Microsoft-Windows-ClusterAwareUpdating

Event	Title	Channel	Sample	Rule
1000	task_0	Debug	N	N
1000	Event ID 1000	Operational	N	N
2000	Failover Cluster Updating WMI provider suffered an unclean shutdown	Admin	N	N
2000	Event ID 2000	Operational	N	N
2001	Scan for updates succeeded.	Admin	N	N
2001	Event ID 2001	Operational	N	N
2002	Scan failed with HRESULT HRESULT.	Admin	N	N
2002	Event ID 2002	Operational	N	N
2003	Download for updates succeeded.	Admin	N	N
2003	Event ID 2003	Operational	N	N
2004	Download failed with HRESULT HRESULT.	Admin	N	N
2004	Event ID 2004	Operational	N	N
2005	Install for updates succeeded.	Admin	N	N
2005	Event ID 2005	Operational	N	N
2006	Install failed with HRESULT HRESULT.	Admin	N	N
2006	Event ID 2006	Operational	N	N
2007	Cancelling Windows Update Agent operation	Admin	N	N
2007	Event ID 2007	Operational	N	N
2008	Update has been skipped as it required user interaction {UpdateTitle UpdateID}.	Admin	N	N
2008	Event ID 2008	Operational	N	N
2009	Update has been skipped as it has an unaccepted EULA {UpdateTitle UpdateID}.	Admin	N	N
2009	Event ID 2009	Operational	N	N
2010	Ignoring WUA warning Message HRESULT.	Admin	N	N
2010	Event ID 2010	Operational	N	N
2011	ObjectName for orchestrator ClientKey has timed out.	Admin	N	N
2011	Event ID 2011	Operational	N	N
2012	Orchestrator ClientKey reconnected to WMI provider.	Admin	N	N
2012	Event ID 2012	Operational	N	N
2013	Failed to store report with identifier ReportId with HRESULT HRESULT.	Admin	N	N
2013	Event ID 2013	Operational	N	N
2014	Activity Transfer event	Admin	N	N
2014	Event ID 2014	Operational	N	N
2015	Failed to retrieve report with identifier ReportId with HRESULT HRESULT.	Admin	N	N
2015	Event ID 2015	Operational	N	N
2016	An instance of ObjectName already exists with Guid ExistingGuid.	Admin	N	N
2016	Event ID 2016	Operational	N	N
2017	Skipped an optional update {UpdateTitle UpdateID}.	Admin	N	N
2017	Event ID 2017	Operational	N	N
2018	Update has been skipped as it is not an important update {UpdateTitle UpdateID}.	Admin	N	N
2018	Event ID 2018	Operational	N	N
2021	Failed to start the hotfix installer.	Admin	N	N
2021	Event ID 2021	Operational	N	N

Event ID 1000: task_0

Channel: Debug

Message #

%1

Fields #

Name	Description
`log` AnsiString

Event ID 1000

Channel: Operational

Fields #

Name	Description
`log` AnsiString

Event ID 2000: Failover Cluster Updating WMI provider suffered an unclean shutdown

Channel: Admin

Event ID 2000

Channel: Operational

Description

Failover Cluster Updating WMI provider suffered an unclean shutdown.

Event ID 2001: Scan for updates succeeded.

Channel: Admin

Description

Scan for updates succeeded. Found UpdateCount updates.

Message #

Scan for updates succeeded. Found %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2001

Channel: Operational

Description

Scan for updates succeeded. Found updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2002: Scan failed with HRESULT HRESULT.

Channel: Admin

Message #

Scan failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2002

Channel: Operational

Description

Scan failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2003: Download for updates succeeded.

Channel: Admin

Description

Download for updates succeeded. Downloaded UpdateCount updates.

Message #

Download for updates succeeded. Downloaded %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2003

Channel: Operational

Description

Download for updates succeeded. Downloaded updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2004: Download failed with HRESULT HRESULT.

Channel: Admin

Message #

Download failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2004

Channel: Operational

Description

Download failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2005: Install for updates succeeded.

Channel: Admin

Description

Install for updates succeeded. Installed UpdateCount updates.

Message #

Install for updates succeeded. Installed %1 updates

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2005

Channel: Operational

Description

Install for updates succeeded. Installed updates.

Fields #

Name	Description
`UpdateCount` UInt32

Event ID 2006: Install failed with HRESULT HRESULT.

Channel: Admin

Message #

Install failed with HRESULT %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2006

Channel: Operational

Description

Install failed with HRESULT.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 2007: Cancelling Windows Update Agent operation

Channel: Admin

Event ID 2007

Channel: Operational

Description

Cancelling Windows Update Agent operation.

Event ID 2008: Update has been skipped as it required user interaction {UpdateTitle UpdateID}.

Channel: Admin

Message #

Update has been skipped as it required user interaction {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2008

Channel: Operational

Description

Update has been skipped as it required user interaction { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2009: Update has been skipped as it has an unaccepted EULA {UpdateTitle UpdateID}.

Channel: Admin

Message #

Update has been skipped as it has an unaccepted EULA {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2009

Channel: Operational

Description

Update has been skipped as it has an unaccepted EULA { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2010: Ignoring WUA warning Message HRESULT.

Channel: Admin

Message #

Ignoring WUA warning %1 %2

Fields #

Name	Description
`Message` UnicodeString
`HRESULT` UInt32

Event ID 2010

Channel: Operational

Description

Ignoring WUA warning.

Fields #

Name	Description
`Message` UnicodeString
`HRESULT` UInt32

Event ID 2011: ObjectName for orchestrator ClientKey has timed out.

Channel: Admin

Description

ObjectName for orchestrator ClientKey has timed out. Last access time: LastAccessTime.

Message #

%1 for orchestrator %2 has timed out. Last access time: %3

Fields #

Name	Description
`ObjectName` UnicodeString
`ClientKey` GUID
`LastAccessTime` FILETIME

Event ID 2011

Channel: Operational

Description

for orchestrator has timed out. Last access time.

Fields #

Name	Description
`ObjectName` UnicodeString
`ClientKey` GUID
`LastAccessTime` FILETIME

Event ID 2012: Orchestrator ClientKey reconnected to WMI provider.

Channel: Admin

Message #

Orchestrator %1 reconnected to WMI provider

Fields #

Name	Description
`ClientKey` GUID

Event ID 2012

Channel: Operational

Description

Orchestrator reconnected to WMI provider.

Fields #

Name	Description
`ClientKey` GUID

Event ID 2013: Failed to store report with identifier ReportId with HRESULT HRESULT.

Channel: Admin

Message #

Failed to store report with identifier %1 with HRESULT %2

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2013

Channel: Operational

Description

Failed to store report with identifier with HRESULT.

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2014: Activity Transfer event

Channel: Admin

Event ID 2014

Channel: Operational

Description

Activity Transfer event.

Event ID 2015: Failed to retrieve report with identifier ReportId with HRESULT HRESULT.

Channel: Admin

Message #

Failed to retrieve report with identifier %1 with HRESULT %2

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2015

Channel: Operational

Description

Failed to retrieve report with identifier with HRESULT.

Fields #

Name	Description
`ReportId` UnicodeString
`HRESULT` UInt32

Event ID 2016: An instance of ObjectName already exists with Guid ExistingGuid.

Channel: Admin

Description

An instance of ObjectName already exists with Guid ExistingGuid. Failed to create an instance with Guid NewGuid.

Message #

An instance of %1 already exists with Guid %2. Failed to create an instance with Guid %3

Fields #

Name	Description
`ObjectName` UnicodeString
`ExistingGuid` GUID
`NewGuid` GUID

Event ID 2016

Channel: Operational

Description

An instance of already exists with Guid . Failed to create an instance with Guid.

Fields #

Name	Description
`ObjectName` UnicodeString
`ExistingGuid` GUID
`NewGuid` GUID

Event ID 2017: Skipped an optional update {UpdateTitle UpdateID}.

Channel: Admin

Message #

Skipped an optional update {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2017

Channel: Operational

Description

Skipped an optional update { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2018: Update has been skipped as it is not an important update {UpdateTitle UpdateID}.

Channel: Admin

Message #

Update has been skipped as it is not an important update {%1 %2}

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2018

Channel: Operational

Description

Update has been skipped as it is not an important update { }.

Fields #

Name	Description
`UpdateTitle` UnicodeString
`UpdateID` UnicodeString

Event ID 2021: Failed to start the hotfix installer.

Channel: Admin

Description

Failed to start the hotfix installer. Installer path: InstallPath. Parameters: Parameters. Update path: UpdatePath. HRESULT HRESULT, exit code: ExitCode.

Message #

Failed to start the hotfix installer. Installer path: %1. Parameters: %2. Update path: %3. HRESULT %4, exit code: %5.

Fields #

Name	Description
`InstallPath` UnicodeString
`Parameters` UnicodeString
`UpdatePath` UnicodeString
`HRESULT` UInt32
`ExitCode` Int32

Event ID 2021

Channel: Operational

Description

Failed to start the hotfix installer. Installer path: . Parameters: . Update path: . HRESULT , exit code: .

Fields #

Name	Description
`InstallPath` UnicodeString
`Parameters` UnicodeString
`UpdatePath` UnicodeString
`HRESULT` UInt32
`ExitCode` Int32

Provenance

ETW provider GUID 10629806-46f2-4366-9092-53025e067e8c

Defined in cauwmiv2.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB