Microsoft-Windows-GroupPolicyTriggerProvider
Event ID 1: task_0
#Fields #
| Name | Description |
|---|---|
GPTriggerEventGuid GUID |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-GroupPolicyTriggerProvider/Operational",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 1,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 13180,
"thread_id": 8736
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-GroupPolicyTriggerProvider",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 09:53:26.000Z",
"version": 0
},
"event_data": {
"GPTriggerEventGuid": "{659FCAE6-5BDB-4DA9-B1FF-CA2A178D46E0}"
},
"message": ""
}
Provenance
ETW provider GUID bd2f4252-5e1e-49fc-9a30-f3978ad89ee2
Defined in gpsvc.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB