Microsoft-Windows-DesktopActivityModerator

Event	Title	Channel	Sample	Rule
1	StartDriverStart	Diagnostic	N	N
4	StartDriver	Diagnostic	N	N
9	StartDriverStop	Diagnostic	N	N
11	StopDriverStart	Diagnostic	N	N
19	StopDriverStop	Diagnostic	N	N
21	SuspendResumeStart	Diagnostic	N	N
22	SuspendResumeStop	Diagnostic	N	N
23	ThrottleStart	Diagnostic	N	N
24	ThrottleStop	Diagnostic	N	N
25	ResiliencyEngageStart	Diagnostic	N	N
26	ResiliencyEngageStop	Diagnostic	N	N
31	ProcessActivityStart	Diagnostic	N	N
32	ProcessActivityStop	Diagnostic	N	N
41	ProcessExempt	Diagnostic	N	N
42	PolicyReload	Diagnostic	N	N
51	PdcCallback	Diagnostic	N	N
52	PdcCallback52	Diagnostic	N	N
53	PdcCallback53	Diagnostic	N	N
54	PdcAcknowledge	Diagnostic	N	N
60	IoTrackingPerfTrack	Diagnostic	N	N
61	IoTrackingCallback	Diagnostic	N	N

Event ID 1: StartDriverStart

Channel: Diagnostic
Task: StartDriver
Opcode: Start

Event ID 4: StartDriver

Channel: Diagnostic
Task: StartDriver

Event ID 9: StartDriverStop

Channel: Diagnostic
Task: StartDriver
Opcode: Stop

Fields #

Name	Description
`NTSTATUS` UInt32

Event ID 11: StopDriverStart

Channel: Diagnostic
Task: StopDriver
Opcode: Start

Event ID 19: StopDriverStop

Channel: Diagnostic
Task: StopDriver
Opcode: Stop

Event ID 21: SuspendResumeStart

Channel: Diagnostic
Task: SuspendResume
Opcode: Start

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 22: SuspendResumeStop

Channel: Diagnostic
Task: SuspendResume
Opcode: Stop

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 23: ThrottleStart

Channel: Diagnostic
Task: Throttle
Opcode: Start

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 24: ThrottleStop

Channel: Diagnostic
Task: Throttle
Opcode: Stop

Fields #

Name	Description
`SuspendFlag` Boolean

Event ID 25: ResiliencyEngageStart

Channel: Diagnostic
Task: ResiliencyEngage
Opcode: Start

Fields #

Name	Description
`ActiveFlag` Boolean

Event ID 26: ResiliencyEngageStop

Channel: Diagnostic
Task: ResiliencyEngage
Opcode: Stop

Fields #

Name	Description
`ActiveFlag` Boolean

Event ID 31: ProcessActivityStart

Channel: Diagnostic
Task: ProcessActivity
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32
`ImageFileNameLength` UInt16
`ImageFileName` UnicodeString
`CommandLineLength` UInt16
`CommandLine` UnicodeString

Event ID 32: ProcessActivityStop

Channel: Diagnostic
Task: ProcessActivity
Opcode: Stop

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32

Event ID 41: ProcessExempt

Channel: Diagnostic
Task: ProcessExempt

Fields #

Name	Description
`ProcessId` UInt32
`SessionId` UInt32
`ExemptGroup` UInt32
`RegisterAtLaunch` Boolean

Event ID 42: PolicyReload

Channel: Diagnostic
Task: PolicyReload

Fields #

Name	Description
`PolicyRecords` UInt32

Event ID 51: PdcCallback

Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`State` UInt32
`NTSTATUS` UInt32
`WorkItemQueued` Boolean

Event ID 52: PdcCallback52

Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`ClientState` UInt32

Event ID 53: PdcCallback53

Channel: Diagnostic
Task: PdcCallback

Fields #

Name	Description
`Flags` UInt32

Event ID 54: PdcAcknowledge

Channel: Diagnostic
Task: PdcAcknowledge

Event ID 60: IoTrackingPerfTrack

Channel: Diagnostic
Task: IoTrackingPerfTrack
Opcode: Info

Fields #

Name	Description
`DeviceBucket` UInt32
`ElapsedTimeMs` UInt32
`FastIoCount` UInt32
`SlowIoCount` UInt32

Event ID 61: IoTrackingCallback

Channel: Diagnostic
Task: IoTrackingCallback
Opcode: Info

Fields #

Name	Description
`DeviceType` UInt16
`DeviceBucket` UInt32
`ElapsedTime` UInt64
`SlowIo` Boolean

Provenance

ETW provider GUID 32dd13df-9c0b-4c3b-b854-ee76c050f5f4

Defined in dam.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB