Microsoft-Windows-Energy-Estimation-Engine

Event	Title	Channel	Sample	Rule
1	InitializeProviderStart	EventLog	Y	N
2	InitializeProviderStop	Trace	N	N
3	UninitializeProvider	EventLog	Y	N
4	QueryStatsStart	Trace	Y	N
5	QueryStatsStop	Trace	Y	N
6	MergeStatsStart	Trace	Y	N
7	MergeStatsStop	Trace	Y	N
8	IndexToAppId	Trace	Y	N
9	IndexToUserId	Trace	N	N
10	QueryColumnInfo	Trace	N	N
11	FreeMemory	Trace	Y	N
12	QueryStatsEnergyEstimate	Trace	N	N
13	MergeStatsEnergyEstimate	Trace	N	N
14	QueryStatsCpuPowerInfo	Trace	Y	N
15	QueryStatsProcessInfo	Trace	N	N
16	QueryStatsAppPerfInfo	Trace	N	N
17	QueryStatsEnergyDelta	Trace	N	N
18	QueryStatsEnergyDelta18	Trace	Y	N
19	DisplayEnergyMonitorPowerState	Trace	N	N
20	DisplayEnergyPolicyBrightness	Trace	N	N
21	DisplayEnergyActualBrightness	Trace	N	N
22	QueryStatsResidualEnergy	Trace	N	N
23	QueryStatsResidualEnergy23	Trace	N	N
24	QueryStatsBatteryState	Trace	N	N
25	QueryStatsMapProcessToApp	Trace	N	N
26	QueryStatsAppForegroundTime	Trace	N	N
27	QueryStatsAppForegroundTime27	Trace	N	N
28	AppInteractivityState	Trace	N	N
29	AppInteractivityState29	Trace	N	N
30	AisResidencyDelta	Trace	N	N
31	AisResidencyDelta31	Trace	N	N
32	EnergyNotification	Trace	N	N
33	QueryStats	Trace	Y	N
34	StandbyActivationTime	Trace	N	N
35	StandbyDripsTime	Trace	N	N
36	UnknownEnergy	Trace	N	N
37	QueryStatsEnergyEstimate37_V2	Trace	Y	N
38	MergeStatsEnergyEstimate38_V2	Trace	Y	N
39	CommittedStatsEnergyEstimate	Trace	N	N
40	ProcessTagEnergyEstimate_V1	Trace	Y	N
41	RpcSetProcessTag	Trace	N	N
42	InitializeProviderDisplayTechnology	Trace	N	N
43	InitializeProviderDisplayModelInitStatus	Trace	N	N
44	InitializeProviderLcdRegistryValueUsingDefault	Trace	N	N
45	InitializeProviderLcdReadDwordFromRegistry	Trace	N	N
46	InitializeProviderBacklightMinimumPointCountError	Trace	N	N
47	InitializeProviderBacklightBrightnessRangeNot0to100	Trace	N	N
48	InitializeProviderBacklightPowerValueTooHighError	Trace	N	N
49	InitializeProviderBacklightPowerCurveError	Trace	N	N

Event ID 1: InitializeProviderStart

Channel: EventLog
Level: Informational
Task: InitializeProvider
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "guid": "DDCC3826-A68A-4E0D-BCFD-9C06C27C6948",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-13T20:05:06.399505+00:00",
    "event_record_id": 1,
    "correlation": {
      "ActivityID": "A5B814C5-B324-0008-B715-B8A524B3DC01"
    },
    "execution": {
      "process_id": 3832,
      "thread_id": 4664
    },
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/EventLog",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 2: InitializeProviderStop

Channel: Trace
Task: InitializeProvider
Opcode: Stop

Event ID 3: UninitializeProvider

Channel: EventLog
Level: Informational
Task: UninitializeProvider

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "guid": "{DDCC3826-A68A-4E0D-BCFD-9C06C27C6948}",
    "event_source_name": "",
    "event_id": 3,
    "version": 0,
    "level": 4,
    "task": 2,
    "opcode": 0,
    "keywords": 4611686018427387905,
    "time_created": "2026-03-20T18:58:09.4178812+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 3740,
      "thread_id": 10532
    },
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/EventLog",
    "computer": "JD-WIN11-22H2-1.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {},
  "message": ""
}

Event ID 4: QueryStatsStart

Channel: Trace
Level: Informational
Task: QueryStats
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 4,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.004Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 5: QueryStatsStop

Channel: Trace
Level: Informational
Task: QueryStats
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 5,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.019Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 6: MergeStatsStart

Channel: Trace
Level: Informational
Task: MergeStats
Opcode: Start

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 6,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.019Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 7: MergeStatsStop

Channel: Trace
Level: Informational
Task: MergeStats
Opcode: Stop

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.029Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 8: IndexToAppId

Channel: Trace
Level: Informational
Task: IndexToAppId

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.011Z",
    "version": 0
  },
  "event_data": {},
  "message": ""
}

Event ID 9: IndexToUserId

Channel: Trace
Task: IndexToUserId

Event ID 10: QueryColumnInfo

Channel: Trace
Task: QueryColumnInfo

Event ID 11: FreeMemory

Channel: Trace
Level: Informational
Task: FreeMemory

Fields #

Name	Description
`DataType` UInt32
`Address` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 11,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.374Z",
    "version": 0
  },
  "event_data": {
    "Address": "0x1DEA2F0D990",
    "DataType": 1
  },
  "message": ""
}

Event ID 12: QueryStatsEnergyEstimate

Channel: Trace
Task: QueryStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`SocEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`OtherEnergy` UInt64
`RecordFlags` UInt32

Event ID 13: MergeStatsEnergyEstimate

Channel: Trace
Task: MergeStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`SocEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`OtherEnergy` UInt64
`RecordFlags` UInt32

Event ID 14: QueryStatsCpuPowerInfo

Channel: Trace
Level: Informational
Task: QueryStats
Opcode: CpuPowerInfo

Fields #

Name	Description
`CpuId` UInt32
`CurrentFrequency` UInt8
`LastBusyFrequency` UInt8
`Energy` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 14,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 11,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.011Z",
    "version": 0
  },
  "event_data": {
    "CpuId": 0,
    "CurrentFrequency": 0,
    "Energy": 0,
    "LastBusyFrequency": 0
  },
  "message": ""
}

Event ID 15: QueryStatsProcessInfo

Channel: Trace
Task: QueryStats
Opcode: ProcessInfo

Fields #

Name	Description
`SessionId` UInt32
`UniqueProcessId` UInt32
`ImageName` UnicodeString
`NumberOfThreads` UInt32
`CycleTime` UInt64
`ReadOperationCount` UInt64
`BytesRead` UInt64
`WriteOperationCount` UInt64
`BytesWritten` UInt64
`DiskEnergy` UInt64
`NetworkTailEnergy` UInt64
`MBBTailEnergy` UInt64
`NetworkTxRxBytes` UInt64
`MBBTxRxBytes` UInt64
`BucketCount` UInt32
`BucketedCycles` SID
`WindowInformation` UInt32
`ForegroundReportTimestamp` UInt64
`ForegroundTime` UInt64

Event ID 16: QueryStatsAppPerfInfo

Channel: Trace
Task: QueryStats
Opcode: AppPerfInfo

Fields #

Name	Description
`UniqueApplicationId` UInt64
`PackageFullName` UnicodeString
`ForegroundCycleTime` UInt64
`BackgroundCycleTime` UInt64
`ForegroundActiveTime` UInt64
`ForegroundBytesRead` UInt64
`ForegroundBytesWritten` UInt64
`BackgroundBytesRead` UInt64
`BackgroundBytesWritten` UInt64
`BucketCount` UInt32
`ForegroundCycles` CountedUtf16String
`ForegroundDiskEnergy` UInt64
`ForegroundNetworkTailEnergy` UInt64
`ForegroundMBBTailEnergy` UInt64
`ForegroundNetworkTxRxBytes` UInt64
`ForegroundMBBTxRxBytes` UInt64
`BackgroundCycles` 25
`BackgroundDiskEnergy` UInt64
`BackgroundNetworkTailEnergy` UInt64
`BackgroundMBBTailEnergy` UInt64
`BackgroundNetworkTxRxBytes` UInt64
`BackgroundMBBTxRxBytes` UInt64

Event ID 17: QueryStatsEnergyDelta

Channel: Trace
Task: QueryStats
Opcode: EnergyDelta

Fields #

Name	Description
`Component` UInt32
`EnergyDelta` UInt64

Event ID 18: QueryStatsEnergyDelta18

Channel: Trace
Level: Informational
Task: QueryStats
Opcode: EnergyDelta

Fields #

Name	Description
`Component` UInt32
`EnergyDelta` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 18,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 14,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.011Z",
    "version": 0
  },
  "event_data": {
    "Component": 5,
    "EnergyDelta": 15060000
  },
  "message": ""
}

Event ID 19: DisplayEnergyMonitorPowerState

Channel: Trace
Task: DisplayEnergy
Opcode: MonitorPowerState

Fields #

Name	Description
`PreviousState` UInt8
`CurrentState` UInt8

Event ID 20: DisplayEnergyPolicyBrightness

Channel: Trace
Task: DisplayEnergy
Opcode: PolicyBrightness

Fields #

Name	Description
`PreviousValue` UInt8
`CurrentValue` UInt8

Event ID 21: DisplayEnergyActualBrightness

Channel: Trace
Task: DisplayEnergy
Opcode: ActualBrightness

Fields #

Name	Description
`PreviousValue` UInt8
`CurrentValue` UInt8

Event ID 22: QueryStatsResidualEnergy

Channel: Trace
Task: QueryStats
Opcode: ResidualEnergy

Fields #

Name	Description
`BatteryDrain` UInt64
`EstimatedEnergy` UInt64
`ResidualEnergy` Int64

Event ID 23: QueryStatsResidualEnergy23

Channel: Trace
Task: QueryStats
Opcode: ResidualEnergy

Fields #

Name	Description
`AgeInSec` UInt16
`AdjustedEnergy` UInt64
`ResidualEnergy` Int64

Event ID 24: QueryStatsBatteryState

Channel: Trace
Task: QueryStats
Opcode: BatteryState

Fields #

Name	Description
`StateFlags` UInt32
`MaxCapacity` UInt32
`RemainingCapacity` UInt32
`Rate` UInt32
`EstimatedTime` UInt32

Event ID 25: QueryStatsMapProcessToApp

Channel: Trace
Task: QueryStats
Opcode: MapProcessToApp

Fields #

Name	Description
`UniqueApplicationId` UInt64
`PackageFullName` UnicodeString
`SessionId` UInt32
`UniqueProcessId` UInt32
`ImageName` UnicodeString

Event ID 26: QueryStatsAppForegroundTime

Channel: Trace
Task: QueryStats
Opcode: AppForegroundTime

Fields #

Name	Description
`UniqueApplicationId` UInt64
`ForegroundTime` UInt64

Event ID 27: QueryStatsAppForegroundTime27

Channel: Trace
Task: QueryStats
Opcode: AppForegroundTime

Fields #

Name	Description
`UniqueApplicationId` UInt64
`ForegroundTimeDelta` UInt64

Event ID 28: AppInteractivityState

Channel: Trace
Task: AppInteractivityState

Fields #

Name	Description
`UniqueProcessId` UInt32
`InteractivityState` UInt32

Event ID 29: AppInteractivityState29

Channel: Trace
Task: AppInteractivityState

Fields #

Name	Description
`UniqueApplicationId` UInt64
`InteractivityState` UInt32

Event ID 30: AisResidencyDelta

Channel: Trace
Task: AisResidencyDelta

Fields #

Name	Description
`UniqueProcessId` UInt32
`FcousTime` UInt64
`VisibleTime` UInt64
`MinimizedTime` UInt64
`DirtyGenerated` UInt32
`DirtyPropagated` UInt32
`CompositorRendered` UInt32

Event ID 31: AisResidencyDelta31

Channel: Trace
Task: AisResidencyDelta

Fields #

Name	Description
`UniqueApplicationId` UInt64
`FcousTime` UInt64
`VisibleTime` UInt64
`MinimizedTime` UInt64
`DirtyGenerated` UInt32
`DirtyPropagated` UInt32
`CompositorRendered` UInt32

Event ID 32: EnergyNotification

Channel: Trace
Task: EnergyNotification
Opcode: EnergyNotification

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`Cookie` UInt32
`BackgroundScreenOffmJ` UInt32
`BackgroundScreenOnmJ` UInt32
`ForegroundScreenOffmJ` UInt32
`ForegroundScreenOnmJ` UInt32

Event ID 33: QueryStats

Channel: Trace
Level: Informational
Task: QueryStats

Fields #

Name	Description
`SruWorkItemType` UInt32
`ProviderState` UInt32
`DeviceState` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 33,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.004Z",
    "version": 0
  },
  "event_data": {
    "DeviceState": 3,
    "ProviderState": 3,
    "SruWorkItemType": 0
  },
  "message": ""
}

Event ID 34: StandbyActivationTime

Channel: Trace
Task: StandbyActivationTime
Opcode: StandbyActivationTime

Fields #

Name	Description
`PdcClientId` UInt16
`LastSnapValue` UInt64
`CurrSnapValue` UInt64
`Delta` UInt64

Event ID 35: StandbyDripsTime

Channel: Trace
Task: StandbyDripsTime
Opcode: StandbyDripsTime

Fields #

Name	Description
`LastStandbyTotal` UInt64
`CurrStandbyTotal` UInt64
`DeltaStandbyTotal` UInt64
`LastDripsTotal` UInt64
`CurrDripsTotal` UInt64
`DeltaDripsTotal` UInt64
`LastActivationTotal` UInt64
`CurrActivationTotal` UInt64
`DeltaActivationTotal` UInt64

Event ID 36: UnknownEnergy

Channel: Trace
Task: UnknownEnergy
Opcode: UnknownEnergy

Fields #

Name	Description
`TotalDuration` UInt64
`StandbyDuration` UInt64
`NonDripsDuration` UInt64
`PdcDuration` UInt64
`BIDuration` UInt64
`TargetedBIEnergy` UInt64
`ActualBIEnergy` UInt64
`UnknownEnergy` UInt64
`ScaleFactor` UInt64
`Policy` UInt32
`DripsPowerFloorMilliWatts` UInt32
`NonDripsPenaltyMilliWatts` UInt32

Event ID 37: QueryStatsEnergyEstimate37_V2

Channel: Trace
Level: Informational
Task: QueryStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`GpuEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`LossEnergy` UInt64
`OtherEnergy` UInt64
`EmiEnergy` UInt64
`ForInternalUse` UInt64
`TimeInMSec` UInt32
`RecordFlags` UInt32
`RecordMeasured` UInt32
`InteractivityState` UInt32
`Committed` UInt32
`WorkOnBehalfCPUEnergy` UInt64
`AttributedCPUEnergy` UInt64
`NpuEnergy` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 37,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.011Z",
    "version": 0
  },
  "event_data": {
    "AppName": "\\Device\\HarddiskVolume4\\Windows\\System32\\SearchIndexer.exe",
    "Committed": 0,
    "CpuEnergy": 57,
    "DiskEnergy": 0,
    "DisplayEnergy": 0,
    "EmiEnergy": 0,
    "ForInternalUse": 0,
    "InteractivityState": 0,
    "LossEnergy": 0,
    "MbbEnergy": 0,
    "NetworkEnergy": 0,
    "OtherEnergy": 0,
    "RecordFlags": 18,
    "RecordMeasured": 0,
    "SocEnergy": 0,
    "TimeInMSec": 59999,
    "UserId": 2
  },
  "message": ""
}

Example keys not documented in the fields table: SocEnergy

Event ID 38: MergeStatsEnergyEstimate38_V2

Channel: Trace
Level: Informational
Task: MergeStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`CpuEnergy` UInt64
`GpuEnergy` UInt64
`DisplayEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`LossEnergy` UInt64
`OtherEnergy` UInt64
`EmiEnergy` UInt64
`ForInternalUse` UInt64
`TimeInMSec` UInt32
`RecordFlags` UInt32
`RecordMeasured` UInt32
`InteractivityState` UInt32
`Committed` UInt32
`WorkOnBehalfCPUEnergy` UInt64
`AttributedCPUEnergy` UInt64
`NpuEnergy` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 38,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 5372
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 10,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.021Z",
    "version": 0
  },
  "event_data": {
    "AppName": "Microsoft.AAD.BrokerPlugin_1000.19580.1000.2_neutral_neutral_cw5n1h2txyewy",
    "Committed": 1,
    "CpuEnergy": 6753,
    "DiskEnergy": 139,
    "DisplayEnergy": 0,
    "EmiEnergy": 0,
    "ForInternalUse": 0,
    "InteractivityState": 0,
    "LossEnergy": 0,
    "MbbEnergy": 0,
    "NetworkEnergy": 3,
    "OtherEnergy": 0,
    "RecordFlags": 2,
    "RecordMeasured": 0,
    "SocEnergy": 0,
    "TimeInMSec": 479978,
    "UserId": 5
  },
  "message": ""
}

