Microsoft-Windows-DeviceUpdateAgent

25 events across 1 channel

Event	Title	Channel	Sample
100	A new deployment session was created with session ID Prop_SessionId.	Operational	N
101	Failed to create a new deployment session with error Prop_UpdateId.	Operational	N
200	Failed to generate a list of files to download with error Prop_ProductId.	Operational	N
201	Requesting Prop_NumFiles files with total size Prop_RequestSize.	Operational	N
300	Failed to install updates with error Prop_ProductId.	Operational	N
301	Update 'Prop_UnicodeString' encountered install error Win32Error.	Operational	N
302	Update 'Prop_UnicodeString' encountered import error Win32Error.	Operational	N
303	Update 'Prop_UnicodeString' should have already existed on the machine, but was …	Operational	N
304	Installation of update set 'Prop_Id' requires the system to be rebooted.	Operational	N
305	Installation of update 'Prop_Id' requires the system to be rebooted.	Operational	N
306	Installation of update set 'Prop_SetId' is complete.	Operational	N
307	Updated product 'Prop_ProductId' to version 'Prop_ProductVersion'.	Operational	N
400	Failed to commit updates with error HRESULT.	Operational	N
500	Failed to clean up updates with error HRESULT.	Operational	N
600	Failed to cancel updates with error HRESULT.	Operational	N
601	Updates were cancelled with reason HRESULT.	Operational	N
700	Failed to merge updates with error HRESULT.	Operational	N
800	Failed to get update result post reboot with error HRESULT.	Operational	N
801	Updated product 'Prop_ProductId' to last activated version …	Operational	N
802	Product 'Missing_updates' was not updated to last activated version …	Operational	N
803	Product 'Prop_ProductId' at version 'Prop_ProductVersion' had summary analysis …	Operational	N
804	Summary analysis found device 'Prop_DeviceInstancePath' using driver package …	Operational	N
805	Summary analysis found device 'Prop_DeviceInstancePath' using driver package …	Operational	N
900	Failed to perform post download operation with error HRESULT.	Operational	N
1000	Parsed manifest for product 'Prop_ProductId' at version 'Prop_Version1' is not …	Operational	N

Event ID 100: A new deployment session was created with session ID Prop_SessionId.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

A new deployment session was created with session ID Prop_SessionId.

Message #

A new deployment session was created with session ID %1

Fields #

Name	Description
`Prop_SessionId` UnicodeString
`Prop_UpdateId` UnicodeString
`Prop_FlightId` UnicodeString

Event ID 101: Failed to create a new deployment session with error Prop_UpdateId.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to create a new deployment session with error Prop_UpdateId.

Message #

Failed to create a new deployment session with error %1

Fields #

Name	Description
`Prop_UpdateId` UnicodeString
`Prop_FlightId` UnicodeString
`HRESULT` UInt32

Event ID 200: Failed to generate a list of files to download with error Prop_ProductId.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to generate a list of files to download with error Prop_ProductId.

Message #

Failed to generate a list of files to download with error %1

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString
`HRESULT` UInt32

Event ID 201: Requesting Prop_NumFiles files with total size Prop_RequestSize.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Requesting Prop_NumFiles files with total size Prop_RequestSize.

Message #

Requesting %1 files with total size %2

Fields #

Name	Description
`Prop_NumFiles` UInt32
`Prop_RequestSize` UInt64

Event ID 300: Failed to install updates with error Prop_ProductId.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to install updates with error Prop_ProductId.

Message #

Failed to install updates with error %1

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString
`HRESULT` UInt32

Event ID 301: Update 'Prop_UnicodeString' encountered install error Win32Error.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Update 'Prop_UnicodeString' encountered install error Win32Error.

Message #

Update '%2' encountered install error %1

Fields #

Name	Description
`Win32Error` UInt32
`Prop_UnicodeString` UnicodeString

Event ID 302: Update 'Prop_UnicodeString' encountered import error Win32Error.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Update 'Prop_UnicodeString' encountered import error Win32Error.

Message #

Update '%2' encountered import error %1

Fields #

Name	Description
`Win32Error` UInt32
`Prop_UnicodeString` UnicodeString

Event ID 303: Update 'Prop_UnicodeString' should have already existed on the machine, but was missing.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Update 'Prop_UnicodeString' should have already existed on the machine, but was missing. Error = Win32Error.

Message #

Update '%2' should have already existed on the machine, but was missing.  Error = %1

Fields #

Name	Description
`Win32Error` UInt32
`Prop_UnicodeString` UnicodeString

Event ID 304: Installation of update set 'Prop_Id' requires the system to be rebooted.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Installation of update set 'Prop_Id' requires the system to be rebooted.

Message #

Installation of update set '%1' requires the system to be rebooted

Fields #

Name	Description
`Prop_Id` UnicodeString

Event ID 305: Installation of update 'Prop_Id' requires the system to be rebooted.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Installation of update 'Prop_Id' requires the system to be rebooted.

Message #

Installation of update '%1' requires the system to be rebooted

Fields #

Name	Description
`Prop_Id` UnicodeString

Event ID 306: Installation of update set 'Prop_SetId' is complete.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Installation of update set 'Prop_SetId' is complete. Prop_SuccessfulUpdates updates out of Prop_TotalUpdates updates were successfully installed in Prop_ElapsedMilliseconds milliseconds.

Message #

Installation of update set '%1' is complete.  %2 updates out of %3 updates were successfully installed in %4 milliseconds

Fields #

Name	Description
`Prop_SetId` UnicodeString
`Prop_SuccessfulUpdates` UInt32
`Prop_TotalUpdates` UInt32
`Prop_ElapsedMilliseconds` UInt64

Event ID 307: Updated product 'Prop_ProductId' to version 'Prop_ProductVersion'.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Updated product 'Prop_ProductId' to version 'Prop_ProductVersion'.

Message #

Updated product '%1' to version '%2'

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString

Event ID 400: Failed to commit updates with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to commit updates with error HRESULT.

Message #

Failed to commit updates with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 500: Failed to clean up updates with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to clean up updates with error HRESULT.

Message #

Failed to clean up updates with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 600: Failed to cancel updates with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to cancel updates with error HRESULT.

Message #

Failed to cancel updates with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 601: Updates were cancelled with reason HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Updates were cancelled with reason HRESULT.

Message #

Updates were cancelled with reason %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 700: Failed to merge updates with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to merge updates with error HRESULT.

Message #

Failed to merge updates with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 800: Failed to get update result post reboot with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to get update result post reboot with error HRESULT.

Message #

Failed to get update result post reboot with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 801: Updated product 'Prop_ProductId' to last activated version 'Prop_ProductVersion'.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Updated product 'Prop_ProductId' to last activated version 'Prop_ProductVersion'.

Message #

Updated product '%1' to last activated version '%2'

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString

Event ID 802: Product 'Missing_updates' was not updated to last activated version 'Missing_drivers'.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Product 'Missing_updates' was not updated to last activated version 'Missing_drivers'.

Message #

Product '%1' was not updated to last activated version '%2'.
Missing updates: %3
Missing drivers: %4
Unpublished drivers: %5
Published drivers: %6
Analysis errors: %7

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString
`Prop_MissingUpdates` UInt32
`Prop_MissingDrivers` UInt32
`Prop_UnpublishedDrivers` UInt32
`Prop_PublishedDrivers` UInt32
`Prop_AnalysisErrorDrivers` UInt32

Event ID 803: Product 'Prop_ProductId' at version 'Prop_ProductVersion' had summary analysis error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Product 'Prop_ProductId' at version 'Prop_ProductVersion' had summary analysis error HRESULT.

Message #

Product '%1' at version '%2' had summary analysis error %3

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_ProductVersion` UnicodeString
`HRESULT` UInt32

Event ID 804: Summary analysis found device 'Prop_DeviceInstancePath' using driver package 'Prop_DriverPackageId' has problem code Prop_ProblemCode.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Summary analysis found device 'Prop_DeviceInstancePath' using driver package 'Prop_DriverPackageId' has problem code Prop_ProblemCode.

Message #

Summary analysis found device '%1' using driver package '%2' has problem code %3

Fields #

Name	Description
`Prop_DeviceInstancePath` UnicodeString
`Prop_DriverPackageId` UnicodeString
`Prop_ProblemCode` UInt32

Event ID 805: Summary analysis found device 'Prop_DeviceInstancePath' using driver package 'Prop_DriverPackageId' has device installation error Prop_InstallError.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Summary analysis found device 'Prop_DeviceInstancePath' using driver package 'Prop_DriverPackageId' has device installation error Prop_InstallError.

Message #

Summary analysis found device '%1' using driver package '%2' has device installation error %3

Fields #

Name	Description
`Prop_DeviceInstancePath` UnicodeString
`Prop_DriverPackageId` UnicodeString
`Prop_InstallError` UInt32

Event ID 900: Failed to perform post download operation with error HRESULT.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Failed to perform post download operation with error HRESULT.

Message #

Failed to perform post download operation with error %1

Fields #

Name	Description
`HRESULT` UInt32

Event ID 1000: Parsed manifest for product 'Prop_ProductId' at version 'Prop_Version1' is not greater than currently installed version 'Prop_Version2'.

Provider: Microsoft-Windows-DeviceUpdateAgent
Channel: Operational

Description

Parsed manifest for product 'Prop_ProductId' at version 'Prop_Version1' is not greater than currently installed version 'Prop_Version2'.

Message #

Parsed manifest for product '%1' at version '%2' is not greater than currently installed version '%3'

Fields #

Name	Description
`Prop_ProductId` UnicodeString
`Prop_Version1` UnicodeString
`Prop_Version2` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID e8f9af91-afbe-5a03-dfec-5d591686326c

Defined in DeviceUpdateAgent.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3624, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)