Microsoft-Windows-EnergyEfficiencyWizard

Event	Title	Channel	Sample	Rule
1	EnableProvidersNTKL	Diagnostic	N	N
2	EnableProvidersEtwProvider	Diagnostic	N	N
3	TraceStart	Diagnostic	N	N
4	TraceStop	Diagnostic	N	N

Event ID 1: EnableProvidersNTKL

Channel: Diagnostic
Task: EnableProviders
Opcode: NTKL

Fields #

Name	Description
`KernelFlags` UInt32

Event ID 2: EnableProvidersEtwProvider

Channel: Diagnostic
Task: EnableProviders
Opcode: EtwProvider

Fields #

Name	Description
`ProviderGUID` GUID
`Rundown` UInt32

Event ID 3: TraceStart

Channel: Diagnostic
Task: Trace
Opcode: Start

Event ID 4: TraceStop

Channel: Diagnostic
Task: Trace
Opcode: Stop

Provenance

ETW provider GUID 1a772f65-be1e-4fc6-96bb-248e03fa60f5

Defined in energy.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3624, captured 2026-06-02 — Manifest XML pack, 2.0 MB