Microsoft-Windows-Cleanmgr
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | Completing initialization. | Diagnostic | N | N |
| 1002 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1003 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1004 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1005 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1006 | Scanning cleanup plugins. | Diagnostic | N | N |
| 1007 | Completing scan. | Diagnostic | N | N |
| 1008 | Completing cleanup. | Diagnostic | N | N |
| 1009 | Purge cleanup plugins. | Diagnostic | N | N |
| 1010 | Purge cleanup plugins. | Diagnostic | N | N |
Event ID 1001: Completing initialization.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DrivePath UnicodeString | |
PluginCount UInt64 | |
PlugInInitialized UInt64 | |
InitTime Double |
Event ID 1003: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
InstantiationTime Double | |
PluginInstantiationTime Double | |
HR Int32 |
Event ID 1005: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
Autorun Boolean | |
Name UnicodeString | |
Description UnicodeString | |
IsPluginSelected Boolean | |
IsPluginVisible Boolean | |
InitializationSucceed Boolean | |
InitializationTime Double | |
PluginInitializationTime Double | |
InitTime Double | |
HR Int32 |
Event ID 1006: Scanning cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
Autorun Boolean | |
IsPluginSelected Boolean | |
IsPluginVisible Boolean | |
SpaceUsed UInt64 | |
ScanAborted Boolean | |
ScanTime Double | |
PluginScanTime Double | |
HR Int32 |
Event ID 1007: Completing scan.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DrivePath UnicodeString | |
IsUserAdmin Boolean | |
TotalScanSize UInt64 | |
PluginCount UInt32 | |
PluginScanned UInt32 | |
ScanSucceeded UInt32 | |
ScanFailed UInt32 | |
SizeZeroPlugin UInt32 | |
ScanTime Double |
Event ID 1008: Completing cleanup.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DrivePath UnicodeString | |
Flag Int32 | |
IsUserAdmin Boolean | |
DiskPriority UInt64 | |
ClaimedDeleteBytes UInt64 | |
ActualDeleteBytes UInt64 | |
VolumeSize UInt64 | |
FreeBytesBefore UInt64 | |
FreeBytesAfter UInt64 | |
StorageReserveBefore AnsiString | |
StorageReserveAfter AnsiString | |
IsPurgeAborted Boolean | |
PluginCount UInt32 | |
TotalPluginsPurged UInt32 | |
TotalPluginsQualified UInt32 | |
TotalPurgeSucceed UInt32 | |
TotalPurgeFailed UInt32 | |
AfterPurgeGetSpaceFailed UInt32 | |
TotalSizesZeroPlugins UInt32 | |
TotalSelectedPlugins UInt32 | |
TotalSkippedPlugins UInt32 | |
PluginPurgeTime Double | |
TotalPurgeTime Double |
Event ID 1009: Purge cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
DrivePath UnicodeString | |
Flag Int32 | |
IsUserAdmin Boolean | |
Autorun Boolean | |
IsPluginSelected Boolean | |
IsPluginVisible Boolean |
Event ID 1010: Purge cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DrivePath UnicodeString | |
Flag Int32 | |
IsUserAdmin Boolean | |
PlugIn UnicodeString | |
Priority UInt32 | |
PluginPurgeTime Double | |
PluginUsedSpaceAfter UInt64 | |
PluginUsedSpaceBefore UInt64 | |
FreeBytesBefore UInt64 | |
FreeBytesAfter UInt64 | |
ReserveAreaBefore AnsiString | |
ReserveAreaAfter AnsiString | |
IsPurgeAborted Boolean | |
Autorun Boolean | |
IsPluginSelected Boolean | |
IsPluginVisible Boolean | |
HRPurge Int32 | |
HRSpaceUsed Int32 | |
PurgeTime Double |
Provenance
ETW provider GUID 9ae87b12-a014-5288-92df-e3030981ebab
Defined in cleanmgr.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3207, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB