Microsoft-Windows-ACL-UI

Event	Title	Channel	Sample	Rule
4000	LaunchAdvancedACLUIStart	Operational	N	N
4001	LaunchAdvancedACLUIStop	Operational	N	N
4002	DownloadClaimIDsStart	Operational	N	N
4003	DownloadClaimIDsStop	Operational	N	N
4004	DisplayPermissionsDialogwhenEditinganACEStart	Operational	N	N
4005	DisplayPermissionsDialogwhenEditinganACEStop	Operational	N	N
4006	DisplayPermissionsDialogwhenAddinganACEStart	Operational	N	N
4007	DisplayPermissionsDialogwhenAddinganACEStop	Operational	N	N
4008	DownloadCentralAccessPolicyIDsStart	Operational	N	N
4009	DownloadCentralAccessPolicyIDsStop	Operational	N	N
4010	DisplayEffectivePermissionReportStart	Operational	N	N
4011	DisplayEffectivePermissionReportStop	Operational	N	N

Event ID 4000: LaunchAdvancedACLUIStart

Channel: Operational
Task: LaunchAdvancedACLUI
Opcode: Start

Event ID 4001: LaunchAdvancedACLUIStop

Channel: Operational
Task: LaunchAdvancedACLUI
Opcode: Stop

Event ID 4002: DownloadClaimIDsStart

Channel: Operational
Task: DownloadClaimIDs
Opcode: Start

Event ID 4003: DownloadClaimIDsStop

Channel: Operational
Task: DownloadClaimIDs
Opcode: Stop

Event ID 4004: DisplayPermissionsDialogwhenEditinganACEStart

Channel: Operational
Task: DisplayPermissionsDialogwhenEditinganACE
Opcode: Start

Event ID 4005: DisplayPermissionsDialogwhenEditinganACEStop

Channel: Operational
Task: DisplayPermissionsDialogwhenEditinganACE
Opcode: Stop

Event ID 4006: DisplayPermissionsDialogwhenAddinganACEStart

Channel: Operational
Task: DisplayPermissionsDialogwhenAddinganACE
Opcode: Start

Event ID 4007: DisplayPermissionsDialogwhenAddinganACEStop

Channel: Operational
Task: DisplayPermissionsDialogwhenAddinganACE
Opcode: Stop

Event ID 4008: DownloadCentralAccessPolicyIDsStart

Channel: Operational
Task: DownloadCentralAccessPolicyIDs
Opcode: Start

Event ID 4009: DownloadCentralAccessPolicyIDsStop

Channel: Operational
Task: DownloadCentralAccessPolicyIDs
Opcode: Stop

Event ID 4010: DisplayEffectivePermissionReportStart

Channel: Operational
Task: DisplayEffectivePermissionReport
Opcode: Start

Event ID 4011: DisplayEffectivePermissionReportStop

Channel: Operational
Task: DisplayEffectivePermissionReport
Opcode: Stop

Provenance

ETW provider GUID ea4cc8b8-a150-47a3-afb9-c8d194b19452

Defined in aclui.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB