Microsoft-Windows-DeviceSetupManager

Event	Title	Channel	Sample	Rule
10	DSM service feature Prop_FeatureId is Prop_FeatureEnablement.	Admin	Y	N
11	DSM service is idle and waiting for Prop_IdleWait.	Admin	Y	N
20	DSM service is running in special OOBE based on OS product policy.	Admin	N	N
21	Auto download settings have been committed in OOBE: Store App Updates …	Admin	N	N
30	Device container Prop_ContainerId is queued for setup.	Admin	Y	N
40	Prop_ServerSelection search started.	Admin	N	N
41	Prop_ServerSelection search completed.	Admin	Y	N
42	Prop_ServerSelection search failed with error HRESULT.	Admin	Y	N
43	Driver update search is being cancelled.	Admin	N	N
44	Prop_ServerSelection search was cancelled.	Admin	N	N
50	Driver recovery on reboot task is Prop_TaskEnablement.	Admin	N	N
50	Driver recovery on reboot task is	Operational	N	N
51	Driver recovery action is requested since it was queued for the next reboot	Admin, Operational	N	N
52	Driver recovery request is received	Admin, Operational	N	N
100	DSM service started, mode is Prop_CoreServiceMode, last session (or boot) was …	Admin	Y	N
101	DSM Service is shutting down.	Admin	Y	N
102	DSM Service dll has loaded.	Debug	Y	N
103	DSM Service dll is unloading.	Debug	Y	N
104	DSM Service failed to start, result=HRESULT.	Admin	N	N
105	DSM Service is entering a retry sequence because soft (retryable) errors were …	Admin	Y	N
106	DSM Service is leaving the retry state, there have been Prop_RetryCycleCount …	Admin	Y	N
107	DSM service has shut down.	Admin	Y	N
108	DSM service has entered service state 'Prop_CoreServiceState'.	Debug	Y	N
109	DSM service has entered service mode 'Prop_CoreServiceMode'.	Admin	Y	N
110	Job (Prop_JobId) has started for device container 'Prop_ContainerId', …	Debug	Y	N
111	Job (Prop_JobId) has completed for device container 'Prop_ContainerId', …	Debug	Y	N
112	Device container 'Prop_DeviceName' (Prop_ContainerId) has been serviced, …	Admin	Y	N
120	Driver update(s) was downloaded for device 'Prop_PackageId' in Prop_MilliSeconds …	Admin	N	N
121	Driver update(s) install on device 'Prop_DevnodeId' failed with error HRESULT.	Admin	Y	N
122	Access to drivers on Windows Update was blocked by policy	Admin	N	N
123	DSM service was delayed by Prop_Seconds seconds for a driver …	Admin	Y	N
124	Driver Prop_PackageId was installed on device 'Prop_DeviceInstanceId' in …	Admin	N	N
125	Driver install on device 'Prop_DevnodeId' was blocked by PnP restriction policy.	Admin	N	N
126	Device 'Prop_DeviceInstanceId' matched driver update Prop_PackageId.	Admin	Y	N
127	Device 'Prop_DevnodeId' does not match any driver updates that are not optional.	Admin	Y	N
130	Metadata package Prop_MetadataPackageId was staged for device container …	Admin	N	N
131	Metadata package staging for device container Prop_ContainerId failed with error …	Admin	Y	N
132	Metadata package search for device container Prop_ContainerId on Windows …	Admin	N	N
133	Metadata package Prop_PackageId download for device container Prop_ContainerId …	Admin	N	N
134	Metadata package search for device container Prop_ContainerId completed.	Admin	N	N
135	Metadata package search for device container Prop_ContainerId completed.	Admin	N	N
136	Metadata package Prop_PackageId was blocked.	Admin	N	N
137	Signature verification failed for metadata package Prop_PackageId from metadata …	Admin	N	N
138	Metadata package Prop_PackageId was not fully staged due to signature …	Admin	N	N
150	Device 'Prop_DeviceName' (Prop_ContainerId) was removed.	Admin	N	N
151	Device 'Prop_DeviceName' (Prop_ContainerId) failed to respond to a device …	Admin	N	N
152	Device 'Prop_DeviceName' (Prop_ContainerId) removal failed with error HRESULT.	Admin	N	N
160	Software Prop_SoftwareName was installed for device 'Prop_DeviceInstanceId' in …	Admin	N	N
161	Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.	Admin	N	N
162	Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId.	Admin	N	N
163	Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId …	Admin	N	N
164	Software Prop_SoftwareName had non-critical error Prop_DeviceInstanceId during …	Admin	N	N
165	Software Prop_SoftwareName is being launched with command line: …	Admin	N	N
166	Device 'Prop_DeviceInstanceId' requested Store App for 'Prop_SoftwareLinks'.	Admin	N	N
167	Product for pfn IsFramework located: ProductId: Prop_ProductId, IsFramework: …	Admin	N	N
168	Uninstalling existing pfn Prop_SoftwarePfn failed with error ErrorCode.	Admin	N	N
169	Store product Prop_ProductId is already installed and is being checked for …	Admin	N	N
170	Store product Prop_ProductId is being installed.	Admin	N	N
171	ProductId Prop_ProductId done processing, install Prop_InstallType completed …	Admin	N	N
172	Store product Prop_ProductId install (Prop_InstallType) failed with error …	Admin	N	N
180	Retrieving entitlement for Store product Prop_ProductId failed with error …	Admin	N	N
190	Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) …	Admin	Y	N
191	Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) …	Admin	N	N
200	Connection to the Windows Update service could not be established.	Admin	Y	N
201	Connection to the Windows Metadata and Internet Services (WMIS) could not be …	Admin	Y	N
202	The Network List Manager reports no connectivity to the internet.	Admin	Y	N
203	The Network List Manager reports connection to the internet has been …	Admin	Y	N
220	Registered the handler Prop_NotificationHandler for the app Prop_PackageId to …	Operational	N	N
221	App Prop_PackageId already has a handler registered for the device container …	Debug	N	N
222	Device container Prop_ContainerId and app Prop_PackageId specify background task …	Debug	N	N
223	Unregistered for the Print background task after uninstalling the app …	Debug	N	N
224	Unregistered for the Mobile Operator background task after uninstalling the app …	Debug	N	N
230	Requested download of the app Prop_PackageId from the store for device …	Debug	N	N
231	Successfully installed the app Prop_PackageId from the store for device …	Debug	N	N
232	Encountered error trying to install app Prop_PackageId from the store for device …	Debug	N	N
233	Encountered error trying to install app Prop_PackageId from the store for device …	Debug	N	N
234	Driver update(s) was installed on device 'Prop_DevnodeId' in Prop_MilliSeconds …	Admin	Y	N
300	Device container 'Prop_ContainerId' has entered the ready state.	Operational	Y	N
301	Device setup for device container 'Prop_ContainerId' has been completed.	Operational	Y	N
302	Device metadata that contains an extension namespace has been parsed for device …	Operational	N	N
400	DeviceSetupTaskStart	Analytic	Y	N
401	DeviceSetupTaskStop	Analytic	Y	N
402	DownloadDriverTaskStart	Analytic	N	N
403	DownloadDriverTaskStop	Analytic	N	N
404	BuildDriverListTaskStart	Analytic	N	N
405	BuildDriverListTaskStop	Analytic	N	N
406	InstallDriverTaskStart	Analytic	N	N
407	InstallDriverTaskStop	Analytic	N	N
408	MetadataInstallTaskStart	Analytic	Y	N
409	MetadataInstallTaskStop	Analytic	Y	N
410	InstallDriverUpdateTaskStart	Analytic	N	N
411	InstallDriverUpdateTaskStop	Analytic	N	N
412	InstallSoftwareStart	Analytic	N	N
413	InstallSoftwareStop	Analytic	N	N
7710	ENTER: Searching WU for driver updates.	Analytic	N	N
7711	EXIT: Searching WU for driver updates.	Analytic	N	N
7712	ENTER: Downloading driver update from WU.	Analytic	N	N
7713	EXIT: Downloading driver update from WU.	Analytic	N	N
7714	ENTER: Installing driver update from WU.	Analytic	N	N
7715	EXIT: Installing driver update from WU.	Analytic	N	N

Event ID 10: DSM service feature Prop_FeatureId is Prop_FeatureEnablement.

Channel: Admin
Level: Informational

Message #

DSM service feature %1 is %2.

Fields #

Name	Description
`Prop_FeatureId` UInt32
`Prop_FeatureEnablement` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 10,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.6263943+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_FeatureEnablement": "1",
    "Prop_FeatureId": "21151629"
  }
}

Event ID 11: DSM service is idle and waiting for Prop_IdleWait.

Channel: Admin
Level: Informational

Message #

DSM service is idle and waiting for %1.

Fields #

Name	Description
`Prop_IdleWait` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 11,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.8270333+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_IdleWait": "2"
  }
}

Event ID 20: DSM service is running in special OOBE based on OS product policy.

Channel: Admin

Event ID 21: Auto download settings have been committed in OOBE: Store App Updates Prop_AppUpdatesEnablement, Windows Updates Prop_WindowsUpdatesEnablement.

Channel: Admin

Message #

Auto download settings have been committed in OOBE: Store App Updates %1, Windows Updates %2.

Fields #

Name	Description
`Prop_AppUpdatesEnablement` UInt8
`Prop_WindowsUpdatesEnablement` UInt8

Event ID 30: Device container Prop_ContainerId is queued for setup.

Channel: Admin
Level: Informational

Message #

Device container %1 is queued for setup.

Fields #

Name	Description
`Prop_ContainerId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 30,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.6276050+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}"
  }
}

Event ID 40: Prop_ServerSelection search started.

Channel: Admin

Message #

%1 search started.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Event ID 41: Prop_ServerSelection search completed.

Channel: Admin
Level: Informational

Message #

%1 search completed.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 41,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:50.0502672+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ServerSelection": "2"
  }
}

Event ID 42: Prop_ServerSelection search failed with error HRESULT.

Channel: Admin
Level: Error

Message #

%1 search failed with error %2.

Fields #

Name	Description
`Prop_ServerSelection` UInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 42,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:34:03.2098648+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ServerSelection": "2",
    "HRESULT": "0x8024001e"
  }
}

Event ID 43: Driver update search is being cancelled.

Channel: Admin

Event ID 44: Prop_ServerSelection search was cancelled.

Channel: Admin

Message #

%1 search was cancelled.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Event ID 50: Driver recovery on reboot task is Prop_TaskEnablement.

Channel: Admin

Message #

Driver recovery on reboot task is %1.

Fields #

Name	Description
`Prop_TaskEnablement` UInt8

Event ID 50: Driver recovery on reboot task is

Channel: Operational

Fields #

Name	Description
`Prop_TaskEnablement` UInt8

Event ID 51: Driver recovery action is requested since it was queued for the next reboot

Channel: Admin, Operational

Event ID 52: Driver recovery request is received

Channel: Admin, Operational

Description

Driver recovery request is received. Last trigger: Prop_DriverRecoveryRequest.

Message #

Driver recovery request is received. Last trigger: %1.

Fields #

Name	Description
`Prop_DriverRecoveryRequest` UInt32

Event ID 100: DSM service started, mode is Prop_CoreServiceMode, last session (or boot) was Prop_Event_Window_Seconds seconds ago.

Channel: Admin
Level: Informational

Message #

DSM service started, mode is %1, last session (or boot) was %2 seconds ago.

Fields #

Name	Description
`Prop_CoreServiceMode` UInt32
`Prop_Event_Window_Seconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:32.2295462+00:00",
    "event_record_id": 1101,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0005-E35D-82C688EFDC01}"
    },
    "execution": {
      "process_id": 2784,
      "thread_id": 5072
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_CoreServiceMode": "0",
    "Prop_Event_Window_Seconds": "8268"
  },
  "message": "DSM service start, mode is Normal, last session (or boot) was 8268 seconds ago"
}

Event ID 101: DSM Service is shutting down.

Channel: Admin
Level: Informational

Description

DSM Service is shutting down. Service uptime was Prop_UpTime_Seconds seconds, active worktime was Prop_WorkTime_MilliSeconds ms.

Message #

DSM Service is shutting down. Service uptime was %1 seconds, active worktime was %2 ms.

Fields #

Name	Description
`Prop_UpTime_Seconds` Int64
`Prop_WorkTime_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:40:18.6721418+00:00",
    "event_record_id": 1120,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0005-E35D-82C688EFDC01}"
    },
    "execution": {
      "process_id": 2784,
      "thread_id": 5072
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_UpTime_Seconds": "46",
    "Prop_WorkTime_MilliSeconds": "1250"
  },
  "message": "DSM Service shutting down. Service uptime was 46 seconds, active worktime was 1250 MilliSeconds."
}

Event ID 102: DSM Service dll has loaded.

Channel: Debug
Level: Informational

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 102,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 8836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:49.306Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 103: DSM Service dll is unloading.

Channel: Debug
Level: Informational

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 103,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11952,
      "thread_id": 6780
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 02:02:55.607Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 104: DSM Service failed to start, result=HRESULT.

Channel: Admin

Message #

DSM Service failed to start, result=%1.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 105: DSM Service is entering a retry sequence because soft (retryable) errors were encountered

Channel: Admin
Level: Informational

Fields #

Name	Description
`Prop_RetryCycleCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.7049233+00:00",
    "event_record_id": 1054,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "DSM Service is entering a retry sequence because soft (retryable) errors were encountered"
}

Event ID 106: DSM Service is leaving the retry state, there have been Prop_RetryCycleCount retry cycles in this session.

Channel: Admin
Level: Informational

Message #

DSM Service is leaving the retry state, there have been %1 retry cycles in this session.

Fields #

Name	Description
`Prop_RetryCycleCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:40.7418653+00:00",
    "event_record_id": 1095,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2700
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_RetryCycleCount": "3"
  },
  "message": "DSM Service is leaving the retry state, there have been 3 retry cycles in this session"
}

Event ID 107: DSM service has shut down.

Channel: Admin
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 107,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:46.8532558+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {}
}

Event ID 108: DSM service has entered service state 'Prop_CoreServiceState'.

Channel: Debug
Level: Informational

Message #

DSM service has entered service state '%1'.

Fields #

Name	Description
`Prop_CoreServiceState` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 108,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 8836
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:49.337Z",
    "version": 0
  },
  "event_data": {
    "Prop_CoreServiceState": 2
  },
  "message": ""
}

Event ID 109: DSM service has entered service mode 'Prop_CoreServiceMode'.

Channel: Admin
Level: Informational

Message #

DSM service has entered service mode '%1'.

Fields #

Name	Description
`Prop_CoreServiceMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T06:25:39.185383+00:00",
    "event_record_id": 70,
    "correlation": {},
    "execution": {
      "process_id": 1856,
      "thread_id": 2020
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_CoreServiceMode": 3
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 110: Job (Prop_JobId) has started for device container 'Prop_ContainerId', type=Prop_JobType.

Channel: Debug
Level: Informational

Message #

Job (%2) has started for device container '%1', type=%3.

Fields #

Name	Description
`Prop_ContainerId` GUID
`Prop_JobId` UInt32
`Prop_JobType` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 110,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 10524
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:49.354Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
    "Prop_JobId": 2,
    "Prop_JobType": 1
  },
  "message": ""
}

Event ID 111: Job (Prop_JobId) has completed for device container 'Prop_ContainerId', status=Prop_JobStatus.

Channel: Debug
Level: Informational

Message #

Job (%2) has completed for device container '%1', status=%3.

Fields #

Name	Description
`Prop_ContainerId` GUID
`Prop_JobId` UInt32
`Prop_JobStatus` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Debug",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 10524
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:49.355Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
    "Prop_JobId": 2,
    "Prop_JobStatus": 1
  },
  "message": ""
}

Event ID 112: Device container 'Prop_DeviceName' (Prop_ContainerId) has been serviced, processed Prop_TaskCount tasks, and wrote Prop_PropertyCount properties in Prop_WorkTime_MilliSeconds ms.

Channel: Admin
Level: Informational

Message #

Device container '%1' (%2) has been serviced, processed %3 tasks, and wrote %4 properties in %5 ms.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`Prop_TaskCount` Int32
`Prop_PropertyCount` Int32
`Prop_WorkTime_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:33.4935482+00:00",
    "event_record_id": 1119,
    "correlation": {},
    "execution": {
      "process_id": 2784,
      "thread_id": 6000
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DeviceName": "TELEMETRY-DC-A",
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}",
    "Prop_TaskCount": "5",
    "Prop_PropertyCount": "35",
    "Prop_WorkTime_MilliSeconds": "484"
  },
  "message": "Device 'TELEMETRY-DC-A' ({00000000-0000-0000-ffff-ffffffffffff}) has been serviced, processed 5 tasks, wrote 35 properties, active worktime was 484 milliseconds."
}

Event ID 120: Driver update(s) was downloaded for device 'Prop_PackageId' in Prop_MilliSeconds ms.

Channel: Admin

Message #

Driver update(s) was downloaded for device '%1' in %2 ms.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_MilliSeconds` Int64

Event ID 121: Driver update(s) install on device 'Prop_DevnodeId' failed with error HRESULT.

Channel: Admin
Level: Error

Message #

Driver update(s) install on device '%1' failed with error %2.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 121,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:34:03.2196267+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "HRESULT": "2149842974",
    "Prop_DevnodeId": "PCI\\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\\3&267a616a&0&10"
  }
}

Event ID 122: Access to drivers on Windows Update was blocked by policy

Channel: Admin

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 123: DSM service was delayed by Prop_Seconds seconds for a driver query/download/install on device 'Prop_DeviceId'.

Channel: Admin
Level: Warning

Message #

DSM service was delayed by %1 seconds for a driver query/download/install on device '%2'.

Fields #

Name	Description
`Prop_Seconds` Int32
`Prop_DeviceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 123,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:33.223885+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_Seconds": 36,
    "Prop_DeviceId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 124: Driver Prop_PackageId was installed on device 'Prop_DeviceInstanceId' in Prop_MilliSeconds ms.

Channel: Admin

Message #

Driver %1 was installed on device '%2' in %3 ms.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Prop_MilliSeconds` Int64

Event ID 125: Driver install on device 'Prop_DevnodeId' was blocked by PnP restriction policy.

Channel: Admin

Message #

Driver install on device '%1' was blocked by PnP restriction policy.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 126: Device 'Prop_DeviceInstanceId' matched driver update Prop_PackageId.

Channel: Admin
Level: Informational

Message #

Device '%1' matched driver update %2.

Fields #

Name	Description
`Prop_DeviceInstanceId` UnicodeString
`Prop_PackageId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:25.745333+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DeviceInstanceId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F",
    "Prop_PackageId": "b5857a80-fd07-4a9d-9adf-2a3a6db94b7e"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 127: Device 'Prop_DevnodeId' does not match any driver updates that are not optional.

Channel: Admin
Level: Informational

Message #

Device '%1' does not match any driver updates that are not optional.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 127,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:50.0714514+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_DevnodeId": "USB\\VID_0627&PID_0001\\28754-0000:00:01.2-1"
  }
}

Event ID 130: Metadata package Prop_MetadataPackageId was staged for device container Prop_ContainerId in Prop_StageTimeMilliSeconds ms.

Channel: Admin

Message #

Metadata package %1 was staged for device container %2 in %3 ms.

Fields #

Name	Description
`Prop_MetadataPackageId` UnicodeString
`Prop_ContainerId` GUID
`Prop_StageTimeMilliSeconds` Int64

Event ID 131: Metadata package staging for device container Prop_ContainerId failed with error HRESULT.

Channel: Admin
Level: Error

Message #

Metadata package staging for device container %1 failed with error %2.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`HRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 131,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:33.4920181+00:00",
    "event_record_id": 1118,
    "correlation": {},
    "execution": {
      "process_id": 2784,
      "thread_id": 6000
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
    "HRESULT": "2147943568"
  },
  "message": "Metadata staging failed, result=0x80070490 for container '{00000000-0000-0000-FFFF-FFFFFFFFFFFF}'"
}

Event ID 132: Metadata package search for device container Prop_ContainerId on Windows Metadata and Internet Services (WMIS) failed with error HRESULT, HTTP status code: HTTPCode.

Channel: Admin

Message #

Metadata package search for device container %1 on Windows Metadata and Internet Services (WMIS) failed with error %2, HTTP status code: %3.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`HRESULT` HexInt32
`HTTPCode` UInt32

Event ID 133: Metadata package Prop_PackageId download for device container Prop_ContainerId failed with error HRESULT.

Channel: Admin

Message #

Metadata package %1 download for device container %2 failed with error %3.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_ContainerId` UnicodeString
`HRESULT` HexInt32

Event ID 134: Metadata package search for device container Prop_ContainerId completed.

Channel: Admin

Description

Metadata package search for device container Prop_ContainerId completed. Found package Prop_PackageId.

Message #

Metadata package search for device container %1 completed. Found package %2.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 135: Metadata package search for device container Prop_ContainerId completed.

Channel: Admin

Description

Metadata package search for device container Prop_ContainerId completed. No package is found.

Message #

Metadata package search for device container %1 completed. No package is found.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Event ID 136: Metadata package Prop_PackageId was blocked.

Channel: Admin

Message #

Metadata package %1 was blocked.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 137: Signature verification failed for metadata package Prop_PackageId from metadata store, error Error.

Channel: Admin

Message #

Signature verification failed for metadata package %1 from metadata store, error %2.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Error` HexInt32

Event ID 138: Metadata package Prop_PackageId was not fully staged due to signature verification: Prop_IsLegacySigCheckForFile1 for 'Prop_FileName1' had result HRESULT1, Prop_IsLegacySigCheckForFile2 for 'Prop_F...

Channel: Admin

Description

Metadata package Prop_PackageId was not fully staged due to signature verification: Prop_IsLegacySigCheckForFile1 for 'Prop_FileName1' had result HRESULT1, Prop_IsLegacySigCheckForFile2 for 'Prop_FileName2' had result HRESULT2.

Message #

Metadata package %1 was not fully staged due to signature verification: %2 for '%3' had result %4, %5 for '%6' had result %7.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_IsLegacySigCheckForFile1` UInt8
`Prop_FileName1` UnicodeString
`HRESULT1` HexInt32
`Prop_IsLegacySigCheckForFile2` UInt8
`Prop_FileName2` UnicodeString
`HRESULT2` HexInt32

Event ID 150: Device 'Prop_DeviceName' (Prop_ContainerId) was removed.

Channel: Admin

Message #

Device '%1' (%2) was removed.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID

Event ID 151: Device 'Prop_DeviceName' (Prop_ContainerId) failed to respond to a device removal request.

Channel: Admin

Message #

Device '%1' (%2) failed to respond to a device removal request.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID

Event ID 152: Device 'Prop_DeviceName' (Prop_ContainerId) removal failed with error HRESULT.

Channel: Admin

Message #

Device '%1' (%2) removal failed with error %3.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`HRESULT` HexInt32

Event ID 160: Software Prop_SoftwareName was installed for device 'Prop_DeviceInstanceId' in Prop_InstallTime ms.

Channel: Admin

Message #

Software %1 was installed for device '%2' in %3 ms.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Prop_InstallTime` UInt64

Event ID 161: Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.

Channel: Admin

Description

Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.Prop_LoHighPartNew.Prop_HiLowPartNew.Prop_LoLowPartNew'. Current Version: 'Prop_HiHighPartOld.Prop_LoHighPartOld.Prop_HiLowPartOld.Prop_LoLowPartOld'.

Message #

Software %1 was not newer, Version: '%2.%3.%4.%5'. Current Version: '%6.%7.%8.%9'.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_HiHighPartNew` UInt32
`Prop_LoHighPartNew` UInt32
`Prop_HiLowPartNew` UInt32
`Prop_LoLowPartNew` UInt32
`Prop_HiHighPartOld` UInt32
`Prop_LoHighPartOld` UInt32
`Prop_HiLowPartOld` UInt32
`Prop_LoLowPartOld` UInt32

Event ID 162: Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId.

Channel: Admin

Message #

Software %1 failed installation with error %2.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`HRESULT` HexInt32

Event ID 163: Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId and process exit code Error.

Channel: Admin

Message #

Software %1 failed installation with error %2 and process exit code %3.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Error` UInt32
`HRESULT` HexInt32

Event ID 164: Software Prop_SoftwareName had non-critical error Prop_DeviceInstanceId during installation, will retry later.

Channel: Admin

Message #

Software %1 had non-critical error %2 during installation, will retry later.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`HRESULT` HexInt32

Event ID 165: Software Prop_SoftwareName is being launched with command line: 'Prop_CommandLine'.

Channel: Admin

Message #

Software %1 is being launched with command line: '%2'.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_CommandLine` UnicodeString

Event ID 166: Device 'Prop_DeviceInstanceId' requested Store App for 'Prop_SoftwareLinks'.

Channel: Admin

Message #

Device '%1' requested Store App for '%2'.

Fields #

Name	Description
`Prop_DeviceInstanceId` UnicodeString
`Prop_SoftwareLinks` UnicodeString

Event ID 167: Product for pfn IsFramework located: ProductId: Prop_ProductId, IsFramework: Prop_SoftwarePfn.

Channel: Admin

Message #

Product for pfn %1 located: ProductId: %2, IsFramework: %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_SoftwarePfn` UnicodeString

Event ID 168: Uninstalling existing pfn Prop_SoftwarePfn failed with error ErrorCode.

Channel: Admin

Message #

Uninstalling existing pfn %1 failed with error %2.

Fields #

Name	Description
`Prop_SoftwarePfn` UnicodeString
`ErrorCode` UInt32

Event ID 169: Store product Prop_ProductId is already installed and is being checked for updates.

Channel: Admin

Message #

Store product %1 is already installed and is being checked for updates.

Fields #

Name	Description
`Prop_ProductId` UnicodeString

Event ID 170: Store product Prop_ProductId is being installed.

Channel: Admin

Message #

Store product %1 is being installed.

Fields #

Name	Description
`Prop_ProductId` UnicodeString

Event ID 171: ProductId Prop_ProductId done processing, install Prop_InstallType completed with error %3.

Channel: Admin

Message #

ProductId %1 done processing, install %2 completed with error %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_InstallType` UInt32

Event ID 172: Store product Prop_ProductId install (Prop_InstallType) failed with error HRESULT.

Channel: Admin

Message #

Store product %1 install (%2) failed with error %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_InstallType` UInt32
`HRESULT` HexInt32

Event ID 180: Retrieving entitlement for Store product Prop_ProductId failed with error ErrorCode.

Channel: Admin

Message #

Retrieving entitlement for Store product %1 failed with error %2.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`ErrorCode` UInt32

Event ID 190: Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) completed in Prop_MilliSeconds ms.

Channel: Admin
Level: Informational

Message #

Property heuristics for device container '%1' (%2) completed in %3 ms.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`Prop_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 190,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.7565201+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}",
    "Prop_MilliSeconds": "105",
    "Prop_DeviceName": "DESKTOP-FF3N5XK"
  }
}

Event ID 191: Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) failed with error HRESULT.

Channel: Admin

Message #

Property heuristics for device container '%1' (%2) failed with error %3.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`HRESULT` HexInt32
`Prop_MilliSeconds` Int64

Event ID 200: Connection to the Windows Update service could not be established.

Channel: Admin
Level: Warning

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 200,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:27.7532780+00:00",
    "event_record_id": 1082,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "A connection to the Windows Update service could not be established."
}

Event ID 201: Connection to the Windows Metadata and Internet Services (WMIS) could not be established.

Channel: Admin
Level: Warning

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.7042415+00:00",
    "event_record_id": 1051,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "A connection to the Windows Metadata and Internet Services (WMIS) could not be established."
}

Event ID 202: The Network List Manager reports no connectivity to the internet.

Channel: Admin
Level: Warning

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 202,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:27.7539308+00:00",
    "event_record_id": 1084,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Network List Manager reports no connectivity to the internet."
}

Event ID 203: The Network List Manager reports connection to the internet has been established.

Channel: Admin
Level: Informational

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 203,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:06.7383623+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {}
}

Event ID 220: Registered the handler Prop_NotificationHandler for the app Prop_PackageId to handle notifications from the device container Prop_ContainerId.

Channel: Operational

Message #

Registered the handler %3 for the app %2 to handle notifications from the device container %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString
`Prop_NotificationHandler` UnicodeString

Event ID 221: App Prop_PackageId already has a handler registered for the device container Prop_ContainerId.

Channel: Debug

Message #

App %2 already has a handler registered for the device container %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 222: Device container Prop_ContainerId and app Prop_PackageId specify background task information, but registration failed with error HRESULT.

Channel: Debug

Message #

Device container %1 and app %2 specify background task information, but registration failed with error %3.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString
`HRESULT` UInt32

Event ID 223: Unregistered for the Print background task after uninstalling the app Prop_PackageId.

Channel: Debug

Message #

Unregistered for the Print background task after uninstalling the app %1.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 224: Unregistered for the Mobile Operator background task after uninstalling the app Prop_PackageId.

Channel: Debug

Message #

Unregistered for the Mobile Operator background task after uninstalling the app %1.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 230: Requested download of the app Prop_PackageId from the store for device Prop_ContainerId.

Channel: Debug

Message #

Requested download of the app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 231: Successfully installed the app Prop_PackageId from the store for device Prop_ContainerId.

Channel: Debug

Message #

Successfully installed the app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 232: Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId.

Channel: Debug

Description

Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId. This operation will be retried when the device is reconnected or the user logs on again.

Message #

Encountered error trying to install app %2 from the store for device %1.  This operation will be retried when the device is reconnected or the user logs on again.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 233: Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId.

Channel: Debug

Message #

Encountered error trying to install app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 234: Driver update(s) was installed on device 'Prop_DevnodeId' in Prop_MilliSeconds ms.

Channel: Admin
Level: Informational

Message #

Driver update(s) was installed on device '%1' in %2 ms.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`Prop_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:33.223883+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DevnodeId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F",
    "Prop_MilliSeconds": 36967
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 300: Device container 'Prop_ContainerId' has entered the ready state.

Channel: Operational
Level: Informational
Opcode: DeviceUxReady

Message #

Device container '%1' has entered the ready state.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 10,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:50:55.529095+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 3156,
      "thread_id": 4092
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{FF3C9BFC-6A33-58E1-8CFA-A12CE4352D2F}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 301: Device setup for device container 'Prop_ContainerId' has been completed.

Channel: Operational
Level: Informational
Opcode: DeviceSetupComplete

Message #

Device setup for device container '%1' has been completed.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:30:42.666470+00:00",
    "event_record_id": 22,
    "correlation": {},
    "execution": {
      "process_id": 3256,
      "thread_id": 4616
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{1074B24D-B986-5A01-B420-B3D39C2F9286}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 302: Device metadata that contains an extension namespace has been parsed for device container 'Prop_ContainerId', ExtensionNamespace = 'Prop_ServiceInfoNamespace', Culture = 'Prop_CultureCode'.

Channel: Operational

Message #

Device metadata that contains an extension namespace has been parsed for device container '%1', ExtensionNamespace = '%2', Culture = '%3'.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_ServiceInfoNamespace` UnicodeString
`Prop_CultureCode` UnicodeString

Event ID 400: DeviceSetupTaskStart

Channel: Analytic
Level: Informational
Task: DeviceSetupTask
Opcode: Start

Fields #

Name	Description
`Prop_ContainerId` GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 400,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 8076
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:49.355Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}"
  },
  "message": ""
}

Event ID 401: DeviceSetupTaskStop

Channel: Analytic
Level: Informational
Task: DeviceSetupTask
Opcode: Stop

Fields #

Name	Description
`Prop_ContainerId` GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 401,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 8076
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:52.824Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}"
  },
  "message": ""
}

Event ID 402: DownloadDriverTaskStart

Channel: Analytic
Task: DownloadDriverTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 403: DownloadDriverTaskStop

Channel: Analytic
Task: DownloadDriverTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 404: BuildDriverListTaskStart

Channel: Analytic
Task: BuildDriverListTask
Opcode: Start

Fields #

Name	Description
`Prop_PackagePath` UnicodeString

Event ID 405: BuildDriverListTaskStop

Channel: Analytic
Task: BuildDriverListTask
Opcode: Stop

Fields #

Name	Description
`Prop_PackagePath` UnicodeString

Event ID 406: InstallDriverTaskStart

Channel: Analytic
Task: InstallDriverTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 407: InstallDriverTaskStop

Channel: Analytic
Task: InstallDriverTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 408: MetadataInstallTaskStart

Channel: Analytic
Level: Informational
Task: MetadataInstallTask
Opcode: Start

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 408,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 10524
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:50.724Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}"
  },
  "message": ""
}

Event ID 409: MetadataInstallTaskStop

Channel: Analytic
Level: Informational
Task: MetadataInstallTask
Opcode: Stop

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-DeviceSetupManager/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 409,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 5468,
      "thread_id": 10524
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:44:50.729Z",
    "version": 0
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}"
  },
  "message": ""
}

Event ID 410: InstallDriverUpdateTaskStart

Channel: Analytic
Task: InstallDriverUpdateTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 411: InstallDriverUpdateTaskStop

Channel: Analytic
Task: InstallDriverUpdateTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 412: InstallSoftwareStart

Channel: Analytic
Task: InstallSoftware
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 413: InstallSoftwareStop

Channel: Analytic
Task: InstallSoftware
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 7710: ENTER: Searching WU for driver updates.

Channel: Analytic
Task: SearchWindowsUpdate
Opcode: Start

Event ID 7711: EXIT: Searching WU for driver updates.

Channel: Analytic
Task: SearchWindowsUpdate
Opcode: Stop

Event ID 7712: ENTER: Downloading driver update from WU.

Channel: Analytic
Task: DownloadFromWindowsUpdate
Opcode: Start

Event ID 7713: EXIT: Downloading driver update from WU.

Channel: Analytic
Task: DownloadFromWindowsUpdate
Opcode: Stop

Event ID 7714: ENTER: Installing driver update from WU.

Channel: Analytic
Task: InstallFromWindowsUpdate
Opcode: Start

Event ID 7715: EXIT: Installing driver update from WU.

Channel: Analytic
Task: InstallFromWindowsUpdate
Opcode: Stop

Provenance

ETW provider GUID fcbb06bb-6a2a-46e3-abaa-246cb4e508b2

Defined in DeviceSetupManager.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB