Microsoft-Windows-DeviceSetupManager

102 events across 4 channels

Event	Title	Channel	Sample
10	DSM service feature Prop_FeatureId is Prop_FeatureEnablement.	Admin	Y
11	DSM service is idle and waiting for Prop_IdleWait.	Admin	Y
20	DSM service is running in special OOBE based on OS product policy.	Admin	N
21	Auto download settings have been committed in OOBE: Store App Updates …	Admin	N
30	Device container Prop_ContainerId is queued for setup.	Admin	Y
40	Prop_ServerSelection search started.	Admin	N
41	Prop_ServerSelection search completed.	Admin	Y
42	Prop_ServerSelection search failed with error HRESULT.	Admin	Y
43	Driver update search is being cancelled.	Admin	N
44	Prop_ServerSelection search was cancelled.	Admin	N
50	Driver recovery on reboot task is Prop_TaskEnablement.	Admin	N
50	Driver recovery on reboot task is	Operational	N
51	Driver recovery action is requested since it was queued for the next reboot.	Admin	N
51	Driver recovery action is requested since it was queued for the next reboot	Operational	N
52	Driver recovery request is received.	Admin	N
52	Driver recovery request is received	Operational	N
100	DSM service started, mode is Prop_CoreServiceMode, last session (or boot) was …	Admin	Y
101	DSM Service is shutting down.	Admin	Y
102	DSM Service dll has loaded.	Debug	N
103	DSM Service dll is unloading.	Debug	N
104	DSM Service failed to start, result=HRESULT.	Admin	N
105	DSM Service is entering a retry sequence because soft (retryable) errors were …	Admin	Y
106	DSM Service is leaving the retry state, there have been Prop_RetryCycleCount …	Admin	Y
107	DSM service has shut down.	Admin	Y
108	DSM service has entered service state 'Prop_CoreServiceState'.	Debug	N
109	DSM service has entered service mode 'Prop_CoreServiceMode'.	Admin	Y
110	Job (Prop_JobId) has started for device container 'Prop_ContainerId', …	Debug	N
111	Job (Prop_JobId) has completed for device container 'Prop_ContainerId', …	Debug	N
112	Device container 'Prop_DeviceName' (Prop_ContainerId) has been serviced, …	Admin	Y
120	Driver update(s) was downloaded for device 'Prop_PackageId' in Prop_MilliSeconds …	Admin	N
121	Driver update(s) install on device 'Prop_DevnodeId' failed with error HRESULT.	Admin	Y
122	Access to drivers on Windows Update was blocked by policy	Admin	N
123	DSM service was delayed by Prop_Seconds seconds for a driver …	Admin	Y
124	Driver Prop_PackageId was installed on device 'Prop_DeviceInstanceId' in …	Admin	N
125	Driver install on device 'Prop_DevnodeId' was blocked by PnP restriction policy.	Admin	N
126	Device 'Prop_DeviceInstanceId' matched driver update Prop_PackageId.	Admin	Y
127	Device 'Prop_DevnodeId' does not match any driver updates that are not optional.	Admin	Y
130	Metadata package Prop_MetadataPackageId was staged for device container …	Admin	N
131	Metadata package staging for device container Prop_ContainerId failed with error …	Admin	Y
132	Metadata package search for device container Prop_ContainerId on Windows …	Admin	N
133	Metadata package Prop_PackageId download for device container Prop_ContainerId …	Admin	N
134	Metadata package search for device container Prop_ContainerId completed.	Admin	N
135	Metadata package search for device container Prop_ContainerId completed.	Admin	N
136	Metadata package Prop_PackageId was blocked.	Admin	N
137	Signature verification failed for metadata package Prop_PackageId from metadata …	Admin	N
138	Metadata package Prop_PackageId was not fully staged due to signature …	Admin	N
150	Device 'Prop_DeviceName' (Prop_ContainerId) was removed.	Admin	N
151	Device 'Prop_DeviceName' (Prop_ContainerId) failed to respond to a device …	Admin	N
152	Device 'Prop_DeviceName' (Prop_ContainerId) removal failed with error HRESULT.	Admin	N
160	Software Prop_SoftwareName was installed for device 'Prop_DeviceInstanceId' in …	Admin	N
161	Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.	Admin	N
162	Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId.	Admin	N
163	Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId …	Admin	N
164	Software Prop_SoftwareName had non-critical error Prop_DeviceInstanceId during …	Admin	N
165	Software Prop_SoftwareName is being launched with command line: …	Admin	N
166	Device 'Prop_DeviceInstanceId' requested Store App for 'Prop_SoftwareLinks'.	Admin	N
167	Product for pfn IsFramework located: ProductId: Prop_ProductId, IsFramework: …	Admin	N
168	Uninstalling existing pfn Prop_SoftwarePfn failed with error ErrorCode.	Admin	N
169	Store product Prop_ProductId is already installed and is being checked for …	Admin	N
170	Store product Prop_ProductId is being installed.	Admin	N
171	ProductId Prop_ProductId done processing, install Prop_InstallType completed …	Admin	N
172	Store product Prop_ProductId install (Prop_InstallType) failed with error …	Admin	N
180	Retrieving entitlement for Store product Prop_ProductId failed with error …	Admin	N
190	Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) …	Admin	Y
191	Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) …	Admin	N
200	Connection to the Windows Update service could not be established.	Admin	Y
201	Connection to the Windows Metadata and Internet Services (WMIS) could not be …	Admin	Y
202	The Network List Manager reports no connectivity to the internet.	Admin	Y
203	The Network List Manager reports connection to the internet has been …	Admin	Y
220	Registered the handler Prop_NotificationHandler for the app Prop_PackageId to …	Operational	N
221	App Prop_PackageId already has a handler registered for the device container …	Debug	N
222	Device container Prop_ContainerId and app Prop_PackageId specify background task …	Debug	N
223	Unregistered for the Print background task after uninstalling the app …	Debug	N
224	Unregistered for the Mobile Operator background task after uninstalling the app …	Debug	N
230	Requested download of the app Prop_PackageId from the store for device …	Debug	N
231	Successfully installed the app Prop_PackageId from the store for device …	Debug	N
232	Encountered error trying to install app Prop_PackageId from the store for device …	Debug	N
233	Encountered error trying to install app Prop_PackageId from the store for device …	Debug	N
234	Driver update(s) was installed on device 'Prop_DevnodeId' in Prop_MilliSeconds …	Admin	Y
300	Device container 'Prop_ContainerId' has entered the ready state.	Operational	Y
301	Device setup for device container 'Prop_ContainerId' has been completed.	Operational	Y
302	Device metadata that contains an extension namespace has been parsed for device …	Operational	N
400	DeviceSetupTaskStart	Analytic	N
401	DeviceSetupTaskStop	Analytic	N
402	DownloadDriverTaskStart	Analytic	N
403	DownloadDriverTaskStop	Analytic	N
404	BuildDriverListTaskStart	Analytic	N
405	BuildDriverListTaskStop	Analytic	N
406	InstallDriverTaskStart	Analytic	N
407	InstallDriverTaskStop	Analytic	N
408	MetadataInstallTaskStart	Analytic	N
409	MetadataInstallTaskStop	Analytic	N
410	InstallDriverUpdateTaskStart	Analytic	N
411	InstallDriverUpdateTaskStop	Analytic	N
412	InstallSoftwareStart	Analytic	N
413	InstallSoftwareStop	Analytic	N
7710	ENTER: Searching WU for driver updates.	Analytic	N
7711	EXIT: Searching WU for driver updates.	Analytic	N
7712	ENTER: Downloading driver update from WU.	Analytic	N
7713	EXIT: Downloading driver update from WU.	Analytic	N
7714	ENTER: Installing driver update from WU.	Analytic	N
7715	EXIT: Installing driver update from WU.	Analytic	N

Event ID 10: DSM service feature Prop_FeatureId is Prop_FeatureEnablement.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM service feature Prop_FeatureId is Prop_FeatureEnablement.

Message #

DSM service feature %1 is %2.

Fields #

Name	Description
`Prop_FeatureId` UInt32
`Prop_FeatureEnablement` UInt8

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 10,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.6263943+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_FeatureEnablement": "1",
    "Prop_FeatureId": "21151629"
  }
}

Event ID 11: DSM service is idle and waiting for Prop_IdleWait.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM service is idle and waiting for Prop_IdleWait.

Message #

DSM service is idle and waiting for %1.

Fields #

Name	Description
`Prop_IdleWait` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 11,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.8270333+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_IdleWait": "2"
  }
}

Event ID 20: DSM service is running in special OOBE based on OS product policy.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

DSM service is running in special OOBE based on OS product policy.

Message #

DSM service is running in special OOBE based on OS product policy.

Event ID 21: Auto download settings have been committed in OOBE: Store App Updates Prop_AppUpdatesEnablement, Windows Updates Prop_WindowsUpdatesEnablement.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Auto download settings have been committed in OOBE: Store App Updates Prop_AppUpdatesEnablement, Windows Updates Prop_WindowsUpdatesEnablement.

Message #

Auto download settings have been committed in OOBE: Store App Updates %1, Windows Updates %2.

Fields #

Name	Description
`Prop_AppUpdatesEnablement` UInt8
`Prop_WindowsUpdatesEnablement` UInt8

Event ID 30: Device container Prop_ContainerId is queued for setup.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Device container Prop_ContainerId is queued for setup.

Message #

Device container %1 is queued for setup.

Fields #

Name	Description
`Prop_ContainerId` GUID

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 30,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.6276050+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}"
  }
}

Event ID 40: Prop_ServerSelection search started.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Prop_ServerSelection search started.

Message #

%1 search started.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Event ID 41: Prop_ServerSelection search completed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Prop_ServerSelection search completed.

Message #

%1 search completed.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 41,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:50.0502672+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ServerSelection": "2"
  }
}

Event ID 42: Prop_ServerSelection search failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Error

Description

Prop_ServerSelection search failed with error HRESULT.

Message #

%1 search failed with error %2.

Fields #

Name	Description
`Prop_ServerSelection` UInt32
`HRESULT` HexInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 42,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:34:03.2098648+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ServerSelection": "2",
    "HRESULT": "0x8024001e"
  }
}

Event ID 43: Driver update search is being cancelled.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver update search is being cancelled.

Message #

Driver update search is being cancelled.

Event ID 44: Prop_ServerSelection search was cancelled.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Prop_ServerSelection search was cancelled.

Message #

%1 search was cancelled.

Fields #

Name	Description
`Prop_ServerSelection` UInt32

Event ID 50: Driver recovery on reboot task is Prop_TaskEnablement.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver recovery on reboot task is Prop_TaskEnablement.

Message #

Driver recovery on reboot task is %1.

Fields #

Name	Description
`Prop_TaskEnablement` UInt8

Event ID 50: Driver recovery on reboot task is

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational

Description

Driver recovery on reboot task is .

Fields #

Name	Description
`Prop_TaskEnablement` UInt8

Event ID 51: Driver recovery action is requested since it was queued for the next reboot.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver recovery action is requested since it was queued for the next reboot.

Message #

Driver recovery action is requested since it was queued for the next reboot.

Event ID 51: Driver recovery action is requested since it was queued for the next reboot

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational

Description

Driver recovery action is requested since it was queued for the next reboot.

Event ID 52: Driver recovery request is received.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver recovery request is received. Last trigger: Prop_DriverRecoveryRequest.

Message #

Driver recovery request is received. Last trigger: %1.

Fields #

Name	Description
`Prop_DriverRecoveryRequest` UInt32

Event ID 52: Driver recovery request is received

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational

Description

Driver recovery request is received. Last trigger: .

Fields #

Name	Description
`Prop_DriverRecoveryRequest` UInt32

Event ID 100: DSM service started, mode is Prop_CoreServiceMode, last session (or boot) was Prop_Event_Window_Seconds seconds ago.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM service started, mode is Prop_CoreServiceMode, last session (or boot) was Prop_Event_Window_Seconds seconds ago.

Message #

DSM service started, mode is %1, last session (or boot) was %2 seconds ago.

Fields #

Name	Description
`Prop_CoreServiceMode` UInt32
`Prop_Event_Window_Seconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 100,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:32.2295462+00:00",
    "event_record_id": 1101,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0005-E35D-82C688EFDC01}"
    },
    "execution": {
      "process_id": 2784,
      "thread_id": 5072
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_CoreServiceMode": "0",
    "Prop_Event_Window_Seconds": "8268"
  },
  "message": "DSM service start, mode is Normal, last session (or boot) was 8268 seconds ago"
}

Event ID 101: DSM Service is shutting down.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM Service is shutting down. Service uptime was Prop_UpTime_Seconds seconds, active worktime was Prop_WorkTime_MilliSeconds ms.

Message #

DSM Service is shutting down. Service uptime was %1 seconds, active worktime was %2 ms.

Fields #

Name	Description
`Prop_UpTime_Seconds` Int64
`Prop_WorkTime_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 101,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:40:18.6721418+00:00",
    "event_record_id": 1120,
    "correlation": {
      "ActivityID": "{C6821FB2-EF88-0005-E35D-82C688EFDC01}"
    },
    "execution": {
      "process_id": 2784,
      "thread_id": 5072
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_UpTime_Seconds": "46",
    "Prop_WorkTime_MilliSeconds": "1250"
  },
  "message": "DSM Service shutting down. Service uptime was 46 seconds, active worktime was 1250 MilliSeconds."
}

Event ID 102: DSM Service dll has loaded.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

DSM Service dll has loaded.

Message #

DSM Service dll has loaded.

Event ID 103: DSM Service dll is unloading.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

DSM Service dll is unloading.

Message #

DSM Service dll is unloading.

Event ID 104: DSM Service failed to start, result=HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

DSM Service failed to start, result=HRESULT.

Message #

DSM Service failed to start, result=%1.

Fields #

Name	Description
`HRESULT` UInt32

Event ID 105: DSM Service is entering a retry sequence because soft (retryable) errors were encountered

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM Service is entering a retry sequence because soft (retryable) errors were encountered.

Message #

DSM Service is entering a retry sequence because soft (retryable) errors were encountered.

Fields #

Name	Description
`Prop_RetryCycleCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 105,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.7049233+00:00",
    "event_record_id": 1054,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "DSM Service is entering a retry sequence because soft (retryable) errors were encountered"
}

Event ID 106: DSM Service is leaving the retry state, there have been Prop_RetryCycleCount retry cycles in this session.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM Service is leaving the retry state, there have been Prop_RetryCycleCount retry cycles in this session.

Message #

DSM Service is leaving the retry state, there have been %1 retry cycles in this session.

Fields #

Name	Description
`Prop_RetryCycleCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 106,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:40.7418653+00:00",
    "event_record_id": 1095,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2700
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_RetryCycleCount": "3"
  },
  "message": "DSM Service is leaving the retry state, there have been 3 retry cycles in this session"
}

Event ID 107: DSM service has shut down.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM service has shut down.

Message #

DSM service has shut down.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 107,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:46.8532558+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {}
}

Event ID 108: DSM service has entered service state 'Prop_CoreServiceState'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

DSM service has entered service state 'Prop_CoreServiceState'.

Message #

DSM service has entered service state '%1'.

Fields #

Name	Description
`Prop_CoreServiceState` UInt32

Event ID 109: DSM service has entered service mode 'Prop_CoreServiceMode'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

DSM service has entered service mode 'Prop_CoreServiceMode'.

Message #

DSM service has entered service mode '%1'.

Fields #

Name	Description
`Prop_CoreServiceMode` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-11-06T06:25:39.185383+00:00",
    "event_record_id": 70,
    "correlation": {},
    "execution": {
      "process_id": 1856,
      "thread_id": 2020
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_CoreServiceMode": 3
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 110: Job (Prop_JobId) has started for device container 'Prop_ContainerId', type=Prop_JobType.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Job (Prop_JobId) has started for device container 'Prop_ContainerId', type=Prop_JobType.

Message #

Job (%2) has started for device container '%1', type=%3.

Fields #

Name	Description
`Prop_ContainerId` GUID
`Prop_JobId` UInt32
`Prop_JobType` UInt32

Event ID 111: Job (Prop_JobId) has completed for device container 'Prop_ContainerId', status=Prop_JobStatus.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Job (Prop_JobId) has completed for device container 'Prop_ContainerId', status=Prop_JobStatus.

Message #

Job (%2) has completed for device container '%1', status=%3.

Fields #

Name	Description
`Prop_ContainerId` GUID
`Prop_JobId` UInt32
`Prop_JobStatus` UInt32

Event ID 112: Device container 'Prop_DeviceName' (Prop_ContainerId) has been serviced, processed Prop_TaskCount tasks, and wrote Prop_PropertyCount properties in Prop_WorkTime_MilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Device container 'Prop_DeviceName' (Prop_ContainerId) has been serviced, processed Prop_TaskCount tasks, and wrote Prop_PropertyCount properties in Prop_WorkTime_MilliSeconds ms.

Message #

Device container '%1' (%2) has been serviced, processed %3 tasks, and wrote %4 properties in %5 ms.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`Prop_TaskCount` Int32
`Prop_PropertyCount` Int32
`Prop_WorkTime_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 112,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:33.4935482+00:00",
    "event_record_id": 1119,
    "correlation": {},
    "execution": {
      "process_id": 2784,
      "thread_id": 6000
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DeviceName": "TELEMETRY-DC-A",
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}",
    "Prop_TaskCount": "5",
    "Prop_PropertyCount": "35",
    "Prop_WorkTime_MilliSeconds": "484"
  },
  "message": "Device 'TELEMETRY-DC-A' ({00000000-0000-0000-ffff-ffffffffffff}) has been serviced, processed 5 tasks, wrote 35 properties, active worktime was 484 milliseconds."
}

Event ID 120: Driver update(s) was downloaded for device 'Prop_PackageId' in Prop_MilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver update(s) was downloaded for device 'Prop_PackageId' in Prop_MilliSeconds ms.

Message #

Driver update(s) was downloaded for device '%1' in %2 ms.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_MilliSeconds` Int64

Event ID 121: Driver update(s) install on device 'Prop_DevnodeId' failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Error

Description

Driver update(s) install on device 'Prop_DevnodeId' failed with error HRESULT.

Message #

Driver update(s) install on device '%1' failed with error %2.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 121,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-18T00:34:03.2196267+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "HRESULT": "2149842974",
    "Prop_DevnodeId": "PCI\\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\\3&267a616a&0&10"
  }
}

Event ID 122: Access to drivers on Windows Update was blocked by policy

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Access to drivers on Windows Update was blocked by policy.

Message #

Access to drivers on Windows Update was blocked by policy.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 123: DSM service was delayed by Prop_Seconds seconds for a driver query/download/install on device 'Prop_DeviceId'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Warning

Description

DSM service was delayed by Prop_Seconds seconds for a driver query/download/install on device 'Prop_DeviceId'.

Message #

DSM service was delayed by %1 seconds for a driver query/download/install on device '%2'.

Fields #

Name	Description
`Prop_Seconds` Int32
`Prop_DeviceId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 123,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:33.223885+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_Seconds": 36,
    "Prop_DeviceId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 124: Driver Prop_PackageId was installed on device 'Prop_DeviceInstanceId' in Prop_MilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver Prop_PackageId was installed on device 'Prop_DeviceInstanceId' in Prop_MilliSeconds ms.

Message #

Driver %1 was installed on device '%2' in %3 ms.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Prop_MilliSeconds` Int64

Event ID 125: Driver install on device 'Prop_DevnodeId' was blocked by PnP restriction policy.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Driver install on device 'Prop_DevnodeId' was blocked by PnP restriction policy.

Message #

Driver install on device '%1' was blocked by PnP restriction policy.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 126: Device 'Prop_DeviceInstanceId' matched driver update Prop_PackageId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Device 'Prop_DeviceInstanceId' matched driver update Prop_PackageId.

Message #

Device '%1' matched driver update %2.

Fields #

Name	Description
`Prop_DeviceInstanceId` UnicodeString
`Prop_PackageId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 126,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:25.745333+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DeviceInstanceId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F",
    "Prop_PackageId": "b5857a80-fd07-4a9d-9adf-2a3a6db94b7e"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 127: Device 'Prop_DevnodeId' does not match any driver updates that are not optional.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Device 'Prop_DevnodeId' does not match any driver updates that are not optional.

Message #

Device '%1' does not match any driver updates that are not optional.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 127,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:50.0714514+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_DevnodeId": "USB\\VID_0627&PID_0001\\28754-0000:00:01.2-1"
  }
}

Event ID 130: Metadata package Prop_MetadataPackageId was staged for device container Prop_ContainerId in Prop_StageTimeMilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package Prop_MetadataPackageId was staged for device container Prop_ContainerId in Prop_StageTimeMilliSeconds ms.

Message #

Metadata package %1 was staged for device container %2 in %3 ms.

Fields #

Name	Description
`Prop_MetadataPackageId` UnicodeString
`Prop_ContainerId` GUID
`Prop_StageTimeMilliSeconds` Int64

Event ID 131: Metadata package staging for device container Prop_ContainerId failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Error

Description

Metadata package staging for device container Prop_ContainerId failed with error HRESULT.

Message #

Metadata package staging for device container %1 failed with error %2.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`HRESULT` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 131,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:33.4920181+00:00",
    "event_record_id": 1118,
    "correlation": {},
    "execution": {
      "process_id": 2784,
      "thread_id": 6000
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-FFFF-FFFFFFFFFFFF}",
    "HRESULT": "2147943568"
  },
  "message": "Metadata staging failed, result=0x80070490 for container '{00000000-0000-0000-FFFF-FFFFFFFFFFFF}'"
}

Event ID 132: Metadata package search for device container Prop_ContainerId on Windows Metadata and Internet Services (WMIS) failed with error HRESULT, HTTP status code: HTTPCode.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package search for device container Prop_ContainerId on Windows Metadata and Internet Services (WMIS) failed with error HRESULT, HTTP status code: HTTPCode.

Message #

Metadata package search for device container %1 on Windows Metadata and Internet Services (WMIS) failed with error %2, HTTP status code: %3.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`HRESULT` HexInt32
`HTTPCode` UInt32

Event ID 133: Metadata package Prop_PackageId download for device container Prop_ContainerId failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package Prop_PackageId download for device container Prop_ContainerId failed with error HRESULT.

Message #

Metadata package %1 download for device container %2 failed with error %3.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_ContainerId` UnicodeString
`HRESULT` HexInt32

Event ID 134: Metadata package search for device container Prop_ContainerId completed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package search for device container Prop_ContainerId completed. Found package Prop_PackageId.

Message #

Metadata package search for device container %1 completed. Found package %2.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 135: Metadata package search for device container Prop_ContainerId completed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package search for device container Prop_ContainerId completed. No package is found.

Message #

Metadata package search for device container %1 completed. No package is found.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Event ID 136: Metadata package Prop_PackageId was blocked.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package Prop_PackageId was blocked.

Message #

Metadata package %1 was blocked.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 137: Signature verification failed for metadata package Prop_PackageId from metadata store, error Error.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Signature verification failed for metadata package Prop_PackageId from metadata store, error Error.

Message #

Signature verification failed for metadata package %1 from metadata store, error %2.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Error` HexInt32

Event ID 138: Metadata package Prop_PackageId was not fully staged due to signature verification: Prop_IsLegacySigCheckForFile1 for 'Prop_FileName1' had result HRESULT1, Prop_IsLegacySigCheckForFile2 for 'Prop_F...

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Metadata package Prop_PackageId was not fully staged due to signature verification: Prop_IsLegacySigCheckForFile1 for 'Prop_FileName1' had result HRESULT1, Prop_IsLegacySigCheckForFile2 for 'Prop_FileName2' had result HRESULT2.

Message #

Metadata package %1 was not fully staged due to signature verification: %2 for '%3' had result %4, %5 for '%6' had result %7.

Fields #

Name	Description
`Prop_PackageId` UnicodeString
`Prop_IsLegacySigCheckForFile1` UInt8
`Prop_FileName1` UnicodeString
`HRESULT1` HexInt32
`Prop_IsLegacySigCheckForFile2` UInt8
`Prop_FileName2` UnicodeString
`HRESULT2` HexInt32

Event ID 150: Device 'Prop_DeviceName' (Prop_ContainerId) was removed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Device 'Prop_DeviceName' (Prop_ContainerId) was removed.

Message #

Device '%1' (%2) was removed.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID

Event ID 151: Device 'Prop_DeviceName' (Prop_ContainerId) failed to respond to a device removal request.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Device 'Prop_DeviceName' (Prop_ContainerId) failed to respond to a device removal request.

Message #

Device '%1' (%2) failed to respond to a device removal request.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID

Event ID 152: Device 'Prop_DeviceName' (Prop_ContainerId) removal failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Device 'Prop_DeviceName' (Prop_ContainerId) removal failed with error HRESULT.

Message #

Device '%1' (%2) removal failed with error %3.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`HRESULT` HexInt32

Event ID 160: Software Prop_SoftwareName was installed for device 'Prop_DeviceInstanceId' in Prop_InstallTime ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName was installed for device 'Prop_DeviceInstanceId' in Prop_InstallTime ms.

Message #

Software %1 was installed for device '%2' in %3 ms.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Prop_InstallTime` UInt64

Event ID 161: Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName was not newer, Version: 'Prop_HiHighPartNew.Prop_LoHighPartNew.Prop_HiLowPartNew.Prop_LoLowPartNew'. Current Version: 'Prop_HiHighPartOld.Prop_LoHighPartOld.Prop_HiLowPartOld.Prop_LoLowPartOld'.

Message #

Software %1 was not newer, Version: '%2.%3.%4.%5'. Current Version: '%6.%7.%8.%9'.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_HiHighPartNew` UInt32
`Prop_LoHighPartNew` UInt32
`Prop_HiLowPartNew` UInt32
`Prop_LoLowPartNew` UInt32
`Prop_HiHighPartOld` UInt32
`Prop_LoHighPartOld` UInt32
`Prop_HiLowPartOld` UInt32
`Prop_LoLowPartOld` UInt32

Event ID 162: Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId.

Message #

Software %1 failed installation with error %2.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`HRESULT` HexInt32

Event ID 163: Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId and process exit code Error.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName failed installation with error Prop_DeviceInstanceId and process exit code Error.

Message #

Software %1 failed installation with error %2 and process exit code %3.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`Error` UInt32
`HRESULT` HexInt32

Event ID 164: Software Prop_SoftwareName had non-critical error Prop_DeviceInstanceId during installation, will retry later.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName had non-critical error Prop_DeviceInstanceId during installation, will retry later.

Message #

Software %1 had non-critical error %2 during installation, will retry later.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_DeviceInstanceId` UnicodeString
`HRESULT` HexInt32

Event ID 165: Software Prop_SoftwareName is being launched with command line: 'Prop_CommandLine'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Software Prop_SoftwareName is being launched with command line: 'Prop_CommandLine'.

Message #

Software %1 is being launched with command line: '%2'.

Fields #

Name	Description
`Prop_SoftwareName` UnicodeString
`Prop_CommandLine` UnicodeString

Event ID 166: Device 'Prop_DeviceInstanceId' requested Store App for 'Prop_SoftwareLinks'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Device 'Prop_DeviceInstanceId' requested Store App for 'Prop_SoftwareLinks'.

Message #

Device '%1' requested Store App for '%2'.

Fields #

Name	Description
`Prop_DeviceInstanceId` UnicodeString
`Prop_SoftwareLinks` UnicodeString

Event ID 167: Product for pfn IsFramework located: ProductId: Prop_ProductId, IsFramework: Prop_SoftwarePfn.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Product for pfn IsFramework located: ProductId: Prop_ProductId, IsFramework: Prop_SoftwarePfn.

Message #

Product for pfn %1 located: ProductId: %2, IsFramework: %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_SoftwarePfn` UnicodeString

Event ID 168: Uninstalling existing pfn Prop_SoftwarePfn failed with error ErrorCode.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Uninstalling existing pfn Prop_SoftwarePfn failed with error ErrorCode.

Message #

Uninstalling existing pfn %1 failed with error %2.

Fields #

Name	Description
`Prop_SoftwarePfn` UnicodeString
`ErrorCode` UInt32

Event ID 169: Store product Prop_ProductId is already installed and is being checked for updates.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Store product Prop_ProductId is already installed and is being checked for updates.

Message #

Store product %1 is already installed and is being checked for updates.

Fields #

Name	Description
`Prop_ProductId` UnicodeString

Event ID 170: Store product Prop_ProductId is being installed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Store product Prop_ProductId is being installed.

Message #

Store product %1 is being installed.

Fields #

Name	Description
`Prop_ProductId` UnicodeString

Event ID 171: ProductId Prop_ProductId done processing, install Prop_InstallType completed with error %3.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

ProductId Prop_ProductId done processing, install Prop_InstallType completed with error %3.

Message #

ProductId %1 done processing, install %2 completed with error %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_InstallType` UInt32

Event ID 172: Store product Prop_ProductId install (Prop_InstallType) failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Store product Prop_ProductId install (Prop_InstallType) failed with error HRESULT.

Message #

Store product %1 install (%2) failed with error %3.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_InstallType` UInt32
`HRESULT` HexInt32

Event ID 180: Retrieving entitlement for Store product Prop_ProductId failed with error ErrorCode.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Retrieving entitlement for Store product Prop_ProductId failed with error ErrorCode.

Message #

Retrieving entitlement for Store product %1 failed with error %2.

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`ErrorCode` UInt32

Event ID 190: Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) completed in Prop_MilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) completed in Prop_MilliSeconds ms.

Message #

Property heuristics for device container '%1' (%2) completed in %3 ms.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`Prop_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 190,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-05-27T16:19:01.7565201+00:00",
    "computer": "DESKTOP-FF3N5XK.ludus.domain",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {
    "Prop_ContainerId": "{00000000-0000-0000-ffff-ffffffffffff}",
    "Prop_MilliSeconds": "105",
    "Prop_DeviceName": "DESKTOP-FF3N5XK"
  }
}

Event ID 191: Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin

Description

Property heuristics for device container 'Prop_DeviceName' (Prop_ContainerId) failed with error HRESULT.

Message #

Property heuristics for device container '%1' (%2) failed with error %3.

Fields #

Name	Description
`Prop_DeviceName` UnicodeString
`Prop_ContainerId` GUID
`HRESULT` HexInt32
`Prop_MilliSeconds` Int64

Event ID 200: Connection to the Windows Update service could not be established.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Warning

Description

Connection to the Windows Update service could not be established.

Message #

Connection to the Windows Update service could not be established.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 200,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:27.7532780+00:00",
    "event_record_id": 1082,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "A connection to the Windows Update service could not be established."
}

Event ID 201: Connection to the Windows Metadata and Internet Services (WMIS) could not be established.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Warning

Description

Connection to the Windows Metadata and Internet Services (WMIS) could not be established.

Message #

Connection to the Windows Metadata and Internet Services (WMIS) could not be established.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 201,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:32:54.7042415+00:00",
    "event_record_id": 1051,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "A connection to the Windows Metadata and Internet Services (WMIS) could not be established."
}

Event ID 202: The Network List Manager reports no connectivity to the internet.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Warning

Description

The Network List Manager reports no connectivity to the internet.

Message #

The Network List Manager reports no connectivity to the internet.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "{FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2}",
    "event_source_name": "",
    "event_id": 202,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2026-05-29T16:33:27.7539308+00:00",
    "event_record_id": 1084,
    "correlation": {},
    "execution": {
      "process_id": 1308,
      "thread_id": 2692
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "The Network List Manager reports no connectivity to the internet."
}

Event ID 203: The Network List Manager reports connection to the internet has been established.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

The Network List Manager reports connection to the internet has been established.

Message #

The Network List Manager reports connection to the internet has been established.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "event_id": 203,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "time_created": "2026-04-17T21:49:06.7383623+00:00",
    "computer": "WIN11-25H2-X64",
    "channel": "Microsoft-Windows-DeviceSetupManager"
  },
  "event_data": {}
}

Event ID 220: Registered the handler Prop_NotificationHandler for the app Prop_PackageId to handle notifications from the device container Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational

Description

Registered the handler Prop_NotificationHandler for the app Prop_PackageId to handle notifications from the device container Prop_ContainerId.

Message #

Registered the handler %3 for the app %2 to handle notifications from the device container %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString
`Prop_NotificationHandler` UnicodeString

Event ID 221: App Prop_PackageId already has a handler registered for the device container Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

App Prop_PackageId already has a handler registered for the device container Prop_ContainerId.

Message #

App %2 already has a handler registered for the device container %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 222: Device container Prop_ContainerId and app Prop_PackageId specify background task information, but registration failed with error HRESULT.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Device container Prop_ContainerId and app Prop_PackageId specify background task information, but registration failed with error HRESULT.

Message #

Device container %1 and app %2 specify background task information, but registration failed with error %3.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString
`HRESULT` UInt32

Event ID 223: Unregistered for the Print background task after uninstalling the app Prop_PackageId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Unregistered for the Print background task after uninstalling the app Prop_PackageId.

Message #

Unregistered for the Print background task after uninstalling the app %1.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 224: Unregistered for the Mobile Operator background task after uninstalling the app Prop_PackageId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Unregistered for the Mobile Operator background task after uninstalling the app Prop_PackageId.

Message #

Unregistered for the Mobile Operator background task after uninstalling the app %1.

Fields #

Name	Description
`Prop_PackageId` UnicodeString

Event ID 230: Requested download of the app Prop_PackageId from the store for device Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Requested download of the app Prop_PackageId from the store for device Prop_ContainerId.

Message #

Requested download of the app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 231: Successfully installed the app Prop_PackageId from the store for device Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Successfully installed the app Prop_PackageId from the store for device Prop_ContainerId.

Message #

Successfully installed the app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 232: Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId. This operation will be retried when the device is reconnected or the user logs on again.

Message #

Encountered error trying to install app %2 from the store for device %1.  This operation will be retried when the device is reconnected or the user logs on again.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 233: Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Debug

Description

Encountered error trying to install app Prop_PackageId from the store for device Prop_ContainerId.

Message #

Encountered error trying to install app %2 from the store for device %1.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_PackageId` UnicodeString

Event ID 234: Driver update(s) was installed on device 'Prop_DevnodeId' in Prop_MilliSeconds ms.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Admin
Level: Informational

Description

Driver update(s) was installed on device 'Prop_DevnodeId' in Prop_MilliSeconds ms.

Message #

Driver update(s) was installed on device '%1' in %2 ms.

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`Prop_MilliSeconds` Int64

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 234,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T21:25:33.223883+00:00",
    "event_record_id": 9,
    "correlation": {},
    "execution": {
      "process_id": 2076,
      "thread_id": 3168
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_DevnodeId": "PCI\\VEN_15AD&DEV_0740&SUBSYS_074015AD&REV_10\\3&61AAA01&0&3F",
    "Prop_MilliSeconds": 36967
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 300: Device container 'Prop_ContainerId' has entered the ready state.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational
Level: Informational
Opcode: DeviceUxReady

Description

Device container 'Prop_ContainerId' has entered the ready state.

Message #

Device container '%1' has entered the ready state.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 10,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:50:55.529095+00:00",
    "event_record_id": 19,
    "correlation": {},
    "execution": {
      "process_id": 3156,
      "thread_id": 4092
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{FF3C9BFC-6A33-58E1-8CFA-A12CE4352D2F}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 301: Device setup for device container 'Prop_ContainerId' has been completed.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational
Level: Informational
Opcode: DeviceSetupComplete

Description

Device setup for device container 'Prop_ContainerId' has been completed.

Message #

Device setup for device container '%1' has been completed.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DeviceSetupManager",
    "guid": "FCBB06BB-6A2A-46E3-ABAA-246CB4E508B2",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 11,
    "keywords": 9223372036854775808,
    "time_created": "2023-11-05T22:30:42.666470+00:00",
    "event_record_id": 22,
    "correlation": {},
    "execution": {
      "process_id": 3256,
      "thread_id": 4616
    },
    "channel": "Microsoft-Windows-DeviceSetupManager/Operational",
    "computer": "WinDev2310Eval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Prop_ContainerId": "{1074B24D-B986-5A01-B420-B3D39C2F9286}"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 302: Device metadata that contains an extension namespace has been parsed for device container 'Prop_ContainerId', ExtensionNamespace = 'Prop_ServiceInfoNamespace', Culture = 'Prop_CultureCode'.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Operational

Description

Device metadata that contains an extension namespace has been parsed for device container 'Prop_ContainerId', ExtensionNamespace = 'Prop_ServiceInfoNamespace', Culture = 'Prop_CultureCode'.

Message #

Device metadata that contains an extension namespace has been parsed for device container '%1', ExtensionNamespace = '%2', Culture = '%3'.

Fields #

Name	Description
`Prop_ContainerId` UnicodeString
`Prop_ServiceInfoNamespace` UnicodeString
`Prop_CultureCode` UnicodeString

Event ID 400: DeviceSetupTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DeviceSetupTask
Opcode: Start

Fields #

Name	Description
`Prop_ContainerId` GUID

Event ID 401: DeviceSetupTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DeviceSetupTask
Opcode: Stop

Fields #

Name	Description
`Prop_ContainerId` GUID

Event ID 402: DownloadDriverTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DownloadDriverTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 403: DownloadDriverTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DownloadDriverTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 404: BuildDriverListTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: BuildDriverListTask
Opcode: Start

Fields #

Name	Description
`Prop_PackagePath` UnicodeString

Event ID 405: BuildDriverListTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: BuildDriverListTask
Opcode: Stop

Fields #

Name	Description
`Prop_PackagePath` UnicodeString

Event ID 406: InstallDriverTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallDriverTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 407: InstallDriverTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallDriverTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 408: MetadataInstallTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: MetadataInstallTask
Opcode: Start

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Event ID 409: MetadataInstallTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: MetadataInstallTask
Opcode: Stop

Fields #

Name	Description
`Prop_ContainerId` UnicodeString

Event ID 410: InstallDriverUpdateTaskStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallDriverUpdateTask
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 411: InstallDriverUpdateTaskStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallDriverUpdateTask
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString
`HRESULT` UInt32

Event ID 412: InstallSoftwareStart

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallSoftware
Opcode: Start

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 413: InstallSoftwareStop

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallSoftware
Opcode: Stop

Fields #

Name	Description
`Prop_DevnodeId` UnicodeString

Event ID 7710: ENTER: Searching WU for driver updates.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: SearchWindowsUpdate
Opcode: Start

Description

ENTER: Searching WU for driver updates.

Message #

ENTER: Searching WU for driver updates.

Event ID 7711: EXIT: Searching WU for driver updates.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: SearchWindowsUpdate
Opcode: Stop

Description

EXIT: Searching WU for driver updates.

Message #

EXIT: Searching WU for driver updates.

Event ID 7712: ENTER: Downloading driver update from WU.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DownloadFromWindowsUpdate
Opcode: Start

Description

ENTER: Downloading driver update from WU.

Message #

ENTER: Downloading driver update from WU.

Event ID 7713: EXIT: Downloading driver update from WU.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: DownloadFromWindowsUpdate
Opcode: Stop

Description

EXIT: Downloading driver update from WU.

Message #

EXIT: Downloading driver update from WU.

Event ID 7714: ENTER: Installing driver update from WU.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallFromWindowsUpdate
Opcode: Start

Description

ENTER: Installing driver update from WU.

Message #

ENTER: Installing driver update from WU.

Event ID 7715: EXIT: Installing driver update from WU.

Provider: Microsoft-Windows-DeviceSetupManager
Channel: Analytic
Task: InstallFromWindowsUpdate
Opcode: Stop

Description

EXIT: Installing driver update from WU.

Message #

EXIT: Installing driver update from WU.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID fcbb06bb-6a2a-46e3-abaa-246cb4e508b2

Defined in DeviceSetupManager.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)