detection.wiki

Microsoft-Windows-DeviceConfidence

EventTitleChannelSampleRule
1000DisplayConsentPromptStartAnalyticNN
1001DisplayConsentPromptStopAnalyticNN
2000Failed getting active window for app package packageSid and capability name …AnalyticNN
2001Failed to show consent prompt for app package packageSid with error error.AnalyticNN
2002Failed to create consent window for app package packageSid with error error.AnalyticNN

Event ID 1000: DisplayConsentPromptStart

#
Channel
Analytic
Task
DisplayConsentPrompt
Opcode
Start

Event ID 1001: DisplayConsentPromptStop

#
Channel
Analytic
Task
DisplayConsentPrompt
Opcode
Stop

Event ID 2000: Failed getting active window for app package packageSid and capability name capabilityName.

#
Channel
Analytic

Message #

Failed getting active window for app package %1 and capability name %2

Fields #

NameDescription
packageSid UnicodeString
capabilityName UnicodeString

Event ID 2001: Failed to show consent prompt for app package packageSid with error error.

#
Channel
Analytic

Message #

Failed to show consent prompt for app package %1 with error %2

Fields #

NameDescription
packageSid UnicodeString
error UInt32

Event ID 2002: Failed to create consent window for app package packageSid with error error.

#
Channel
Analytic

Message #

Failed to create consent window for app package %1 with error %2

Fields #

NameDescription
packageSid UnicodeString
error UInt32

Provenance

ETW provider GUID 1d5990c1-ec62-49f0-9e37-1f4db12db41e

Defined in ConsentUX.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB