Microsoft-Windows-DXP

Event	Title	Channel	Sample	Rule
1	WorkingSetCompositionStart	Analytic	N	N
2	WorkingSetCompositionStop	Analytic	N	N
3	MetadataAcquisitionStart	Analytic	N	N
4	MetadataAcquisitionStop	Analytic	N	N
5	SignatureVerificationStart	Analytic	N	N
6	SignatureVerificationStop	Analytic	N	N
7	DestinationListCreationStart	Analytic	N	N
8	DestinationListCreationStop	Analytic	N	N
11	AutoPlayLaunchStart	Analytic	N	N
12	AutoPlayLaunchStop	Analytic	N	N
13	LauncherStart	Analytic	N	N
14	LauncherStop	Analytic	N	N
15	Launcher	Analytic	N	N
16	Launcher16	Analytic	N	N
18	LayoutInitialized	Analytic	N	N
19	StatusStart	Analytic	N	N
20	StatusStop	Analytic	N	N
21	Tasks	Analytic	N	N
22	DeviceAccessStart	Analytic	N	N
23	DeviceAccessStop	Analytic	N	N
24	TasksStart	Analytic	N	N
25	TasksStop	Analytic	N	N
26	SSOStart	Analytic	N	N
27	SSOStop	Analytic	N	N
28	DeviceConnectStop	Analytic	N	N
29	DeviceConnectStop29	Analytic	N	N
30	LayoutInitialized30	Analytic	N	N
31	LayoutInitializedStart	Analytic	N	N
32	LayoutInitializedStop	Analytic	N	N
33	LayoutInitialized33	Analytic	N	N

Event ID 1: WorkingSetCompositionStart

Channel: Analytic
Task: WorkingSetComposition
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 2: WorkingSetCompositionStop

Channel: Analytic
Task: WorkingSetComposition
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 3: MetadataAcquisitionStart

Channel: Analytic
Task: MetadataAcquisition
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 4: MetadataAcquisitionStop

Channel: Analytic
Task: MetadataAcquisition
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 5: SignatureVerificationStart

Channel: Analytic
Task: SignatureVerification
Opcode: Start

Fields #

Name	Description
`FileName` UnicodeString

Event ID 6: SignatureVerificationStop

Channel: Analytic
Task: SignatureVerification
Opcode: Stop

Fields #

Name	Description
`FileName` UnicodeString

Event ID 7: DestinationListCreationStart

Channel: Analytic
Task: DestinationListCreation
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 8: DestinationListCreationStop

Channel: Analytic
Task: DestinationListCreation
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 11: AutoPlayLaunchStart

Channel: Analytic
Task: AutoPlayLaunch
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 12: AutoPlayLaunchStop

Channel: Analytic
Task: AutoPlayLaunch
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 13: LauncherStart

Channel: Analytic
Task: Launcher
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 14: LauncherStop

Channel: Analytic
Task: Launcher
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 15: Launcher

Channel: Analytic
Task: Launcher

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 16: Launcher16

Channel: Analytic
Task: Launcher

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 18: LayoutInitialized

Channel: Analytic
Task: LayoutInitialized

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 19: StatusStart

Channel: Analytic
Task: Status
Opcode: Start

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 20: StatusStop

Channel: Analytic
Task: Status
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 21: Tasks

Channel: Analytic
Task: Tasks

Event ID 22: DeviceAccessStart

Channel: Analytic
Task: DeviceAccess
Opcode: Start

Event ID 23: DeviceAccessStop

Channel: Analytic
Task: DeviceAccess
Opcode: Stop

Event ID 24: TasksStart

Channel: Analytic
Task: Tasks
Opcode: Start

Event ID 25: TasksStop

Channel: Analytic
Task: Tasks
Opcode: Stop

Event ID 26: SSOStart

Channel: Analytic
Task: SSO
Opcode: Start

Event ID 27: SSOStop

Channel: Analytic
Task: SSO
Opcode: Stop

Event ID 28: DeviceConnectStop

Channel: Analytic
Task: DeviceConnect
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 29: DeviceConnectStop29

Channel: Analytic
Task: DeviceConnect
Opcode: Stop

Fields #

Name	Description
`DeviceID` UnicodeString

Event ID 30: LayoutInitialized30

Channel: Analytic
Task: LayoutInitialized

Event ID 31: LayoutInitializedStart

Channel: Analytic
Task: LayoutInitialized
Opcode: Start

Fields #

Name	Description
`Object` UInt64

Event ID 32: LayoutInitializedStop

Channel: Analytic
Task: LayoutInitialized
Opcode: Stop

Fields #

Name	Description
`Object` UInt64

Event ID 33: LayoutInitialized33

Channel: Analytic
Task: LayoutInitialized

Fields #

Name	Description
`DeviceID` UnicodeString

Provenance

ETW provider GUID 728b8c72-0f0f-4071-9bcc-27cb3b6dacbe

Defined in dxpserver.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB