Microsoft-Windows-FileHistory-ConfigManager
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | ValidateTargetStart | Debug | N | N |
| 2 | ValidateTargetStop | Debug | N | N |
| 3 | ProvisionAndSetTargetStart | Debug | N | N |
| 4 | ProvisionAndSetTargetStop | Debug | N | N |
| 5 | ReassociationStart | Debug | N | N |
| 6 | ReassociationStop | Debug | N | N |
| 7 | ReassociationStart7 | Debug | N | N |
| 8 | ReassociationStop8 | Debug | N | N |
| 9 | MigrationStart | Debug | N | N |
| 10 | MigrationStop | Debug | N | N |
| 11 | MigrationStart11 | Debug | N | N |
| 12 | MigrationStop12 | Debug | N | N |
| 13 | MigrationStart13 | Debug | N | N |
| 14 | MigrationStop14 | Debug | N | N |
| 15 | SettingChangeNotification | Debug | N | N |
Event ID 8: ReassociationStop8
#Event ID 10: MigrationStop
#Event ID 12: MigrationStop12
#Event ID 14: MigrationStop14
#Event ID 15: SettingChangeNotification
#Provenance
ETW provider GUID b447b4dd-7780-11e0-ada3-18a90531a85a
Defined in fhsvc.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB