$ErrorCode (integer)

201

task_0

-

WARNING

$TargetName (string)

$UserName (string)

$DomainName (string)

$CallerPID (integer)

$ProcessName (string)

$ClientLUID (string)

$ClientUserName (string)

$ClientDomainName (string)

$MechanismOID (string)

202

task_0

-

WARNING

$TargetName (string)

$UserName (string)

$DomainName (string)

$CallerPID (integer)

$ProcessName (string)

$ClientLUID (string)

$ClientUserName (string)

$ClientDomainName (string)

$MechanismOID (string)

203

task_0

-

WARNING

300

task_0

-

INFO

$DomainController (string)

$TargetDomain (string)

301

task_0

-

INFO

$Target (string)

302

task_0

-

INFO

$DomainController (string)

$TargetDomain (string)

$DesiredFlags (integer)

$CacheFlags (integer)

$ErrorCode (integer)

303

task_0

-

INFO

$LuidHighPart (integer)

$LuidLowPart (integer)

$DomainName (string)

$UserName (string)

$UpdateCurrent (boolean)

$UpdateOld (boolean)

$Refresh (boolean)

$LastFileTime (string)

$CurrentFileTime (string)

Microsoft-Windows-Security-Netlogon

4004

BlockingNTLM

-

WARNING

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

4005

BlockingNTLM

-

WARNING

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

4006

BlockingNTLM

-

WARNING

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

8004

AuditingNTLM

-

INFO

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

8005

AuditingNTLM

-

INFO

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

8006

AuditingNTLM

-

INFO

$SChannelName (string)

$UserName (string)

$DomainName (string)

$WorkstationName (string)

$SChannelType (integer)

9000

MSA

-

ERROR

$AccountName (string)

$AccountDomain (string)

$Status (integer)

9001

MSA

-

ERROR

$Account (string)

9002

MSA

-

ERROR

$Account (string)

$Status (integer)

9003

MSA

-

ERROR

$Account (string)

$Status (integer)

9004

LOCATOR

-

WARNING

$RequestsRejected (integer)

Microsoft-Windows-Security-Vault

100

VaultPerformance

win:Start

INFO

101

VaultPerformance

win:Stop

INFO

102

VaultPerformance

win:Start

INFO

103

VaultPerformance

win:Stop

INFO

104

VaultPerformance

win:Start

INFO

105

VaultPerformance

win:Stop

INFO

106

VaultPerformance

win:Start

INFO

107

VaultPerformance

win:Stop

INFO

108

VaultPerformance

win:Start

INFO

109

VaultPerformance

win:Stop

INFO

110

VaultPerformance

win:Start

INFO

111

VaultPerformance

win:Stop

INFO

Microsoft-Windows-SmbWmiProvider

0

task_0

-

ERROR

$FunctionName (string)

$MiError (integer)

$Win32Error (integer)

1

task_0

-

ERROR

$Message (string)

Microsoft-Windows-Time-Service

1

task_0

-

ERROR

$TimeProvider (string)

$ErrorMessage (string)

2

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

3

task_0

-

INFO

$TimeProvider (string)

$ErrorMessage (string)

4

task_0

-

ERROR

$TimeProvider (string)

$ErrorMessage (string)

5

task_0

-

ERROR

$TimeProvider (string)

$ErrorMessage (string)

6

task_0

-

WARNING

$ErrorMessage (string)

7

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

8

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

9

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

10

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

11

task_0

-

WARNING

12

task_0

-

WARNING

13

task_0

-

WARNING

14

task_0

-

WARNING

$RetryMinutes (string)

15

task_0

-

WARNING

$ErrorMessage (string)

16

task_0

-

WARNING

$ManualPeer (string)

$ErrorMessage (string)

17

task_0

-

WARNING

$ManualPeer (string)

$ErrorMessage (string)

$RetryMinutes (string)

18

task_0

-

WARNING

$Domain (string)

$ErrorMessage (string)

$RetryMinutes (string)

19

task_0

-

ERROR

$LogFile (string)

$ErrorMessage (string)

20

task_0

-

ERROR

$LogFile (string)

$ErrorMessage (string)

21

task_0

-

ERROR

22

task_0

-

WARNING

$Peer (string)

$ErrorMessage (string)

23

task_0

-

WARNING

$Peer (string)

$ErrorMessage (string)

24

task_0

-

WARNING

$DomainPeer (string)

$ErrorMessage (string)

25

task_0

-

WARNING

$DomainPeer (string)

$ErrorMessage (string)

26

task_0

-

WARNING

$DomainPeer (string)

27

task_0

-

WARNING

$DomainPeer (string)

28

task_0

-

WARNING

29

task_0

-

WARNING

$RetryMinutes (string)

30

task_0

-

WARNING

$ErrorMessage (string)

31

task_0

-

WARNING

32

task_0

-

WARNING

$ErrorMessage (string)

33

task_0

-

WARNING

$SystemTimeChangeSeconds (string)

34

task_0

-

ERROR

$SystemTimeChangeSeconds (integer)

$MaxSystemTimeChangeSeconds (integer)

$TimeSource (string)

35

task_0

-

INFO

$TimeSource (string)

$TimeSourceRefId (integer)

$CurrentStratumNumber (integer)

36

task_0

-

WARNING

$UnsynchronizedTimeSeconds (integer)

$TimeRemainingToSetLocalClockFreeRunningSeconds (integer)

37

task_0

-

INFO

$TimeSource (string)

38

task_0

-

WARNING

$TimeSource (string)

39

task_0

-

WARNING

40

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

41

task_0

-

WARNING

42

task_0

-

ERROR

43

task_0

-

WARNING

$TimeProvider (string)

$ErrorMessage (string)

44

task_0

-

ERROR

$ErrorMessage (string)

45

task_0

-

ERROR

$ErrorMessage (string)

46

task_0

-

ERROR

$ErrorMessage (string)

47

task_0

-

WARNING

$ManualPeer (string)

$ErrorMessage (string)

48

task_0

-

WARNING

$ManualPeer (string)

$ErrorMessage (string)

$RetryMinutes (integer)

49

task_0

-

WARNING

$ErrorMessage (string)

50

task_0

-

WARNING

$TimeDifferenceMilliseconds (integer)

$TimeSampleSeconds (integer)

51

task_0

-

WARNING

$Peer (string)

$TimeDifferenceSeconds (string)

$TransmissionDelayMilliseconds (integer)

52

task_0

-

WARNING

$TimeOffsetSeconds (integer)

53

task_0

-

WARNING

$Peer (string)

54

task_0

-

ERROR

$ErrorMessage (string)

129

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

130

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

$DomainPeer (string)

131

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

$DomainPeer (string)

132

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

$DomainPeer (string)

$TimeSource (string)

133

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

134

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

$DomainPeer (string)

135

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

$DomainPeer (string)

$TimeSource (string)

136

task_0

-

WARNING

$ErrorMessage (string)

$RetryMinutes (integer)

137

task_0

-

INFO

$ManualPeer (string)

138

task_0

-

INFO

$DomainPeer (string)

139

task_0

-

INFO

140

task_0

-

WARNING

141

task_0

-

WARNING

142

task_0

-

WARNING

143

task_0

-

INFO

144

task_0

-

WARNING

145

task_0

-

WARNING

146

task_0

-

INFO

$ChainingCountRequests (integer)

$ChainLoggingRate (integer)

$ChainingCountSuccess (integer)

$ChainingCountFailure (integer)

147

task_0

-

-

148

task_0

-

-

149

task_0

-

-

150

task_0

-

-

151

task_0

-

-

152

task_0

-

-

153

task_0

-

-

154

task_0

-

-

156

task_0

-

WARNING

$ClientRID (integer)

$DomainPeer (string)

157

task_0

-

WARNING

$ClientAddress (string)

158

task_0

-

INFO

$TimeProvider (string)

159

task_0

-

WARNING

$ErrorMessage (string)

257

task_0

-

INFO

$CurrentTimeUTC (string)

$TickCount (integer)

$Configuration (string)

$TimeProviders (string)

$ClockRate (integer)

258

task_0

-

INFO

$CurrentTimeUTC (string)

$TickCount (integer)

$ErrorMessage (string)

259

task_0

-

INFO

$AllNtpServers (string)

$ChosenReferenceNtpServer (string)

$TickCount (integer)

$IFTSTMP (integer)

260

task_0

-

INFO

$Configuration (string)

$TimeProviders (string)

$LeapIndicator (integer)

$Stratum (integer)

$Precision (string)

$RootDelay (string)

$RootDispersion (string)

$ReferenceId (string)

$LastSuccessfulSyncTime (string)

$Source (string)

$PollInterval (integer)

$PhaseOffset (string)

$ClockRate (integer)

$StateMachine (integer)

$TimeSourceFlags (integer)

$ServerRole (integer)

$LastSyncError (integer)

$TimeSinceLastGoodSync (string)

$TickCount (integer)

261

task_0

-

INFO

$NewTime (string)

$OldTime (string)

$TickCount (integer)

262

task_0

-

INFO

$AdjustmentPPM (string)

$NewClockRate (integer)

$OldClockRate (integer)

$TickCount (integer)

$MinReportedAdjustmentPPM (string)

263

task_0

-

INFO

$Configuration (string)

$TimeProviders (string)

$TickCount (integer)

264

task_0

-

INFO

$AllNtpServers (string)

$TickCount (integer)

265

task_0

-

INFO

$TimeSource (string)

$TimeSourceRefId (string)

$LocalStratumNumber (integer)

$TickCount (integer)

266

task_0

-

INFO

$ReasonCode (integer)

$TickCount (integer)

272

task_0

-

INFO

$Enabled (integer)

$LeapSecondCount (integer)

$CurrentUtcOffset (integer)

$RuntimeStateAndSettingsConsistent (integer)

$NewestLeapSecondsList (string)

$TickCount (integer)

273

task_0

-

INFO

$Action (string)

$UtcTime (string)

$LocalTime (string)

$TimeProvider (string)

$TickCount (integer)

274

task_0

-

WARNING

$Action (string)

$UtcTime (string)

$LocalTime (string)

$TimeProvider (string)

$TickCount (integer)

275

task_0

-

WARNING

$UtcLeapSecondString (string)

$ErrorMessage (string)

$TickCount (integer)

276

task_0

-

WARNING

$Action (string)

$UtcTime (string)

$LocalTime (string)

$TimeProvider (string)

$TickCount (integer)

279

task_0

-

WARNING

$TickCount (integer)

280

task_0

-

WARNING

$RpcEndPointError (integer)

Microsoft-Windows-TPM-WMI

513

task_0

-

INFO

514

task_0

-

WARNING

$ErrorCode (string)

515

task_0

-

WARNING

516

task_0

-

INFO

517

task_0

-

WARNING

$HResult (integer)

518

task_0

-

INFO

$HResult (integer)

769

task_0

-

INFO

$OldOSManagedAuthLevel (integer)

$NewOSManagedAuthLevel (integer)

1025

task_0

-

INFO

1026

task_0

-

INFO

$ErrorCode (integer)

$StatusInformation (string)

1027

task_0

-

INFO

1028

task_0

-

INFO

1029

task_0

-

INFO

$ErrorCode (string)

1030

task_0

-

INFO

1031

task_0

-

INFO

$ErrorCode (string)

1032

task_0

-

ERROR

1281

task_0

-

INFO

1282

task_0

-

INFO

1537

task_0

-

INFO

$HealthAttestationServer (string)

1538

task_0

-

WARNING

$HealthAttestationServer (string)

$HResult (integer)

1539

task_0

-

WARNING

$HealthAttestationServer (string)

$HTTPStatus (integer)

$ServerResponse (string)

1793

task_0

-

INFO

1794

task_0

-

ERROR

Microsoft-Windows-UserModePowerService

1

RundownPlatformRole

-

INFO

$PlatformRole (integer)

2

RundownPowerScheme

-

INFO

$SchemeGuid (string)

3

RundownAcPowerSetting

-

INFO

$SubgroupGuid (string)

$SettingGuid (string)

$ValueIndex (integer)

$Type (integer)

$DataSize (integer)

$Data (string)

4

RundownDcPowerSetting

-

INFO

$SubgroupGuid (string)

$SettingGuid (string)

$ValueIndex (integer)

$Type (integer)

$DataSize (integer)

$Data (string)

5

AdaptiveDimTimeout

-

INFO

$Timeout (integer)

7

task_0

-

INFO

$Name (string)

8

RundownBatteryInformation

-

INFO

$DeviceName (string)

$ManufacturerName (string)

$ManufactureDay (integer)

$ManufactureMonth (integer)

$ManufactureYear (integer)

$SerialNumber (string)

$Capabilities (integer)

$Technology (integer)

$Pad (string)

$Chemistry (string)

$DesignCapacity (integer)

$FullChargeCapacity (integer)

$DefaultAlert1 (integer)

$DefaultAlert2 (integer)

$CriticalBias (integer)

$CycleCount (integer)

$GranularityScaleCount (integer)

$GranularityScale (string)

$UniqueId (string)

9

RundownBatteryStatus

-

INFO

$State (integer)

$Capacity (integer)

$Voltage (integer)

$Rate (integer)

$EstimatedRuntime (integer)

$UniqueId (string)

10

RundownBrightnessCapability

-

INFO

$BrightnessCapable (boolean)

11

RundownPowerSource

-

INFO

$AcOnline (boolean)

12

PowerSchemeChanged

-

INFO

$ProcessPath (string)

$ProcessPid (integer)

$OldSchemeGuid (string)

$NewSchemeGuid (string)

13

PowerMeterData

-

INFO

$MeterId (string)

$value (integer)

14

PowerMeterMetaData

-

INFO

$MeterId (string)

$SamplingPeriod (integer)

$MeterNameLength (integer)

$MeterName (string)

$MeteredHardwareCount (integer)

$MeteredHardwareName (string)

15

RundownOverrideConfiguration

-

INFO

$Flags (integer)

$ProcessorVendor (integer)

$ProcessorType (integer)

16

RundownOverridePowerSetting

-

INFO

$SchemeGuid (string)

$SubgroupGuid (string)

$SettingGuid (string)

$Flags (integer)

$DataType (integer)

$DataSize (integer)

$Data (string)

16

RundownOverridePowerSetting

-

INFO

$SchemeGuid (string)

$SubgroupGuid (string)

$SettingGuid (string)

$Flags (integer)

$DataType (integer)

$DataSize (integer)

$Data (string)

$ProfileGuid (string)

17

RundownPowerProfileSetting

-

INFO

$ProfileGuid (string)

$SubgroupGuid (string)

$SettingGuid (string)

$SchemePersonalityGuid (string)

$Flags (integer)

$ValueIndex (integer)

$Type (integer)

$DataSize (integer)

$Data (string)

18

EnergyMeterData

-

INFO

$MeterId (string)

$AbsoluteEnergy (integer)

$AbsoluteTime (integer)

19

EnergyMeterMetaData

-

INFO

$MeterId (string)

$SamplingPeriod (integer)

$ChannelNameLength (integer)

$ChannelName (string)

22

ProvEngineTurnApply

-

INFO

$Turn (integer)

23

RundownConsoleSession

-

INFO

$SessionId (integer)

24

ConsoleSessionChange

-

INFO

$Event (integer)

$SessionId (integer)

25

RundownSessionUser

-

INFO

$UserContextToken (integer)

$SessionId (integer)

$UserSid (string)

26

SessionUserChange

-

INFO

$Event (integer)

$UserContextToken (integer)

$SessionId (integer)

$UserSid (string)

27

RundownSmartUserPresenceState

-

INFO

$Supported (boolean)

$GlobalUserPresent (boolean)

$UserPredictionMode (integer)

$MinConfidence (integer)

$SuspendCount (integer)

$LastUserAwayEndSystemTime (integer)

28

RundownSmartUserPresenceIntevals

-

INFO

$UserSid (string)

$IntervalCount (integer)

$AwayIntervals (integer)

28

RundownSmartUserPresenceIntevals

-

INFO

$UserSid (string)

$IntervalCount (integer)

$AwayIntervals (integer)

$Flags (integer)

29

SmartUserPresenceIntervalsSet

-

INFO

$UserSid (string)

$IntervalCount (integer)

$AwayIntervals (integer)

29

SmartUserPresenceIntervalsSet

-

INFO

$UserSid (string)

$IntervalCount (integer)

$AwayIntervals (integer)

$Flags (integer)

30

SmartUserPresenceIntevalsClear

-

INFO

$UserSid (string)

31

SmartUserPresencePrediction

-

INFO

$UserAwayEndSystemTime (integer)

32

SmartUserPresenceSuspendResume

-

INFO

$Suspend (boolean)

$SuspendCount (integer)

$GlobalUserPresent (boolean)

$UserPredictionMode (integer)

33

SmartUserPresenceTimeUpdate

-

INFO

$SystemTimeShift (integer)

34

SleepStudySleepSession

win:Start

INFO

$Type (integer)

$Id (integer)

35

SleepStudySleepSession

win:Stop

INFO

$Type (integer)

$Id (integer)

$ErrorCode (integer)

36

SleepStudySleepSession

TooShort

INFO

$Type (integer)

$Id (integer)

37

SleepStudySleepSessionRelogging

win:Start

INFO

$Type (integer)

$Id (integer)

38

SleepStudySleepSessionRelogging

win:Stop

INFO

$Type (integer)

$Id (integer)

$ErrorCode (integer)

39

SleepStudySleepSessionRelogging

PassStart

INFO

$Type (integer)

$Id (integer)

40

SleepStudySleepSessionRelogging

PassStop

INFO

$Type (integer)

$Id (integer)

$ErrorCode (integer)

41

SleepStudySleepSessionRelogging

MissingStart

ERROR

$Type (integer)

$Id (integer)

42

SleepStudySleepSessionRelogging

MissingStop

ERROR

$Type (integer)

$Id (integer)

$ErrorCode (integer)

43

BrightnessAndTransitionTimes

-

INFO

$EffectiveBrightnessPercentage (integer)

$EffectiveBrightnessMillinits (integer)

$NewBrightnessTransitionTime (integer)

$DimmingTransitionTime (integer)

$DimmedBrightnessPercentage (integer)

$DimmedBrightnessMillinits (integer)

$NewDimmedTransitionTime (integer)

$UnDimmingTransitionTime (integer)

44

AdaptiveStandby

BatteryReserveAction

INFO

$TimeInStandby (integer)

$RemainingBatteryPercentage (integer)

$RemainingBatteryTime (integer)

$ReserveBatteryTime (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

44

AdaptiveStandby

BatteryReserveAction

INFO

$TimeInStandby (integer)

$GracePeriod (integer)

$RemainingBatteryPercentage (integer)

$RemainingBatteryTime (integer)

$ReserveBatteryTime (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

44

AdaptiveStandby

BatteryReserveAction

INFO

$TimeInStandby (integer)

$GracePeriod (integer)

$RemainingBatteryPercentage (integer)

$RemainingBatteryTime (integer)

$ReserveBatteryTime (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

$DataSources (integer)

45

AdaptiveStandby

StandbyBudgetAction

INFO

$TimeInStandby (integer)

$RemainingBatteryPercentage (integer)

$StandbyBatteryDrainPercentage (integer)

$BatteryDrainPercentageThreshold (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

45

AdaptiveStandby

StandbyBudgetAction

INFO

$TimeInStandby (integer)

$GracePeriod (integer)

$RemainingBatteryPercentage (integer)

$StandbyBatteryDrainPercentage (integer)

$BatteryDrainPercentageThreshold (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

45

AdaptiveStandby

StandbyBudgetAction

INFO

$TimeInStandby (integer)

$GracePeriod (integer)

$RemainingBatteryPercentage (integer)

$StandbyBatteryDrainPercentage (integer)

$BatteryDrainPercentageThreshold (integer)

$ExecuteAction (boolean)

$RejectReason (integer)

$DataSources (integer)

46

AdaptiveStandby

StandbyBudgetReset

INFO

$ActualTimeRange (integer)

$RemainingBatteryPercentage (integer)

47

AdaptiveStandby

SrumFailure

INFO

$Action (integer)

$Error (integer)

48

GpuAdapterCount

-

INFO

$Id (integer)

$GpuCount (integer)

49

RundownOverlaySchemePowerSetting

-

INFO

$OverlaySchemeGuid (string)

$SubgroupGuid (string)

$SettingGuid (string)

$Flags (integer)

$ValueIndex (integer)

$Type (integer)

$DataSize (integer)

$Data (string)

50

RundownActualOverlayPowerScheme

-

INFO

$SchemeGuid (string)

50

RundownActualOverlayPowerScheme

-

INFO

$SchemeGuid (string)

$AcOverlay (boolean)

51

OverlayPowerSchemeChanged

-

INFO

$ProcessPath (string)

$ProcessPid (integer)

$OldSchemeGuid (string)

$NewSchemeGuid (string)

52

RundownEffectiveOverlayPowerScheme

-

INFO

$SchemeGuid (string)

53

RundownOverlaySuspendReason

-

INFO

$Reason (integer)

54

OverlaySuspendResume

-

INFO

$Reason (integer)

$Suspend (boolean)

55

OverrideDllSettingsUpdate

-

INFO

56

OverrideDllPowerSetting

-

INFO

$SchemeGuid (string)

$SubgroupGuid (string)

$SettingGuid (string)

$Flags (integer)

$DataType (integer)

$DataSize (integer)

$Data (string)

$ProfileGuid (string)

57

AdaptiveStandby

win:Start

INFO

$Reason (integer)

58

AdaptiveStandby

win:Stop

INFO

$Reason (integer)

Microsoft-Windows-VerifyHardwareSecurity

3001

CheckGeneric

reportCheck

INFO

$CurrentCheckBit (integer)

3002

CheckSecureBootEnabled

securebootEnabledFailedCheck

ERROR

3003

CheckSecureBootEnabled

securebootEnabledFailedToCheck

WARNING

$hr (integer)

3004

CheckCertificates

certsFailedCheck

ERROR

$name (string)

$database (string)

$bytes (string)

3005

CheckCertificates

certsFailedToCheck

WARNING

$hr (integer)

3006

CheckSecureBootPolicy

securebootPolicyFailedCheck

ERROR

3007

CheckSecureBootPolicy

securebootPolicyFailedToCheck

WARNING

$hr (integer)

3008

CheckHostLockdownPolicy

HostLockdownCheck

INFO

$HostProvider (string)

$ModulePath (string)

$Method (string)

$InternalName (string)

3009

CheckHostLockdownPolicy

HostLockdownCheck

ERROR

$HostProvider (string)

$ModulePath (string)

$Method (string)

$InternalName (string)

$hr (integer)

3010

CheckHostLockdownPolicy

HostLockdownCheck

ERROR

$HostProvider (string)

$ModulePath (string)

$Method (string)

$InternalName (string)

3011

CheckHostLockdownPolicy

HostLockdownCheck

ERROR

$HostProvider (string)

$ModulePath (string)

$Method (string)

$hr (integer)

3012

CheckHostLockdownPolicy

HostLockdownCheck

INFO

$HostProvider (string)

$ModulePath (string)

$Method (string)

$InternalName (string)

3013

CheckHostLockdownPolicy

HostLockdownCheck

INFO

$HostProvider (string)

$ModulePath (string)

$Method (string)

$InternalName (string)

Microsoft-Windows-WindowsUpdateClient

16

AutomaticUpdates

CheckforUpdates

WARNING

17

AutomaticUpdates

Download

INFO

$updatelist (string)

18

AutomaticUpdates

Download

INFO

$schedinstalldate (string)

$schedinstalltime (string)

$updatelist (string)

19

WindowsUpdateAgent

Installation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

19

WindowsUpdateAgent

Installation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

20

WindowsUpdateAgent

Installation

ERROR

$errorCode (string)

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

20

WindowsUpdateAgent

Installation

ERROR

$errorCode (string)

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

21

AutomaticUpdates

Reboot

INFO

$updatelist (string)

22

AutomaticUpdates

Reboot

INFO

$restarttime (string)

$updatelist (string)

23

WindowsUpdateAgent

Uninstallation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

23

WindowsUpdateAgent

Uninstallation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

24

WindowsUpdateAgent

Uninstallation

ERROR

$errorCode (string)

$updatelist (string)

$updateGuid (string)

$updateRevisionNumber (integer)

24

WindowsUpdateAgent

Uninstallation

ERROR

$errorCode (string)

$updatelist (string)

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

25

WindowsUpdateAgent

CheckforUpdates

ERROR

$errorCode (string)

25

WindowsUpdateAgent

CheckforUpdates

ERROR

$errorCode (string)

$serviceGuid (string)

26

WindowsUpdateAgent

CheckforUpdates

INFO

$updateCount (integer)

26

WindowsUpdateAgent

CheckforUpdates

INFO

$updateCount (integer)

$serviceGuid (string)

27

WindowsUpdateAgent

StateChange

INFO

28

WindowsUpdateAgent

StateChange

INFO

29

WindowsUpdateAgent

StateChange_1_17

WARNING

30

WindowsUpdateAgent

StateChange_1_17

INFO

31

WindowsUpdateAgent

Download

ERROR

$errorCode (string)

$updateGuid (string)

$updateRevisionNumber (integer)

31

WindowsUpdateAgent

Download

ERROR

$updateTitle (string)

$errorCode (string)

$updateGuid (string)

$updateRevisionNumber (integer)

32

WindowsUpdateAgent

StateChange_1_17

INFO

$serverName (string)

33

WindowsUpdateAgent

StateChange_1_17

INFO

$serverName (string)

34

WindowsUpdateAgent

SelfUpdate

WARNING

$errorCode (string)

35

WindowsUpdateAgent

SelfUpdate

WARNING

$errorCode (string)

36

WindowsUpdateAgent

SelfUpdate

INFO

$version1 (string)

$version2 (string)

37

WindowsUpdateAgent

SelfUpdate

INFO

$version1 (string)

$version2 (string)

38

WindowsUpdateAgent

StateChange_1_17

INFO

39

WindowsUpdateAgent

StateChange_1_17

INFO

40

WindowsUpdateAgent

StateChange_1_17

INFO

$updateGuid (string)

$updateRevisionNumber (integer)

40

WindowsUpdateAgent

StateChange_1_17

INFO

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

41

WindowsUpdateAgent

Download

INFO

$updateGuid (string)

$updateRevisionNumber (integer)

41

WindowsUpdateAgent

Download

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

42

AutomaticUpdates

Other

INFO

$hc_stateid (integer)

$restartDate (string)

$restartTime (string)

43

WindowsUpdateAgent

Installation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

43

WindowsUpdateAgent

Installation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

44

WindowsUpdateAgent

Download

INFO

$updateGuid (string)

$updateRevisionNumber (integer)

44

WindowsUpdateAgent

Download

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

209

WindowsUpdateAgent

win:Start

INFO

$pdcActivationId (integer)

$description (string)

$accessType (integer)

$isInteractiveOrAPIDriven (boolean)

$stopIdleTimer (boolean)

$networkRefCount (integer)

$systemRefCount (integer)

210

WindowsUpdateAgent

-

INFO

$pdcActivationId (integer)

$description (string)

$accessType (integer)

$isInteractiveOrAPIDriven (boolean)

$stopIdleTimer (boolean)

$networkRefCount (integer)

$systemRefCount (integer)

211

WindowsUpdateAgent

win:Stop

INFO

$pdcActivationId (integer)

$description (string)

$accessType (integer)

$isInteractiveOrAPIDriven (boolean)

$stopIdleTimer (boolean)

$networkRefCount (integer)

$systemRefCount (integer)

212

WindowsUpdateAgent

Revert

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

$serviceGuid (string)

213

WindowsUpdateAgent

Revert

ERROR

$errorCode (string)

$updatelist (string)

$updateGuid (string)

$updateRevisionNumber (integer)

214

WindowsUpdateAgent

Revert

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

215

WindowsUpdateAgent

Uninstallation

INFO

$updateTitle (string)

$updateGuid (string)

$updateRevisionNumber (integer)

Microsoft-Windows-WMI-Activity

1

task_0

-

INFO

$GroupOperationId (integer)

$OperationId (integer)

$Operation (string)

$ClientMachine (string)

$User (string)

$ClientProcessId (integer)

$NamespaceName (string)

2

task_0

-

INFO

$GroupOperationId (integer)

$Operation (string)

$ProviderName (string)

$ProviderGuid (string)

$Path (string)

3

task_0

-

INFO

$OperationId (integer)

11

task_0

-

INFO

$CorrelationId (string)

$GroupOperationId (integer)

$OperationId (integer)

$Operation (string)

$ClientMachine (string)

$ClientMachineFQDN (string)

$User (string)

$ClientProcessId (integer)

$ClientProcessCreationTime (integer)

$NamespaceName (string)

$IsLocal (boolean)

12

task_0

-

INFO

$GroupOperationId (integer)

$Operation (string)

$HostId (integer)

$ProviderName (string)

$ProviderGuid (string)

$Path (string)

13

task_0

-

INFO

$OperationId (integer)

$ResultCode (string)

14

task_0

-

INFO

$OperationId (integer)

$Operation (string)

$Channel (integer)

$Message (string)

15

task_0

-

INFO

$OperationId (integer)

$Operation (string)

$ErrorId (string)

$ErrorCategory (integer)

$Message (string)

$TargetName (string)

16

task_0

-

INFO

$OperationId (integer)

$Operation (string)

$ErrorId (string)

$Message (string)

17

task_0

-

INFO

$CorrelationId (string)

$ProcessId (integer)

$Protocol (string)

$Operation (string)

$User (string)

$Namespace (string)

18

task_0

-

INFO

$ConsumerType (string)

$PossibleCause (string)

19

task_0

-

INFO

$OperationID (integer)

$Operation (string)

$ClientProcessId (integer)

$ClientMachineFQDN (string)

$ClientProcessCreationTime (integer)

$IsLocal (boolean)

20

task_0

-

INFO

$OperationID (integer)

$Operation (string)

$Flags (integer)

$ClientProcessId (integer)

$ClientMachineFQDN (string)

$ClientProcessCreationTime (integer)

$IsLocal (boolean)

21

task_0

-

INFO

$ConsumerType (string)

$PossibleCause (string)

22

task_0

-

INFO

$CorrelationId (string)

$GroupOperationId (integer)

$OperationId (integer)

$ClassName (string)

$MethodName (string)

$ImplementationClass (string)

$ClientMachine (string)

$ClientMachineFQDN (string)

$User (string)

$ClientProcessId (integer)

$ClientProcessCreationTime (integer)

$NamespaceName (string)

$IsLocal (boolean)

23

task_0

-

INFO

$CorrelationId (string)

$GroupOperationId (integer)

$OperationId (integer)

$Commandline (string)

$CreatedProcessId (integer)

$CreatedProcessCreationTime (integer)

$ClientMachine (string)

$ClientMachineFQDN (string)

$User (string)

$ClientProcessId (integer)

$ClientProcessCreationTime (integer)

$IsLocal (boolean)

50

task_0

-

INFO

100

task_0

-

-

$ComponentName (string)

$MessageDetail (string)

$FileName (string)

101

task_0

-

ERROR

$ComponentName (string)

$ErrorId (string)

$ErrorDetail (string)

$FileName (string)

5857

task_0

-

-

$ProviderName (string)

$Code (string)

$HostProcess (string)

$ProcessID (integer)

$ProviderPath (string)

5858

task_0

-

ERROR

$Id (string)

$ClientMachine (string)

$User (string)

$ClientProcessId (integer)

$Component (string)

$Operation (string)

$ResultCode (string)

$PossibleCause (string)

5859

task_0

-

-

$NamespaceName (string)

$Query (string)

$User (string)

$processid (integer)

$providerName (string)

$queryid (integer)

$PossibleCause (string)

5860

task_0

-

-

$NamespaceName (string)

$Query (string)

$User (string)

$processid (integer)

$MachineName (string)

$PossibleCause (string)

5861

task_0

-

-

$Namespace (string)

$ESS (string)

$CONSUMER (string)

$PossibleCause (string)

Microsoft-Windows-WMI

4

task_0

opcode_192

-

10

task_0

opcode_192

-

21

task_0

opcode_192

-

22

task_0

opcode_192

-

23

task_0

opcode_192

-

24

task_0

opcode_192

-

25

task_0

opcode_192

-

28

task_0

opcode_192

-

29

task_0

opcode_192

-

43

task_0

opcode_192

-

48

task_0

opcode_192

-

58

task_0

opcode_192

-

59

task_0

opcode_192

-

63

task_0

opcode_128

-

65

task_0

opcode_192

-

66

task_0

opcode_192

-

67

task_0

-

INFO

$BackupFile (string)

67

task_0

opcode_192

-

68

task_0

-

INFO

$BackupFile (string)

$Error (string)

68

task_0

opcode_192

-

5600

task_0

opcode_64

-

5601

task_0

opcode_192

-

5602

task_0

opcode_192

-

5604

task_0

opcode_192

-

5605

task_0

opcode_192

-

5606

task_0

opcode_192

-

5611

task_0

opcode_192

-

5612

task_0

opcode_192

-

5614

task_0

opcode_192

-

5615

task_0

opcode_192

-

5616

task_0

opcode_192

-

5617

task_0

opcode_192

-

5631

task_0

opcode_192

-