Microsoft-Windows-ClusterAwareUpdating

42 events across 3 channels

Event	Title	Channel	Sample
1000	task_0	Debug	N
1000	Event ID 1000	Operational	N
2000	Failover Cluster Updating WMI provider suffered an unclean shutdown	Admin	N
2000	Event ID 2000	Operational	N
2001	Scan for updates succeeded.	Admin	N
2001	Event ID 2001	Operational	N
2002	Scan failed with HRESULT HRESULT.	Admin	N
2002	Event ID 2002	Operational	N
2003	Download for updates succeeded.	Admin	N
2003	Event ID 2003	Operational	N
2004	Download failed with HRESULT HRESULT.	Admin	N
2004	Event ID 2004	Operational	N
2005	Install for updates succeeded.	Admin	N
2005	Event ID 2005	Operational	N
2006	Install failed with HRESULT HRESULT.	Admin	N
2006	Event ID 2006	Operational	N
2007	Cancelling Windows Update Agent operation	Admin	N
2007	Event ID 2007	Operational	N
2008	Update has been skipped as it required user interaction {UpdateTitle UpdateID}.	Admin	N
2008	Event ID 2008	Operational	N
2009	Update has been skipped as it has an unaccepted EULA {UpdateTitle UpdateID}.	Admin	N
2009	Event ID 2009	Operational	N
2010	Ignoring WUA warning Message HRESULT.	Admin	N
2010	Event ID 2010	Operational	N
2011	ObjectName for orchestrator ClientKey has timed out.	Admin	N
2011	Event ID 2011	Operational	N
2012	Orchestrator ClientKey reconnected to WMI provider.	Admin	N
2012	Event ID 2012	Operational	N
2013	Failed to store report with identifier ReportId with HRESULT HRESULT.	Admin	N
2013	Event ID 2013	Operational	N
2014	Activity Transfer event	Admin	N
2014	Event ID 2014	Operational	N
2015	Failed to retrieve report with identifier ReportId with HRESULT HRESULT.	Admin	N
2015	Event ID 2015	Operational	N
2016	An instance of ObjectName already exists with Guid ExistingGuid.	Admin	N
2016	Event ID 2016	Operational	N
2017	Skipped an optional update {UpdateTitle UpdateID}.	Admin	N
2017	Event ID 2017	Operational	N
2018	Update has been skipped as it is not an important update {UpdateTitle UpdateID}.	Admin	N
2018	Event ID 2018	Operational	N
2021	Failed to start the hotfix installer.	Admin	N
2021	Event ID 2021	Operational	N

Event ID 1000: task_0

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Debug

Message #

%1

Fields #

Name	Description
`log` AnsiString

Event ID 1000

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Fields #

Name	Description
`log` AnsiString

Event ID 2000: Failover Cluster Updating WMI provider suffered an unclean shutdown

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Failover Cluster Updating WMI provider suffered an unclean shutdown.

Message #

Failover Cluster Updating WMI provider suffered an unclean shutdown

Event ID 2000

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Failover Cluster Updating WMI provider suffered an unclean shutdown.

Event ID 2001: Scan for updates succeeded.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Scan for updates succeeded. Found UpdateCount updates.

Message #

Scan for updates succeeded. Found %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2001

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Scan for updates succeeded. Found updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2002: Scan failed with HRESULT HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Scan failed with HRESULT HRESULT.

Message #

Scan failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2002

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Scan failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2003: Download for updates succeeded.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Download for updates succeeded. Downloaded UpdateCount updates.

Message #

Download for updates succeeded. Downloaded %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2003

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Download for updates succeeded. Downloaded updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2004: Download failed with HRESULT HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Download failed with HRESULT HRESULT.

Message #

Download failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2004

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Download failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2005: Install for updates succeeded.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Install for updates succeeded. Installed UpdateCount updates.

Message #

Install for updates succeeded. Installed %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2005

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Install for updates succeeded. Installed updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2006: Install failed with HRESULT HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Install failed with HRESULT HRESULT.

Message #

Install failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2006

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Install failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2007: Cancelling Windows Update Agent operation

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Cancelling Windows Update Agent operation.

Message #

Cancelling Windows Update Agent operation

Event ID 2007

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Cancelling Windows Update Agent operation.

Event ID 2008: Update has been skipped as it required user interaction {UpdateTitle UpdateID}.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Update has been skipped as it required user interaction {UpdateTitle UpdateID}.

Message #

Update has been skipped as it required user interaction {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2008

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Update has been skipped as it required user interaction { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2009: Update has been skipped as it has an unaccepted EULA {UpdateTitle UpdateID}.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Update has been skipped as it has an unaccepted EULA {UpdateTitle UpdateID}.

Message #

Update has been skipped as it has an unaccepted EULA {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2009

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Update has been skipped as it has an unaccepted EULA { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2010: Ignoring WUA warning Message HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Ignoring WUA warning Message HRESULT.

Message #

Ignoring WUA warning %1 %2

Fields #

Name	Description
`Message` UnicodeString
`HRESULT` UInt32

Event ID 2010

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Ignoring WUA warning.

Fields #

Name	Description
`Message` UnicodeString
`HRESULT` UInt32

Event ID 2011: ObjectName for orchestrator ClientKey has timed out.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

ObjectName for orchestrator ClientKey has timed out. Last access time: LastAccessTime.

Message #

%1 for orchestrator %2 has timed out. Last access time: %3

Fields #

Name	Description
`ObjectName` UnicodeString
`ClientKey` GUID
`LastAccessTime` FILETIME

Event ID 2011

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

for orchestrator has timed out. Last access time.

Fields #

Name	Description
`ObjectName` UnicodeString
`ClientKey` GUID
`LastAccessTime` FILETIME

Event ID 2012: Orchestrator ClientKey reconnected to WMI provider.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Orchestrator ClientKey reconnected to WMI provider.

Message #

Orchestrator %1 reconnected to WMI provider

Fields #

Name	Description
`ClientKey` GUID

Event ID 2012

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Orchestrator reconnected to WMI provider.

Fields #

Name	Description
`ClientKey` GUID

Event ID 2013: Failed to store report with identifier ReportId with HRESULT HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Failed to store report with identifier ReportId with HRESULT HRESULT.

Message #

Failed to store report with identifier %1 with HRESULT %2

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2013

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Failed to store report with identifier with HRESULT.

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2014: Activity Transfer event

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Activity Transfer event.

Message #

Activity Transfer event

Event ID 2014

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Activity Transfer event.

Event ID 2015: Failed to retrieve report with identifier ReportId with HRESULT HRESULT.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Failed to retrieve report with identifier ReportId with HRESULT HRESULT.

Message #

Failed to retrieve report with identifier %1 with HRESULT %2

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2015

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Failed to retrieve report with identifier with HRESULT.

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2016: An instance of ObjectName already exists with Guid ExistingGuid.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

An instance of ObjectName already exists with Guid ExistingGuid. Failed to create an instance with Guid NewGuid.

Message #

An instance of %1 already exists with Guid %2. Failed to create an instance with Guid %3

Fields #

Name	Description
`ObjectName` UnicodeString
`ExistingGuid` GUID
`NewGuid` GUID

Event ID 2016

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

An instance of already exists with Guid . Failed to create an instance with Guid.

Fields #

Name	Description
`ObjectName` UnicodeString
`ExistingGuid` GUID
`NewGuid` GUID

Event ID 2017: Skipped an optional update {UpdateTitle UpdateID}.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Skipped an optional update {UpdateTitle UpdateID}.

Message #

Skipped an optional update {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2017

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Skipped an optional update { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2018: Update has been skipped as it is not an important update {UpdateTitle UpdateID}.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Update has been skipped as it is not an important update {UpdateTitle UpdateID}.

Message #

Update has been skipped as it is not an important update {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2018

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Update has been skipped as it is not an important update { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2021: Failed to start the hotfix installer.

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Admin

Description

Failed to start the hotfix installer. Installer path: InstallPath. Parameters: Parameters. Update path: UpdatePath. HRESULT HRESULT, exit code: ExitCode.

Message #

Failed to start the hotfix installer. Installer path: %1. Parameters: %2. Update path: %3. HRESULT %4, exit code: %5.

Fields #

Name	Description
`InstallPath` UnicodeString
`Parameters` UnicodeString
`UpdatePath` UnicodeString
`HRESULT` UInt32
`ExitCode` Int32

Event ID 2021

Provider: Microsoft-Windows-ClusterAwareUpdating
Channel: Operational

Description

Failed to start the hotfix installer. Installer path: . Parameters: . Update path: . HRESULT , exit code: .

Fields #

Name	Description
`InstallPath` UnicodeString
`Parameters` UnicodeString
`UpdatePath` UnicodeString
`HRESULT` UInt32
`ExitCode` Int32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 10629806-46f2-4366-9092-53025e067e8c

Defined in cauwmiv2.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02

Downloads

Microsoft-Windows-ClusterAwareUpdating registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)