Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider
80 events across 2 channels
Event ID 1000: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method succeeded.
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method succeeded. The input Culture/Locale was UILanguage. The size of the result set was ResultSize.
Message #
Fields #
| Name | Description |
|---|---|
UILanguage UnicodeString | |
ResultSize UInt64 |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider",
"event_id": 1000,
"level": "Information",
"task": null,
"opcode": "Info",
"time_created": "2026-03-17T18:45:49.4045989+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
},
"event_data": {
"UILanguage": "en-US",
"ResultSize": "1"
}
}
Event ID 1001: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed because the system ran out of memory.
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed because the system ran out of memory.
Message #
Event ID 1002: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method was canceled by the caller.
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method was canceled by the caller.
Message #
Event ID 1003: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed with error (Error).
#Event ID 1004: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed.
#Event ID 1010: The Windows Scripted Diagnostic Provider API IDiagnosticProvider Cancel method succeeded.
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider Cancel method succeeded.
Message #
Event ID 1011: The Windows Scripted Diagnostic Provider API IDiagnosticProvider Cancel method failed with error (Error).
#Event ID 1012: The Windows Scripted Diagnostic Provider API IDiagnosticProvider failed to cancel the connected diagnostic provider with error (Error).
#Event ID 1013: The Windows Scripted Diagnostic Provider API IDiagnosticProvider failed to cancel the local diagnostic provider with error (Error).
#Event ID 1015: The Windows Scripted Diagnostic Provider API IDiagnosticProvider object property QueryRemoteServer is being overridden by Group Policy.
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider object property QueryRemoteServer is being overridden by Group Policy. The property will be interpreted as being set to VARIANT_FALSE.
Message #
Event ID 1016: The Windows Scripted Diagnostic Provider API IDiagnosticProvider object property QueryRemoteServer is being overridden by the Administrator through...
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider object property QueryRemoteServer is being overridden by the Administrator through a System Wide Preference. The property will be interpreted as being set to VARIANT_FALSE.
Message #
Event ID 1017: The Windows Scripted Diagnostic Provider API IDiagnosticProvider object property QueryRemoteServer is set to QueryRemoteServer.
#Event ID 1018: The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed because the input IDiagnosticMetadat...
#Description
The Windows Scripted Diagnostic Provider API IDiagnosticProvider FindDiagnosticsBySearchMetadata method failed because the input IDiagnosticMetadataCollection object was empty.
Message #
Event ID 2000: The diagnostic package index information was successfully loaded from IndexPath.
#Description
The diagnostic package index information was successfully loaded from IndexPath.
Message #
Fields #
| Name | Description |
|---|---|
IndexPath UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider",
"event_id": 2000,
"level": "Information",
"task": null,
"opcode": "Info",
"time_created": "2026-03-17T18:45:49.4042596+00:00",
"computer": "JD-DC01-2022.ludus.domain",
"channel": "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
},
"event_data": {
"IndexPath": "C:\\Windows\\Diagnostics\\Index\\WindowsUpdateDiagnostic.xml"
}
}
Event ID 2001: Failed to scan diagnostic package index information from IndexPath, with error (Error).
#Event ID 2002: Failed to load the resource (Resource;ResourceId) with error code (Error).
#Event ID 3000: Sending request to the remote server Hostname at the URL path Url.
#Event ID 3001: Failed to connect to the remote server Hostname at the URL path Url due to lack of network access.
#Event ID 3002: Failed to connect to the remote server Hostname at the URL path Url with error Error.
#Event ID 3003: Timed out while communicating with the remote server Hostname at the URL path Url.
#Event ID 3004: Timed out waiting for a response from the remote server Hostname at the URL path Url.
#Event ID 3005: Response from the remote server Hostname at the URL path Url returned the following error response code: ResponseCode.
#Event ID 3006: Received response from the remote server Hostname at the URL path Url.
#Event ID 3007: Parsed valid response from the remote server Hostname at the URL path Url.
#Event ID 3008: Response received from the remote server Hostname at the URL path Url is invalid for the following reason: Reason.
#Event ID 3009: Response received from the remote server Hostname at the URL path Url is malformed.
#Event ID 3010: Attempting to send data to remote server using the following proxy configuration: Access Type (AccessType); Proxy Server (Proxy); Proxy Bypass Server (ProxyBypass).
#Event ID 3011: Failed to send data to remote server using the following proxy configuration: Access Type (AccessType); Proxy Server (Proxy); Proxy Bypass Server (ProxyBypass) because...
#Description
Failed to send data to remote server using the following proxy configuration: Access Type (AccessType); Proxy Server (Proxy); Proxy Bypass Server (ProxyBypass) because of proxy failure (Error).
Message #
Fields #
| Name | Description |
|---|---|
Error UInt32 | |
AccessType Int32 | |
Proxy UnicodeString | |
ProxyBypass UnicodeString |
References #
Event ID 3012: Failed to send data to remote server because list of proxy servers was exhausted without receiving a response.
#Event ID 3013: Connection to remote server has been reset or terminated while waiting for a response.
#Event ID 3014: The following system configuration will be used when querying content providers: OS Major Version (OSMajorVersion); OS Minor Version (OSMinorVersion); Service Pack Major.
#Description
The following system configuration will be used when querying content providers: OS Major Version (OSMajorVersion); OS Minor Version (OSMinorVersion); Service Pack Major (ServicePackMajor); Service Pack Minor (ServicePackMinor); Build Number (BuildNumber); Product Type (ProductType); Processor Architecture (ProcessorArchitecture); Culture (Culture); System Type (SystemType); OEM (OEM); Model (Model); IsMobilePc (IsMobilePc); IsInternal (IsInternal); GeoId (GeoId); Family (Family); OEM SKU (OEMSKU); Version (Version); Base Board OEM (BaseBoardOEM); Base Board Model (BaseBoardModel); Base Board Version (BaseBoardVersion); BIOS Vendor (BIOSVendor); BIOS Version (BIOSVersion); BIOS Release Date (BIOSReleaseDate); BIOS Major Release (BIOSMajorRelease); BIOS Minor Release (BIOSMinorRelease); Embedded Controller Firmware Major Release (ECFirmwareMajorRelease); Embedded Controller Firmware Minor Release (ECFirmwareMinorRelease).
Message #
Fields #
| Name | Description |
|---|---|
OSMajorVersion Int32 | |
OSMinorVersion Int32 | |
ServicePackMajor Int16 | |
ServicePackMinor Int16 | |
BuildNumber Int32 | |
ProductType Int32 | |
ProcessorArchitecture Int16 | |
Culture UnicodeString | |
SystemType Int8 | |
OEM UnicodeString | |
Model UnicodeString | |
IsMobilePc Boolean | |
IsInternal Boolean | |
GeoId Int32 | |
Family UnicodeString | |
OEMSKU UnicodeString | |
Version UnicodeString | |
BaseBoardOEM UnicodeString | |
BaseBoardModel UnicodeString | |
BaseBoardVersion UnicodeString | |
BIOSVendor UnicodeString | |
BIOSVersion UnicodeString | |
BIOSReleaseDate UnicodeString | |
BIOSMajorRelease UInt8 | |
BIOSMinorRelease UInt8 | |
ECFirmwareMajorRelease UInt8 | |
ECFirmwareMinorRelease UInt8 |
Event ID 4000: Starting to scan diagnostic package index information from IndexPath.
#Event ID 4001: Finished scanning diagnostic package index information from IndexPath.
#Event ID 4006: Starting to query content providers for scripted diagnostic content packages.
#Description
Starting to query content providers for scripted diagnostic content packages.
Message #
Event ID 4007: Finished querying content providers for scripted diagnostic content packages with error code (Error).
#Event ID 4008: Starting to cancel content providers.
#Description
Starting to cancel content providers.
Message #
Event ID 4009: Finished cancelling content providers with error code (Error).
#Event ID 4010: Starting to cancel local content provider.
#Description
Starting to cancel local content provider.
Message #
Event ID 4011: Finished cancelling local content provider with error code (Error).
#Event ID 4012: Starting to cancel remote content provider.
#Description
Starting to cancel remote content provider.
Message #
Event ID 4013: Finished cancelling remove content provider with error code (Error).
#Event ID 4014: Starting to gather system configuration necessary for scripted diagnostic content package query.
#Description
Starting to gather system configuration necessary for scripted diagnostic content package query.
Message #
Event ID 4015: Finished gathering system configuration necessary for scripted diagnostic content package query with error code (Error).
#Event ID 4016: Started to connect to remote server Hostname using URL path Url.
#Event ID 4017: Finished connecting to remote server Hostname using URL path Url.
#Event ID 4018: Sending POST request to the remote server Hostname using the URL path: Url with request body: RequestBody.
#Event ID 4019: Response received from remote server.
#Event ID 4020: Starting to parse response from the remote server Hostname POST request to the URL path: Url with request body: RequestBody.
#Event ID 4021: Finished parsing response from the remote server Hostname POST request to the URL path: Url with request body: RequestBody with error Error.
#Event ID 4022: Starting to acquire lock in function Method.
#Event ID 4023: Finished acquiring lock in function Method.
#Event ID 4024: Starting to add result to Diagnostic Collection.
#Description
Starting to add result to Diagnostic Collection.
Message #
Event ID 4025: Finished adding result to Diagnostic Collection with error code (Error).
#Event ID 4026: Starting to load resource from Resource.
#Event ID 4027: Finished loading resource from Resource.
#Event ID 5000: Method succeeded.
#Event ID 5001: Method succeeded.
#Event ID 5002: Method succeeded.
#Event ID 5004: Method succeeded.
#Event ID 5005: Method succeeded.
#Event ID 5006: Method succeeded.
#Event ID 5008: Method succeeded.
#Event ID 5009: Method succeeded.
#Event ID 5010: Method failed because the system ran out of memory.
#Event ID 5011: Method failed with error (Error) because the input parameter, Parameter, was NULL.
#Event ID 5012: Method failed with error (Error).
#Event ID 5013: Method succeeded.
#Event ID 5014: Method failed with error (Error) because the index, Index, is out of bounds of the enumeration or the enumeration is empty.
#Event ID 5015: Method succeeded.
#Event ID 5016: Method failed with error (Error) because the collection already contains an object of type, Type, with value, Value.
#Event ID 5017: Method succeeded.
#Event ID 5018: Method failed with error (Error) because the collection already contains an object of with identifier, Id, and publisher, Publisher, with a greater version (Version).
#Event ID 5019: Local Content Diagnostic Provider search parameter: Parameter has value: Value.
#Event ID 5020: Search Result includes a diagnostic with the following identifier Id.
#Description
Search Result includes a diagnostic with the following identifier Id. The publisher of the Diagnostic is Publisher. The version of the Diagnostic is Version. The URL for the diagnostic is: Url.
Message #
Fields #
| Name | Description |
|---|---|
Id UnicodeString | |
Publisher UnicodeString | |
Version UnicodeString | |
Url UnicodeString |
Event ID 5021: Deserializing diagnostic from index file IndexPath failed with error code (Error) because the XML does not represent a valid Diagnostic.
#Event ID 5026: Deserializing diagnostic failed index file IndexPath with error code (Error) because the XML does not contain valid XML.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 9363ccd9-d429-4452-9adb-2501e704b810
Defined in sdiagprv.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02