Example keys not documented in the fields table: SocEnergy

Event ID 39: CommittedStatsEnergyEstimate

Channel: Trace
Task: CommittedStats
Opcode: EnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`UserId` UInt16
`LossEnergy` UInt64
`UnknownEnergy` UInt64
`RecordFlags` UInt32
`InteractivityState` UInt32

Event ID 40: ProcessTagEnergyEstimate_V1

Channel: Trace
Level: Informational
Task: ProcessTagEnergyEstimate

Fields #

Name	Description
`AppName` UnicodeString
`Tag` UnicodeString
`CpuEnergy` UInt64
`DiskEnergy` UInt64
`NetworkEnergy` UInt64
`MbbEnergy` UInt64
`Time` UInt32
`RecordFlags` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Energy-Estimation-Engine/Trace",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 40,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 3184,
      "thread_id": 8024
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Energy-Estimation-Engine",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 23:56:00.003Z",
    "version": 0
  },
  "event_data": {
    "AppName": "MicrosoftWindows.Client.CBS_1000.22700.1106.0_x64__cw5n1h2txyewy",
    "CpuEnergy": 698443,
    "DiskEnergy": 0,
    "MbbEnergy": 0,
    "NetworkEnergy": 0,
    "RecordFlags": 3,
    "Tag": "{00000000-0000-0000-0000-000000000000}:v",
    "Time": 120000
  },
  "message": ""
}

Event ID 41: RpcSetProcessTag

Channel: Trace
Task: RpcSetProcessTag

Fields #

Name	Description
`ProcessId` UInt32
`CreateTime` UInt64
`Tag` UnicodeString
`DiskEnergy` UInt64
`NetworkTailEnergy` UInt64
`MBBTailEnergy` UInt64
`NetworkTxRxBytes` UInt64
`MBBTxRxBytes` UInt64
`BucketCount` UInt32
`BucketedCycles` Float
`ErrorCode` UInt32

Event ID 42: InitializeProviderDisplayTechnology

Channel: Trace
Task: InitializeProvider
Opcode: DisplayTechnology

Fields #

Name	Description
`DisplayTechnology` UInt32

Event ID 43: InitializeProviderDisplayModelInitStatus

Channel: Trace
Task: InitializeProvider
Opcode: DisplayModelInitStatus

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 44: InitializeProviderLcdRegistryValueUsingDefault

Channel: Trace
Task: InitializeProvider
Opcode: LcdRegistryValueUsingDefault

Fields #

Name	Description
`ValueName` UnicodeString
`DefaultValue` UInt32

Event ID 45: InitializeProviderLcdReadDwordFromRegistry

Channel: Trace
Task: InitializeProvider
Opcode: LcdReadDwordFromRegistry

Fields #

Name	Description
`ValueName` UnicodeString
`RegistryValue` UInt32
`SetValue` UInt32
`MinimumValue` UInt32
`MaximumValue` UInt32

Event ID 46: InitializeProviderBacklightMinimumPointCountError

Channel: Trace
Task: InitializeProvider
Opcode: BacklightMinimumPointCountError

Fields #

Name	Description
`PointCount` UInt32
`MinimumPointCount` UInt32

Event ID 47: InitializeProviderBacklightBrightnessRangeNot0to100

Channel: Trace
Task: InitializeProvider
Opcode: BacklightBrightnessRangeNot0to100

Fields #

Name	Description
`FirstBrightnessPercent` UInt32
`LastBrightnessPercent` UInt32

Event ID 48: InitializeProviderBacklightPowerValueTooHighError

Channel: Trace
Task: InitializeProvider
Opcode: BacklightPowerValueTooHighError

Fields #

Name	Description
`BacklightPower` UInt32
`MaximumBacklightPower` UInt32

Event ID 49: InitializeProviderBacklightPowerCurveError

Channel: Trace
Task: InitializeProvider
Opcode: BacklightPowerCurveError

Fields #

Name	Description
`Index` UInt32
`CurrentBrightnessPercent` UInt32
`PreviousBrightnessPercent` UInt32
`CurrentBacklightPower` UInt32
`PreviousBacklightPower` UInt32
`MaximumBacklightPower` UInt32

Provenance

ETW provider GUID ddcc3826-a68a-4e0d-bcfd-9c06c27c6948

Defined in eeprov.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB