Microsoft-Windows-ClusterAwareUpdating-Management

46 events across 2 channels

Event	Title	Channel	Sample
1001	Cluster updating has exceeded the warning timeout of timeoutValue.	Admin	N
1001	Event ID 1001	Operational	N
1002	Cluster updating has exceeded the StopAfter timeout of timeoutValue.	Admin	N
1002	Event ID 1002	Operational	N
1003	Starting CAU run runIdentifier on cluster clusterName.	Admin	N
1003	Event ID 1003	Operational	N
1004	CAU run runIdentifier on cluster clusterName completed successfully.	Admin	N
1004	Event ID 1004	Operational	N
1005	CAU run runIdentifier on cluster clusterName was canceled.	Admin	N
1005	Event ID 1005	Operational	N
1006	CAU run runIdentifier on cluster clusterName failed partially.	Admin	N
1006	Event ID 1006	Operational	N
1007	CAU run runIdentifier on cluster clusterName failed.	Admin	N
1007	Event ID 1007	Operational	N
1008	Node clusterNodeName entered node maintenance mode.	Admin	N
1008	Event ID 1008	Operational	N
1009	Node clusterNodeName exited node maintenance mode.	Admin	N
1009	Event ID 1009	Operational	N
1010	Rebooting node clusterNodeName.	Admin	N
1010	Event ID 1010	Operational	N
1011	Node clusterNodeName has rebooted successfully.	Admin	N
1011	Event ID 1011	Operational	N
1012	Failed to reboot node clusterNodeName.	Admin	N
1012	Event ID 1012	Operational	N
1013	CAU run failed on node clusterNodeName.	Admin	N
1013	Event ID 1013	Operational	N
1014	Recovering the cluster clusterName from previous CAU run.	Admin	N
1014	Event ID 1014	Operational	N
1015	Failed to acquire lock on node clusterNodeName.	Admin	N
1015	Event ID 1015	Operational	N
1016	Failed to put node clusterNodeName in node maintenance mode.	Admin	N
1016	Event ID 1016	Operational	N
1017	Failed to resume node clusterNodeName from node maintenance mode.	Admin	N
1017	Event ID 1017	Operational	N
1018	Canceling CAU run as rebooting node clusterNodeName will compromise cluster …	Admin	N
1018	Event ID 1018	Operational	N
1019	Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.	Admin	N
1019	Event ID 1019	Operational	N
1020	Canceling CAU run as all nodes are required to be online.	Admin	N
1020	Event ID 1020	Operational	N
1021	User canceled CAU run runIdentifier on cluster clusterName.	Admin	N
1021	Event ID 1021	Operational	N
1022	Failed to save CAU report.	Admin	N
1022	Event ID 1022	Operational	N
1023	Failed to get CAU report.	Admin	N
1023	Event ID 1023	Operational	N

Event ID 1001: Cluster updating has exceeded the warning timeout of timeoutValue.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the warning timeout of timeoutValue.

Message #

Cluster updating has exceeded the warning timeout of %1.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1001

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the warning timeout of .

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002: Cluster updating has exceeded the StopAfter timeout of timeoutValue.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of timeoutValue. Stopping updating run.

Message #

Cluster updating has exceeded the StopAfter timeout of %1. Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1002

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Cluster updating has exceeded the StopAfter timeout of . Stopping updating run.

Fields #

Name	Description
`timeoutValue` UInt32

Event ID 1003: Starting CAU run runIdentifier on cluster clusterName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Starting CAU run runIdentifier on cluster clusterName.

Message #

Starting CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1003

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Starting CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004: CAU run runIdentifier on cluster clusterName completed successfully.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName completed successfully.

Message #

CAU run %1 on cluster %2 completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1004

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster completed successfully.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005: CAU run runIdentifier on cluster clusterName was canceled.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName was canceled.

Message #

CAU run %1 on cluster %2 was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1005

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster was canceled.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006: CAU run runIdentifier on cluster clusterName failed partially.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName failed partially.

Message #

CAU run %1 on cluster %2 failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1006

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed partially.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1007: CAU run runIdentifier on cluster clusterName failed.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run runIdentifier on cluster clusterName failed. Error Message:errorMessage Error Code:errorCode Stack:stackTrace.

Message #

CAU run %1 on cluster %2 failed. Error Message:%3 Error Code:%4 Stack:%5

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1007

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run on cluster failed. Error Message: Error Code: Stack.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString
`errorMessage` UnicodeString
`errorCode` Int32
`stackTrace` UnicodeString

Event ID 1008: Node clusterNodeName entered node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName entered node maintenance mode.

Message #

Node %1 entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1008

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node entered node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009: Node clusterNodeName exited node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName exited node maintenance mode.

Message #

Node %1 exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1009

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node exited node maintenance mode.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010: Rebooting node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Rebooting node clusterNodeName.

Message #

Rebooting node %1.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1010

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Rebooting node .

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011: Node clusterNodeName has rebooted successfully.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Node clusterNodeName has rebooted successfully.

Message #

Node %1 has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1011

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Node has rebooted successfully.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1012: Failed to reboot node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to reboot node clusterNodeName. Details: errorMessage.

Message #

Failed to reboot node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1012

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to reboot node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013: CAU run failed on node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

CAU run failed on node clusterNodeName. Details: errorMessage.

Message #

CAU run failed on node %1. Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1013

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

CAU run failed on node . Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1014: Recovering the cluster clusterName from previous CAU run.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Recovering the cluster clusterName from previous CAU run.

Message #

Recovering the cluster %1 from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1014

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Recovering the cluster from previous CAU run.

Fields #

Name	Description
`clusterName` UnicodeString

Event ID 1015: Failed to acquire lock on node clusterNodeName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to acquire lock on node clusterNodeName. This could be due to a different instance of orchestrator that owns the lock on this node.

Message #

Failed to acquire lock on node %1. This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1015

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to acquire lock on node . This could be due to a different instance of orchestrator that owns the lock on this node.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1016: Failed to put node clusterNodeName in node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to put node clusterNodeName in node maintenance mode. Details: errorMessage.

Message #

Failed to put node %1 in node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1016

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to put node in node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017: Failed to resume node clusterNodeName from node maintenance mode.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Failed to resume node clusterNodeName from node maintenance mode. Details: errorMessage.

Message #

Failed to resume node %1 from node maintenance mode.  Details: %2

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1017

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Failed to resume node from node maintenance mode. Details.

Fields #

Name	Description
`clusterNodeName` UnicodeString
`errorMessage` UnicodeString

Event ID 1018: Canceling CAU run as rebooting node clusterNodeName will compromise cluster quorum.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as rebooting node clusterNodeName will compromise cluster quorum.

Message #

Canceling CAU run as rebooting node %1 will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1018

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as rebooting node will compromise cluster quorum.

Fields #

Name	Description
`clusterNodeName` UnicodeString

Event ID 1019: Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as patching failed on nodeCount (MaxFailedNodes) nodes.

Message #

Canceling CAU run as patching failed on %1 (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1019

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as patching failed on (MaxFailedNodes) nodes.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020: Canceling CAU run as all nodes are required to be online.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodeCount nodes are currently offline.

Message #

Canceling CAU run as all nodes are required to be online. %1 nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1020

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

Canceling CAU run as all nodes are required to be online. nodes are currently offline.

Fields #

Name	Description
`nodeCount` Int32

Event ID 1021: User canceled CAU run runIdentifier on cluster clusterName.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: InstallingUpdates

Description

User canceled CAU run runIdentifier on cluster clusterName.

Message #

User canceled CAU run %1 on cluster %2.

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1021

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: InstallingUpdates

Description

User canceled CAU run on cluster .

Fields #

Name	Description
`runIdentifier` GUID
`clusterName` UnicodeString

Event ID 1022: Failed to save CAU report.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: Reports

Description

Failed to save CAU report. Details:errorMessage.

Message #

Failed to save CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1022

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: Reports

Description

Failed to save CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023: Failed to get CAU report.

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Admin
Opcode: Reports

Description

Failed to get CAU report. Details:errorMessage.

Message #

Failed to get CAU report. Details:%1

Fields #

Name	Description
`errorMessage` UnicodeString

Event ID 1023

Provider: Microsoft-Windows-ClusterAwareUpdating-Management
Channel: Operational
Opcode: Reports

Description

Failed to get CAU report. Details.

Fields #

Name	Description
`errorMessage` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 9b9e93d6-5569-4179-8c8a-5201cb2b9536

Defined in ClusterAwareUpdatingNative.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-ClusterAwareUpdating-Management registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)