Microsoft-Windows-BootUX

Event	Title	Channel	Sample	Rule
1000	LaunchUXStart	Operational	N	N
1001	LaunchUXStop	Operational	N	N
1002	SwapPageStart	Operational	N	N
1003	SwapPageStop	Operational	N	N
1004	task_0	Operational	N	N
1005	task_01005	Operational	N	N
1006	UserInteractionStart	Operational	N	N
1007	UserInteractionStop	Operational	N	N
1008	PageConstructionStart	Operational	N	N
1009	PageConstructionStop	Operational	N	N

Event ID 1000: LaunchUXStart

Channel: Operational
Task: LaunchUX
Opcode: Start

Event ID 1001: LaunchUXStop

Channel: Operational
Task: LaunchUX
Opcode: Stop

Event ID 1002: SwapPageStart

Channel: Operational
Task: SwapPage
Opcode: Start

Event ID 1003: SwapPageStop

Channel: Operational
Task: SwapPage
Opcode: Stop

Event ID 1004: task_0

Channel: Operational
Opcode: Info

Fields #

Name	Description
`UsingUSB` Boolean
`success` Boolean
`resultCode` UInt32

Event ID 1005: task_01005

Channel: Operational
Opcode: Info

Fields #

Name	Description
`programCounter` UInt64
`exceptionType` UInt32

Event ID 1006: UserInteractionStart

Channel: Operational
Task: UserInteraction
Opcode: Start

Event ID 1007: UserInteractionStop

Channel: Operational
Task: UserInteraction
Opcode: Stop

Event ID 1008: PageConstructionStart

Channel: Operational
Task: PageConstruction
Opcode: Start

Event ID 1009: PageConstructionStop

Channel: Operational
Task: PageConstruction
Opcode: Stop

Provenance

ETW provider GUID 67d781bd-cbd2-4bd2-ad1f-6152fb891246

Defined in bootux.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB