detection.wiki

Microsoft-Windows-DirectSound

EventTitleChannelSampleRule
0A DirectSound Stream Switch has started.DebugNN
1A DirectSound Stream Switch has completed with status hr (hrString).DebugNN

Event ID 0: A DirectSound Stream Switch has started.

#
Channel
Debug

Event ID 1: A DirectSound Stream Switch has completed with status hr (hrString).

#
Channel
Debug

Message #

A DirectSound Stream Switch has completed with status %1 (%2).

Fields #

NameDescription
hr UInt32
hrString UnicodeString

Provenance

ETW provider GUID 8a93b54b-c75a-49b5-a5be-9060715b1a33

Defined in dsound.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB