File Kernel Trace; Operation Set 1

Event	Title	Channel	Sample	Rule
0	FileOperation	ETW Trace	N	N
1	FileOperation	ETW Trace	N	N
2	FileOperation	ETW Trace	N	N
3	FileOperation	ETW Trace	N	N
4	FileOperation	ETW Trace	N	N
5	FileOperation	ETW Trace	N	N
6	FileOperation	ETW Trace	N	N
7	FileOperation	ETW Trace	N	N
8	FileOperation	ETW Trace	N	N
9	FileOperation	ETW Trace	N	N
10	FileOperation	ETW Trace	N	N
11	FileOperation	ETW Trace	N	N
12	FileOperation	ETW Trace	N	N
13	FileOperation	ETW Trace	N	N
14	FileOperation	ETW Trace	N	N
15	FileOperation	ETW Trace	N	N
16	FileOperation	ETW Trace	N	N
17	FileOperation	ETW Trace	N	N
18	FileOperation	ETW Trace	N	N
19	FileOperation	ETW Trace	N	N
20	FileOperation	ETW Trace	N	N
21	FileOperation	ETW Trace	N	N
22	FileOperation	ETW Trace	N	N
23	FileOperation	ETW Trace	N	N
24	FileOperation	ETW Trace	N	N
25	FileOperation	ETW Trace	N	N
26	FileOperation	ETW Trace	N	N
27	FileOperation	ETW Trace	N	N
236	FileOperation	ETW Trace	N	N
237	FileOperation	ETW Trace	N	N
238	FileOperation	ETW Trace	N	N
239	FileOperation	ETW Trace	N	N
240	FileOperation	ETW Trace	N	N
241	FileOperation	ETW Trace	N	N
242	FileOperation	ETW Trace	N	N
243	FileOperation	ETW Trace	N	N
249	FileOperation	ETW Trace	N	N
250	FileOperation	ETW Trace	N	N
251	FileOperation	ETW Trace	N	N
252	FileOperation	ETW Trace	N	N
253	FileOperation	ETW Trace	N	N
254	FileOperation	ETW Trace	N	N
255	FileOperation	ETW Trace	N	N

Event ID 0: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 1: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 2: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 3: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 4: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 5: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 6: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 7: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 8: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 9: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 10: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 11: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 12: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 13: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 14: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 15: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 16: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 17: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 18: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 19: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 20: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 21: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 22: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 23: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 24: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 25: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 26: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 27: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 236: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 237: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 238: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 239: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 240: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 241: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 242: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 243: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 249: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 250: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 251: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 252: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 253: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 254: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Event ID 255: FileOperation

Channel: ETW Trace
Opcode: FileTrace
Source: Trace

Fields #

Name	Description
`Status` mof:UInt32	NTSTATUS reference
`Operation` mof:UInt8	Known values `%%2456` Open key file. `%%2457` Delete key file. `%%2458` Read persisted key from file. `%%2459` Write persisted key to file. `%%2464` Export of persistent cryptographic key. `%%2465` Import of persistent cryptographic key. `%%2480` Open Key. `%%2481` Create Key. `%%2482` Delete Key. `%%2483` Encrypt. `%%2484` Decrypt. `%%2485` Sign hash. `%%2486` Secret agreement. `%%2487` Domain settings. `%%2488` Local settings. `%%2489` Add provider. `%%2490` Remove provider. `%%2491` Add context. `%%2492` Remove context. `%%2493` Add function. `%%2494` Remove function. `%%2495` Add function provider. `%%2496` Remove function provider. `%%2497` Add function property. `%%2498` Remove function property. `%%2499` Machine key. `%%2500` User key. `%%2501` Key Derivation. `%%2502` Claim Creation. `%%2503` Claim Verification.
`MinorOperation` mof:UInt8
`SequenceNumber` mof:UInt32
`IsPagingIO` mof:UInt8
`IsFastIO` mof:UInt8
`IsDirectory` mof:UInt8
`CreateOnExisting` mof:UInt8
`StartTime` mof:SInt64
`ProcessId` mof:UInt32
`ProcessCreateTime` mof:SInt64
`FileObject` mof:UInt64
`LastAccessTime` mof:SInt64
`SessionId` mof:UInt32
`WindowStation` mof:UInt64
`AccessToken` mof:UInt32
`SidLength` mof:UInt32
`ParametersLength` mof:UInt32
`ResultLength` mof:UInt32
`PreviousValueLength` mof:UInt32
`UserSID` mof:Object
`OperationalParameters` mof:UInt8
`ResultData` mof:UInt8
`PreviousValue` mof:UInt8
`FileName` mof:String
`VolumeDosName` mof:String
`VolumeGuidName` mof:String
`VolumeName` mof:String

Provenance

ETW provider GUID {D75D8303-6C21-4BDE-9C98-ECC6320F9291}

WS2025-26100.0, schema read from the WMI MOF class, captured 2026-02-26
Taken from Windows installation media (build 26100.1), not a patched system, so the exact update level is unknown.
WS2022-20348.4893, schema read from the WMI MOF class, captured 2026-06-02
MOF class: MSNT_FileBaseTrace_Set1
Win11-26200.6584, schema read from the WMI MOF class, captured 2026-06-02
MOF class: MSNT_FileBaseTrace_Set1