Microsoft-Windows-FileHistory-Service
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | ConfigurationLoadStart | Debug | N | N |
| 2 | ConfigurationLoadStop | Debug | N | N |
| 3 | CatalogLoadStart | Debug | N | N |
| 4 | CatalogLoadStop | Debug | N | N |
| 5 | ConfigurationSaveStart | Debug | N | N |
| 6 | ConfigurationSaveStop | Debug | N | N |
| 7 | BackupCycleStart | Debug | N | N |
| 8 | BackupCycleStop | Debug | N | N |
| 9 | BackupStopStart | Debug | N | N |
| 10 | BackupStop | Debug | N | N |
Event ID 1: ConfigurationLoadStart
#Event ID 3: CatalogLoadStart
#Fields #
| Name | Description |
|---|---|
CatalogPath1 UnicodeString | |
CatalogPath2 UnicodeString |
Provenance
ETW provider GUID b447b4e0-7780-11e0-ada3-18a90531a85a
Defined in fhsvc.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB