Microsoft-Windows-BestPractices
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 0 | Model scanning | Operational | N | N |
| 1 | Finished model scan | Operational | N | N |
| 2 | Started scan of model 'String' submodel 'String2'. | Operational | N | N |
| 3 | Finished starting scan of model 'String' submodel 'String2'. | Operational | N | N |
| 4 | String. | Operational | N | N |
| 5 | The model is a Windows 7 model | Operational | N | N |
| 6 | The model will be scanned remotely | Operational | N | N |
| 7 | The model requires starting the scan on this local computer. | Operational | N | N |
Event ID 0: Model scanning
#Event ID 1: Finished model scan
#Event ID 2: Started scan of model 'String' submodel 'String2'.
#Event ID 3: Finished starting scan of model 'String' submodel 'String2'.
#Event ID 5: The model is a Windows 7 model
#Event ID 6: The model will be scanned remotely
#Event ID 7: The model requires starting the scan on this local computer.
#Provenance
ETW provider GUID 5218e51a-3996-4a9a-a75a-70ba4eb66312
Defined in BPAInst.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB