Microsoft-Windows-Dwm-Dwm
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | CompositionStateAndInput | Diagnostic | N | N |
| 2 | CompositionStateOutput | Diagnostic | N | N |
| 3 | TraceGraphicsCapabilities | Diagnostic | N | N |
| 4 | CompositionOverriden | Diagnostic | N | N |
| 5 | CompositionEnabledByPolicy | Diagnostic | N | N |
| 6 | RemotingCaps | Diagnostic | N | N |
| 7 | SystemMemoryLockingThreshold | Diagnostic | N | N |
| 8 | SlowCompositionTime | Diagnostic | N | N |
| 9 | StartDWMTransport | Diagnostic | N | N |
| 10 | StopDWMTransport | Diagnostic | N | N |
| 11 | AddGhost | Diagnostic | N | N |
| 12 | DuplicateGhost | Diagnostic | N | N |
| 13 | VetoCreateGhostWindow | Diagnostic | N | N |
| 14 | PolicyOrModeChange | Diagnostic | N | N |
| 15 | EstablishKernelRedirection | Diagnostic | N | N |
Event ID 6: RemotingCaps
#Fields #
| Name | Description |
|---|---|
IsCapable UInt32 | |
AllowDwmcoreInSession UInt32 | |
RemoteAppEnabled UInt32 | |
AllowDwmcoreInClient UInt32 | |
AllowThemesInCLient UInt32 |
Event ID 7: SystemMemoryLockingThreshold
#Event ID 8: SlowCompositionTime
#Event ID 10: StopDWMTransport
#Event ID 15: EstablishKernelRedirection
#Provenance
ETW provider GUID d29d56ea-4867-4221-b02e-cfd998834075
Defined in dwm.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB