detection.wiki

Microsoft-Windows-DesktopWindowManager-Diag

EventTitleChannelSampleRule
1DesktopWindowManager_DiagStatsDiagnosticNN
2DesktopWindowManager_DWMResponsivenessDiagnosticNN

Event ID 1: DesktopWindowManager_DiagStats

#
Channel
Diagnostic
Task
DesktopWindowManager_DiagStats

Fields #

NameDescription
PercentLessThan4 UInt32
PercentLessThan8 UInt32
PercentLessThan16 UInt32
PercentLessThan32 UInt32
PercentLessThan50 UInt32
PercentLessThan100 UInt32
PercentLessThan500 UInt32
PercentLessThan1000 UInt32
PercentLessThan2000 UInt32
PercentLessThan5000 UInt32
PercentLessThan10000 UInt32
PercentGreater10000 UInt32
PercentMissedFlips UInt32
FrameRateReductions UInt32
DiagEventsFired UInt32
PeakPercentSysMemUsed UInt32
PeakWindowCount UInt32
DiagFrames UInt32
DiagStatsDuration UInt32

Event ID 2: DesktopWindowManager_DWMResponsiveness

#
Channel
Diagnostic
Task
DesktopWindowManager_DWMResponsiveness

Fields #

NameDescription
Reason UInt32
Diagnosis UInt32

Provenance

ETW provider GUID 31f60101-3703-48ea-8143-451f8de779d2

Defined in dwmcore.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.2849, captured 2026-06-02 — Manifest XML pack, 1.9 MB