Microsoft-Windows-Deployment-Services-Diagnostics

147 events across 6 channels

Event	Title	Channel	Sample
4096	The following client booted from PXE.	Operational	N
4099	The Following Client started TFTP Download.	Operational	N
4100	The Following Client completed TFTP Download.	Operational	N
4101	The Following Client failed TFTP Download.	Admin	N
4101	Event ID 4101	Operational	N
4102	The following WDS Client has started.	Operational	N
4103	The following WDS Client has processed unattend mode.	Operational	N
4104	The following WDS Client has selected Image.	Operational	N
4105	The following WDS Client has started Image Transfer.	Operational	N
4106	The following WDS Client has ended Image Transfer.	Operational	N
4107	The following WDS Client has downgraded Image Transfer.	Operational	N
4108	The following WDS Client has started Image Apply.	Operational	N
4109	The following WDS Client has ended Image Apply.	Operational	N
4110	The following WDS Client has started Post Apply Actions.	Operational	N
4111	The following WDS Client has ended Post Apply Actions.	Operational	N
4112	The following WDS Client has ended.	Operational	N
4113	The following WDS Client has encountered Domain Join Error.	Admin	N
4113	Event ID 4113	Operational	N
4114	The following WDS Client has encountered Fatal Error.	Admin	N
4114	Event ID 4114	Operational	N
4115	The following WDS Client has this message.	Operational	N
4116	Namespace Registered.	Operational	N
4117	Namespace Unregistered.	Operational	N
4118	Multicast Session Started.	Operational	N
4119	Multicast Session Ended.	Operational	N
4120	Client joined Multicast Session.	Operational	N
4121	Client exited Multicast Session.	Operational	N
4122	Client forced out of Multicast Session.	Operational	N
4123	The following WDS Client has encountered an inaccessible driver package.	Operational	N
4124	The following WDS Client has started offline driver injection.	Operational	N
4125	The following WDS Client has ended offline driver injection.	Operational	N
4126	The following WDS Client has encountered a failure while performing offline …	Operational	N
4127	Ddp request received for the following client.	Operational	N
4128	Ddp request failed for the following client.	Operational	N
4129	Ddp request successfully completed for the following client.	Operational	N
4130	Client demoted to slower Multicast Session.	Operational	N
4131	The following WDS Client has selected Image.	Operational	N
4132	The following client attempted to boot from PXE but was ignored because it is …	Operational	N
16384	Event ID 16384	Operational	N
16384	[.	Verbose	N
16385	[.	Debug	N
16385	Event ID 16385	Operational	N
16386	[.	Debug	N
16386	Event ID 16386	Operational	N
16387	[.	Debug	N
16387	Event ID 16387	Operational	N
16388	[.	Debug	N
16388	Event ID 16388	Operational	N
16389	Event ID 16389	Operational	N
16389	[.	Verbose	N
16390	Event ID 16390	Operational	N
16390	[.	Packet	N
24576	Event ID 24576	Operational	N
24576	[.	Verbose	Y
24577	[.	Debug	N
24577	Event ID 24577	Operational	N
24578	[.	Debug	N
24578	Event ID 24578	Operational	N
24579	[.	Debug	N
24579	Event ID 24579	Operational	N
24580	[.	Debug	N
24580	Event ID 24580	Operational	N
24581	Event ID 24581	Operational	N
24581	[.	Verbose	N
24582	Event ID 24582	Operational	N
24582	[.	Packet	N
32768	Event ID 32768	Operational	N
32768	[.	Verbose	N
32769	[.	Debug	N
32769	Event ID 32769	Operational	N
32770	[.	Debug	N
32770	Event ID 32770	Operational	N
32771	[.	Debug	N
32771	Event ID 32771	Operational	N
32772	[.	Debug	N
32772	Event ID 32772	Operational	N
32773	Event ID 32773	Operational	N
32773	[.	Verbose	N
32774	Event ID 32774	Operational	N
32774	[.	Packet	N
36864	A device query was successfully processed (status StatusCode).	Metadata	N
36864	Event ID 36864	Operational	N
36865	A device query failed with status StatusCode.	Metadata	N
36865	Event ID 36865	Operational	N
36866	Provider [ProviderName] processed a device query with status StatusCode, …	Metadata	N
36866	Event ID 36866	Operational	N
36867	Provider [ProviderName] failed to process a device query with status StatusCode, …	Metadata	N
36867	Event ID 36867	Operational	N
40960	Provider [ProviderName] successfully added a device with status StatusCode.	Metadata	N
40960	Event ID 40960	Operational	N
40962	Provider [ProviderName] failed to add a device with status StatusCode.	Metadata	N
40962	Event ID 40962	Operational	N
40963	Provider [ProviderName] successfully deleted device [DeviceIdentifier]; status …	Metadata	N
40963	Event ID 40963	Operational	N
40964	Provider [ProviderName] failed to delete device [DeviceIdentifier]; status code …	Metadata	N
40964	Event ID 40964	Operational	N
40965	Provider [ProviderName] successfully modified a device with status code …	Metadata	N
40965	Event ID 40965	Operational	N
40966	Provider [ProviderName] failed to modify a device with status code StatusCode.	Metadata	N
40966	Event ID 40966	Operational	N
40967	Provider [ProviderName] successfully retrieved metadata for a device with status …	Metadata	N
40967	Event ID 40967	Operational	N
40968	Provider [ProviderName] failed to retrieve metadata for a device with status …	Metadata	N
40968	Event ID 40968	Operational	N
40969	The server successfully processed a request for available providers with status …	Metadata	N
40969	Event ID 40969	Operational	N
40970	The server failed to process a request for available providers with status code …	Metadata	N
40970	Event ID 40970	Operational	N
45056	The server processed a metadata match request.	Metadata	N
45056	Event ID 45056	Operational	N
45057	There was an attempt to overwrite an object's metadata which failed because the …	Metadata	N
45057	Event ID 45057	Operational	N
49152	The server successfully retrieved metadata for an object with status code …	Metadata	N
49152	Event ID 49152	Operational	N
49153	The server failed to retrieve metadata for an object with status code …	Metadata	N
49153	Event ID 49153	Operational	N
49154	The server successfully modified metadata for an object with status code …	Metadata	N
49154	Event ID 49154	Operational	N
49155	The server failed to modify metadata for an object with status code StatusCode.	Metadata	N
49155	Event ID 49155	Operational	N
49158	A new metadata object was successfully registered in the server with status code …	Metadata	N
49158	Event ID 49158	Operational	N
49159	The server failed to register a new metadata object with status code StatusCode.	Metadata	N
49159	Event ID 49159	Operational	N
49162	An object was successfully deleted with status code StatusCode.	Metadata	N
49162	Event ID 49162	Operational	N
49163	The server failed to delete an object with status code StatusCode.	Metadata	N
49163	Event ID 49163	Operational	N
49164	An object's parenting relationship was successfully modified with status code …	Metadata	N
49164	Event ID 49164	Operational	N
49165	The server failed to modify an object's parenting relationship with status code …	Metadata	N
49165	Event ID 49165	Operational	N
53248	WdsUtil.	Operational	N
53249	A WdsUtil.	Operational	N
53250	A WdsUtil.	Operational	N
57344	The following VHDX apply has started.	Operational	N
57345	The following VHDX apply has completed.	Operational	N
57346	The following VHDX apply has failed.	Operational	N
57347	The PXE server processed a request from a client of architecture Architecture.	Admin	N
57347	Event ID 57347	Operational	N
57348	A BufferType buffer was created for reading file FilePath.	Operational	N
57349	A BufferType buffer created for reading file FilePath was deleted.	Operational	N
57350	An endpoint was opened by provider Provider.	Operational	N
57351	An endpoint was closed by provider Provider.	Operational	N
57352	WdsCim was invoked with the following command line.	Operational	N
57353	A WdsCim method was successfully executed.	Operational	N
57354	A WdsCim method failed.	Operational	N

Event ID 4096: The following client booted from PXE.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following client booted from PXE.

Message #

The following client booted from PXE: 

Hardware Address: %1
IP: %2
Device ID: %3
ClientArchitecture: %4
Prestaged: %5

Fields #

Name	Description
`ClientHardwareAddress` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientPrestaged` Boolean

Event ID 4099: The Following Client started TFTP Download.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: TFTP_Download
Opcode: Start

Description

The Following Client started TFTP Download.

Message #

The Following Client started TFTP Download: 

Client IP: %1
Filename: %2
File Size: %3
Client Port: %4
Server Port: %5
Variable Window: %6

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4100: The Following Client completed TFTP Download.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: TFTP_Download
Opcode: Stop

Description

The Following Client completed TFTP Download.

Message #

The Following Client completed TFTP Download: 

Client IP: %1
Filename: %2
File Size: %3
Client Port: %4
Server Port: %5
Variable Window: %6

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4101: The Following Client failed TFTP Download.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Admin

Description

The Following Client failed TFTP Download.

Message #

The Following Client failed TFTP Download: 

Client IP: %1
Filename: %2
ErrorCode: %3
File Size: %4
Client Port: %5
Server Port: %6
Variable Window: %7

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4101

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The Following Client failed TFTP Download.

Fields #

Name	Description
`ClientIP` UnicodeString
`FileName` UnicodeString
`ErrorCode` UInt32
`FileSize` UInt64
`ClientPort` UInt16
`ServerPort` UInt16
`VariableWindow` Boolean

Event ID 4102: The following WDS Client has started.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_Session
Opcode: Start

Description

The following WDS Client has started.

Message #

The following WDS Client has started: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ClientVer: %6
WinPEVer: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientVersion` UnicodeString
`WinPEVersion` UnicodeString

Event ID 4103: The following WDS Client has processed unattend mode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has processed unattend mode.

Message #

The following WDS Client has processed unattend mode: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
UnattendMode: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`UnattendMode` Boolean

Event ID 4104: The following WDS Client has selected Image.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has selected Image.

Message #

The following WDS Client has selected Image: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
FullUserName: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`FullUserName` UnicodeString

Event ID 4105: The following WDS Client has started Image Transfer.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_ImageTransfer
Opcode: Start

Description

The following WDS Client has started Image Transfer.

Message #

The following WDS Client has started Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4106: The following WDS Client has ended Image Transfer.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_ImageTransfer
Opcode: Stop

Description

The following WDS Client has ended Image Transfer.

Message #

The following WDS Client has ended Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4107: The following WDS Client has downgraded Image Transfer.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has downgraded Image Transfer.

Message #

The following WDS Client has downgraded Image Transfer: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
MulticastNamespace: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`MulticastNamespace` UnicodeString

Event ID 4108: The following WDS Client has started Image Apply.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_ImageApply
Opcode: Start

Description

The following WDS Client has started Image Apply.

Message #

The following WDS Client has started Image Apply: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString

Event ID 4109: The following WDS Client has ended Image Apply.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_ImageApply
Opcode: Stop

Description

The following WDS Client has ended Image Apply.

Message #

The following WDS Client has ended Image Apply: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

ImageGroup: %6
ImageName: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString

Event ID 4110: The following WDS Client has started Post Apply Actions.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_PostApplyActions
Opcode: Start

Description

The following WDS Client has started Post Apply Actions.

Message #

The following WDS Client has started Post Apply Actions: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4111: The following WDS Client has ended Post Apply Actions.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_PostApplyActions
Opcode: Stop

Description

The following WDS Client has ended Post Apply Actions.

Message #

The following WDS Client has ended Post Apply Actions: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4112: The following WDS Client has ended.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_Session
Opcode: Stop

Description

The following WDS Client has ended.

Message #

The following WDS Client has ended: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4113: The following WDS Client has encountered Domain Join Error.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Admin

Description

The following WDS Client has encountered Domain Join Error.

Message #

The following WDS Client has encountered Domain Join Error: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
MachineName: %6
MachineOU: %7
ErrorCode: %8

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`MachineName` UnicodeString
`MachineOU` UnicodeString
`ErrorCode` HexInt32

Event ID 4113

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has encountered Domain Join Error.

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`MachineName` UnicodeString
`MachineOU` UnicodeString
`ErrorCode` HexInt32

Event ID 4114: The following WDS Client has encountered Fatal Error.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Admin

Description

The following WDS Client has encountered Fatal Error.

Message #

The following WDS Client has encountered Fatal Error: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ErrorMessage: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ErrorMessage` UnicodeString

Event ID 4114

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has encountered Fatal Error.

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ErrorMessage` UnicodeString

Event ID 4115: The following WDS Client has this message.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has this message.

Message #

The following WDS Client has this message: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
Message: %6

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`Message` UnicodeString

Event ID 4116: Namespace Registered.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Namespace Registered.

Message #

Namespace Registered: 

NamespaceName: %1
ContentProvider: %2
NamespaceType: %3

Fields #

Name	Description
`NamespaceName` UnicodeString
`ContenProvider` UnicodeString
`MulticastType` UInt32

Event ID 4117: Namespace Unregistered.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Namespace Unregistered.

Message #

Namespace Unregistered: 

NamespaceName: %1
ContentProvider: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ContenProvider` UnicodeString

Event ID 4118: Multicast Session Started.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Multicast_Session
Opcode: Start

Description

Multicast Session Started.

Message #

Multicast Session Started: 

NamespaceName: %1
ObjectName: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4119: Multicast Session Ended.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Multicast_Session
Opcode: Stop

Description

Multicast Session Ended.

Message #

Multicast Session Ended: 

NamespaceName: %1
ObjectName: %2

Fields #

Name	Description
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4120: Client joined Multicast Session.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Multicast_ClientSession
Opcode: Start

Description

Client joined Multicast Session.

Message #

Client joined Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4121: Client exited Multicast Session.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Multicast_ClientSession
Opcode: Stop

Description

Client exited Multicast Session.

Message #

Client exited Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4122: Client forced out of Multicast Session.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Client forced out of Multicast Session.

Message #

Client forced out of Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4
Reason: %5

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString
`Reason` UInt32

Event ID 4123: The following WDS Client has encountered an inaccessible driver package.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has encountered an inaccessible driver package.

Message #

The following WDS Client has encountered an inaccessible driver package: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
DriverPackage: %6
ErrorCode: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`DriverPackageName` UnicodeString
`ErrorCode` UInt32

Event ID 4124: The following WDS Client has started offline driver injection.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_OfflineDriverInjection
Opcode: Start

Description

The following WDS Client has started offline driver injection.

Message #

The following WDS Client has started offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4125: The following WDS Client has ended offline driver injection.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WDSClient_OfflineDriverInjection
Opcode: Stop

Description

The following WDS Client has ended offline driver injection.

Message #

The following WDS Client has ended offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32

Event ID 4126: The following WDS Client has encountered a failure while performing offline driver injection.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has encountered a failure while performing offline driver injection.

Message #

The following WDS Client has encountered a failure while performing offline driver injection: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
DriverPackage: %6
ErrorCode: %7

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`DriverPackageName` UnicodeString
`ErrorCode` UInt32

Event ID 4127: Ddp request received for the following client.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Ddp_Request
Opcode: Start

Description

Ddp request received for the following client.

Message #

Ddp request received for the following client: 

MAC: %1
IP: %2

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString

Event ID 4128: Ddp request failed for the following client.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Ddp request failed for the following client.

Message #

Ddp request failed for the following client: 

MAC: %1
IP: %2
ErrorCode: %3

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ErrorCode` UInt32

Event ID 4129: Ddp request successfully completed for the following client.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: Ddp_Request
Opcode: Stop

Description

Ddp request successfully completed for the following client.

Message #

Ddp request successfully completed for the following client: 

MAC: %1
IP: %2
NumDriverPackages: %3

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NumDriverPackages` UInt32

Event ID 4130: Client demoted to slower Multicast Session.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Client demoted to slower Multicast Session.

Message #

Client demoted to slower Multicast Session: 

ClientMAC: %1
ClientIP: %2
NamespaceName: %3
ObjectName: %4

Fields #

Name	Description
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`NamespaceName` UnicodeString
`ObjectName` UnicodeString

Event ID 4131: The following WDS Client has selected Image.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following WDS Client has selected Image.

Message #

The following WDS Client has selected Image: 

SessionGuid: %1
MAC: %2
IP: %3
ClientDeviceID: %4
ClientArchitecture: %5
ImageGroup: %6
ImageName: %7
ImageLanguage: %8
ImageArchitecture: %10
FullUserName: %9

Fields #

Name	Description
`SessionGUID` GUID
`ClientMAC` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ImageGroup` UnicodeString
`ImageName` UnicodeString
`ImageLanguage` UnicodeString
`FullUserName` UnicodeString
`ImageArch` UInt32

Event ID 4132: The following client attempted to boot from PXE but was ignored because it is not recognized.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following client attempted to boot from PXE but was ignored because it is not recognized.

Message #

The following client attempted to boot from PXE but was ignored because it is not recognized: 

Hardware Address: %1
IP: %2
Device ID: %3
ClientArchitecture: %4
Prestaged: %5

Fields #

Name	Description
`ClientHardwareAddress` UnicodeString
`ClientIP` UnicodeString
`ClientDeviceID` UnicodeString
`ClientArch` UInt32
`ClientPrestaged` Boolean

Event ID 16384

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16384: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16385: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16385

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16386: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16386

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16387: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16387

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16388: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16388

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16389

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16389: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16390

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 16390: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Packet

Message #

[%1] %3

Fields #

Name	Description
`Component` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24576

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24576: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose
Level: Verbose

Message #

[%1/%2] %4

Fields #

Name	Description
`WDSProviderTraceEvent.Component` UnicodeString
`WDSProviderTraceEvent.Provider` UnicodeString
`WDSProviderTraceEvent.Severity` UInt32
`WDSProviderTraceEvent.Message` UnicodeString
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Deployment-Services-Diagnostics",
    "guid": "{22B7D623-566B-47B6-9BA0-BC9DA3C9D646}",
    "event_source_name": "",
    "event_id": 24576,
    "version": 0,
    "level": 5,
    "task": 0,
    "opcode": 0,
    "keywords": 2305843009213694016,
    "time_created": "2026-06-13T14:23:44.0396634+00:00",
    "event_record_id": 6,
    "correlation": {},
    "execution": {
      "process_id": 6148,
      "thread_id": 3204
    },
    "channel": "Microsoft-Windows-Deployment-Services-Diagnostics/Verbose",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "WDSProviderTraceEvent": {
      "Component": "WDSServer",
      "Provider": "WDSMC",
      "Severity": "65536",
      "Message": "<- CContentProvidersHandler::Shutdown=0"
    }
  },
  "message": "[WDSServer/WDSMC] <- CContentProvidersHandler::Shutdown=0"
}

Event ID 24577: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24577

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24578: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24578

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24579: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24579

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24580: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24580

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24581

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24581: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24582

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 24582: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Packet

Message #

[%1/%2] %4

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32768

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32768: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32769: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32769

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32770: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32770

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32771: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32771

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32772: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Debug

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32772

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32773

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32773: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Verbose

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32774

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 32774: [.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Packet

Message #

[%1/%2/%3] %5

Fields #

Name	Description
`Component` UnicodeString
`Provider` UnicodeString
`SubProvider` UnicodeString
`Severity` UInt32
`Message` UnicodeString

Event ID 36864: A device query was successfully processed (status StatusCode).

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

A device query was successfully processed (status StatusCode).

Message #

A device query was successfully processed (status %3):

Input:
%1

Output:
%2

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36864

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A device query was successfully processed (status ).

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36865: A device query failed with status StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

A device query failed with status StatusCode.

Message #

A device query failed with status %3:

Input:
%1

Output:
%2

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36865

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A device query failed with status.

Fields #

Name	Description
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36866: Provider [ProviderName] processed a device query with status StatusCode, response type ResponseType.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] processed a device query with status StatusCode, response type ResponseType.

Message #

Provider [%1] processed a device query with status %5, response type %4:

Input:
%2

Output:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36866

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] processed a device query with status , response type.

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36867: Provider [ProviderName] failed to process a device query with status StatusCode, response type ResponseType.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] failed to process a device query with status StatusCode, response type ResponseType.

Message #

Provider [%1] failed to process a device query with status %5, response type %4:

Input:
%2

Output:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 36867

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] failed to process a device query with status , response type.

Fields #

Name	Description
`ProviderName` UnicodeString
`InputMetadata` UnicodeString
`OutputMetadata` UnicodeString
`ResponseType` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40960: Provider [ProviderName] successfully added a device with status StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] successfully added a device with status StatusCode.

Message #

Provider [%1] successfully added a device with status %5:

Device Name: %2

Initial Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40960

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] successfully added a device with status.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40962: Provider [ProviderName] failed to add a device with status StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] failed to add a device with status StatusCode.

Message #

Provider [%1] failed to add a device with status %5:

Device Name: %2

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40962

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] failed to add a device with status.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40963: Provider [ProviderName] successfully deleted device [DeviceIdentifier]; status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] successfully deleted device [DeviceIdentifier]; status code StatusCode.

Message #

Provider [%1] successfully deleted device [%2]; status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40963

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] successfully deleted device []; status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40964: Provider [ProviderName] failed to delete device [DeviceIdentifier]; status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] failed to delete device [DeviceIdentifier]; status code StatusCode.

Message #

Provider [%1] failed to delete device [%2]; status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40964

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] failed to delete device []; status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40965: Provider [ProviderName] successfully modified a device with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] successfully modified a device with status code StatusCode.

Message #

Provider [%1] successfully modified a device with status code %5:

Device Name: %2

New Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40965

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] successfully modified a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40966: Provider [ProviderName] failed to modify a device with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] failed to modify a device with status code StatusCode.

Message #

Provider [%1] failed to modify a device with status code %5:

Device Name: %2

New Metadata:
%3

Note that the device may or may not be modified with the New Metadata; this is at the discretion of the Provider.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40966

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] failed to modify a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40967: Provider [ProviderName] successfully retrieved metadata for a device with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] successfully retrieved metadata for a device with status code StatusCode.

Message #

Provider [%1] successfully retrieved metadata for a device with status code %5:

Device Name: %2

Metadata:
%3

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40967

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] successfully retrieved metadata for a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40968: Provider [ProviderName] failed to retrieve metadata for a device with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

Provider [ProviderName] failed to retrieve metadata for a device with status code StatusCode.

Message #

Provider [%1] failed to retrieve metadata for a device with status code %5:

Device Name: %2

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40968

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

Provider [] failed to retrieve metadata for a device with status code.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40969: The server successfully processed a request for available providers with status code StatusCode; Count providers available.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server successfully processed a request for available providers with status code StatusCode; Count providers available.

Message #

The server successfully processed a request for available providers with status code %5; %4 providers available.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40969

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server successfully processed a request for available providers with status code ; providers available.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40970: The server failed to process a request for available providers with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to process a request for available providers with status code StatusCode.

Message #

The server failed to process a request for available providers with status code %5.

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 40970

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to process a request for available providers with status code .

Fields #

Name	Description
`ProviderName` UnicodeString
`DeviceIdentifier` UnicodeString
`Metadata` UnicodeString
`Count` UInt32
`StatusCode` HexInt32	NTSTATUS reference

Event ID 45056: The server processed a metadata match request.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server processed a metadata match request.

Message #

The server processed a metadata match request:

Object ID: %1

Object Metadata:
%2

Request Metadata:
%3

Match Result: %4

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45056

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server processed a metadata match request.

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45057: There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Message #

There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Object ID: %1
5nObject Filter:
%2

Request Metadata:
%3

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 45057

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

There was an attempt to overwrite an object's metadata which failed because the request did not pass the internal filter for this object.

Fields #

Name	Description
`ObjectID` GUID
`ObjectMetadata` UnicodeString
`RequestMetadata` UnicodeString
`MatchResult` Boolean

Event ID 49152: The server successfully retrieved metadata for an object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server successfully retrieved metadata for an object with status code StatusCode.

Message #

The server successfully retrieved metadata for an object with status code %3:

Object ID: %1

Object Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49152

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server successfully retrieved metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49153: The server failed to retrieve metadata for an object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to retrieve metadata for an object with status code StatusCode.

Message #

The server failed to retrieve metadata for an object with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49153

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to retrieve metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49154: The server successfully modified metadata for an object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server successfully modified metadata for an object with status code StatusCode.

Message #

The server successfully modified metadata for an object with status code %3:

Object ID: %1

New Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49154

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server successfully modified metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49155: The server failed to modify metadata for an object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to modify metadata for an object with status code StatusCode.

Message #

The server failed to modify metadata for an object with status code %3:

Object ID: %1

New Metadata:
%2

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49155

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to modify metadata for an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49158: A new metadata object was successfully registered in the server with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

A new metadata object was successfully registered in the server with status code StatusCode.

Message #

A new metadata object was successfully registered in the server with status code %3:

Object ID: %1

Object Metadata:
%2

Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49158

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A new metadata object was successfully registered in the server with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49159: The server failed to register a new metadata object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to register a new metadata object with status code StatusCode.

Message #

The server failed to register a new metadata object with status code %3:

Object ID: %1

Object Metadata:
%2

Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49159

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to register a new metadata object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49162: An object was successfully deleted with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

An object was successfully deleted with status code StatusCode.

Message #

An object was successfully deleted with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49162

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

An object was successfully deleted with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49163: The server failed to delete an object with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to delete an object with status code StatusCode.

Message #

The server failed to delete an object with status code %3:

Object ID: %1

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49163

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to delete an object with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49164: An object's parenting relationship was successfully modified with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

An object's parenting relationship was successfully modified with status code StatusCode.

Message #

An object's parenting relationship was successfully modified with status code %3:

Object ID: %1

New Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49164

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

An object's parenting relationship was successfully modified with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49165: The server failed to modify an object's parenting relationship with status code StatusCode.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Metadata

Description

The server failed to modify an object's parenting relationship with status code StatusCode.

Message #

The server failed to modify an object's parenting relationship with status code %3:

Object ID: %1

New Parent: %4

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 49165

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The server failed to modify an object's parenting relationship with status code.

Fields #

Name	Description
`ObjectID` GUID
`Metadata` UnicodeString
`StatusCode` HexInt32	NTSTATUS reference
`ParentID` GUID

Event ID 53248: WdsUtil.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WdsUtil_Command
Opcode: Start

Description

WdsUtil.exe was run with the following command line.

Message #

WdsUtil.exe was run with the following command line:

%1

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 53249: A WdsUtil.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WdsUtil_Command
Opcode: Stop

Description

A WdsUtil.exe command was successfully executed.

Message #

A WdsUtil.exe command was successfully executed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 53250: A WdsUtil.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A WdsUtil.exe command failed.

Message #

A WdsUtil.exe command failed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57344: The following VHDX apply has started.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: VhdxApply
Opcode: Start

Description

The following VHDX apply has started.

Message #

The following VHDX apply has started: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57345: The following VHDX apply has completed.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: VhdxApply
Opcode: Stop

Description

The following VHDX apply has completed.

Message #

The following VHDX apply has completed: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57346: The following VHDX apply has failed.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

The following VHDX apply has failed.

Message #

The following VHDX apply has failed: 

SourceFile: %1
SourceFileSize: %2
SourceDiskSize: %3 bytes
DestinationPath: %4
DestinationDiskSize:%5 bytes

Fields #

Name	Description
`SourceFileName` UnicodeString
`SourceFileSize` UInt64
`SourceDiskSize` UInt64
`DestinationDiskPath` UnicodeString
`DestinationDiskSize` UInt64

Event ID 57347: The PXE server processed a request from a client of architecture Architecture.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Admin

Message #

The PXE server processed a request from a client of architecture %1.  However there were no boot images installed for this architecture.  PXE clients of this architecture will not be able to complete the boot process successfully.  To resolve this problem, add at least one boot image for this architecture.

Fields #

Name	Description
`Architecture` UnicodeString

Event ID 57347

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Fields #

Name	Description
`Architecture` UnicodeString

Event ID 57348: A BufferType buffer was created for reading file FilePath.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A BufferType buffer was created for reading file FilePath.

Message #

A %3 buffer was created for reading file %1.

Fields #

Name	Description
`FilePath` UnicodeString
`FileSize` UInt64
`BufferType` UInt32

Event ID 57349: A BufferType buffer created for reading file FilePath was deleted.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A BufferType buffer created for reading file FilePath was deleted.

Message #

A %3 buffer created for reading file %1 was deleted.

Fields #

Name	Description
`FilePath` UnicodeString
`FileSize` UInt64
`BufferType` UInt32

Event ID 57350: An endpoint was opened by provider Provider.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

An endpoint was opened by provider Provider.

Message #

An endpoint was opened by provider %2.

Type: %1
Address: %3

Fields #

Name	Description
`Type` UInt32
`Provider` UnicodeString
`Address` UnicodeString

Event ID 57351: An endpoint was closed by provider Provider.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

An endpoint was closed by provider Provider.

Message #

An endpoint was closed by provider %2.

Type: %1
Address: %3

Fields #

Name	Description
`Type` UInt32
`Provider` UnicodeString
`Address` UnicodeString

Event ID 57352: WdsCim was invoked with the following command line.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WdsCim_Command
Opcode: Start

Description

WdsCim was invoked with the following command line.

Message #

WdsCim was invoked with the following command line:

%1

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57353: A WdsCim method was successfully executed.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational
Task: WdsCim_Command
Opcode: Stop

Description

A WdsCim method was successfully executed.

Message #

A WdsCim method was successfully executed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Event ID 57354: A WdsCim method failed.

Provider: Microsoft-Windows-Deployment-Services-Diagnostics
Channel: Operational

Description

A WdsCim method failed.

Message #

A WdsCim method failed.

Command Line: %1

Status Code: %2

Fields #

Name	Description
`CommandLine` UnicodeString
`ReturnCode` HexInt32

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 22b7d623-566b-47b6-9ba0-bc9da3c9d646

Defined in WdsDiag.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-Deployment-Services-Diagnostics registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)