Microsoft-Windows-Diagnosis-MSDE

Event	Title	Channel	Sample	Rule
1000	Begin application initialization.	Debug	N	N
1001	End application initialization.	Debug	N	N
1002	Begin escalation.	Debug	N	N
1003	End escalation.	Debug	N	N

Event ID 1000: Begin application initialization.

Channel: Debug
Task: PerfTrack_MSDT_Initialize_Application
Opcode: Start

Event ID 1001: End application initialization.

Channel: Debug
Task: PerfTrack_MSDT_Initialize_Application
Opcode: Stop

Event ID 1002: Begin escalation.

Channel: Debug
Task: PerfTrack_MSDT_Escalation
Opcode: Start

Event ID 1003: End escalation.

Channel: Debug
Task: PerfTrack_MSDT_Escalation
Opcode: Stop

Provenance

ETW provider GUID a50b09f8-93eb-4396-84c9-dc921259f952

Defined in msdt.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB