Microsoft-Windows-EndpointTriggerProvider

Event	Title	Channel	Sample	Rule
1	task_0	Operational	Y	N

Event ID 1: task_0

Channel: Operational
Level: Informational

Fields #

Name	Description
`TriggerSubType` UnicodeString
`TriggerData` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-EndpointTriggerProvider/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 1432,
      "thread_id": 2792
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-EndpointTriggerProvider",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:34:08.689Z",
    "version": 0
  },
  "event_data": {
    "TriggerData": "a111f1c5-5923-47c0-9a68-d0bafb577901",
    "TriggerSubType": "bc90d167-9470-4139-a9ba-be0bbbf5b74d"
  },
  "message": ""
}

Provenance

ETW provider GUID 92aab24d-d9a9-4a60-9f94-201fed3e3e88

Defined in RpcEpMap.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB