Microsoft-Windows-CmiSetup
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | CMI Configuration Started | Analytic | N | N |
| 1002 | CMI Configuration completed with status ErrorCode. | Analytic | N | N |
| 2001 | Executing CMI changes. | Analytic | N | N |
| 2002 | CMI changes completed with status ErrorCode. | Analytic | N | N |
| 3001 | Performing CBS Online Install. | Analytic | N | N |
| 3002 | CBS Online Install completed with status ErrorCode. | Analytic | N | N |
Event ID 1001: CMI Configuration Started
#Event ID 1002: CMI Configuration completed with status ErrorCode.
#Event ID 2001: Executing CMI changes.
#Event ID 2002: CMI changes completed with status ErrorCode.
#Event ID 3001: Performing CBS Online Install.
#Provenance
ETW provider GUID 75ebc33e-0cc6-49da-8cd9-8903a5222aa0
Defined in CmiSetup.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB