Microsoft-Windows-HostGuardianClient-Service
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Host guardian client service is launched. | Operational | N | N |
| 2 | Host guardian client service is shutdown. | Operational | N | N |
| 3 | Host guardian client is started. | Operational | N | N |
| 4 | Host guardian client service is stopped. | Operational | N | N |
| 5 | Message. | Debug | N | N |
| 5 | Event ID 5 | Operational | N | N |
| 6 | Message --> Win32Error. | Debug | N | N |
| 6 | Event ID 6 | Operational | N | N |
| 7 | Message --> Win32Error. | Debug | N | N |
| 7 | Event ID 7 | Operational | N | N |
| 8 | 'Win32Error' error registering service with service control manager. | Admin | N | N |
| 8 | Event ID 8 | Operational | N | N |
| 9 | Failed to load the attestation WMI provider (Str1) at namespace Str2 from path … | Operational | N | N |
| 10 | Failed to load the service plugin from path Message. | Operational | N | N |
| 11 | Failed to initialize global configuration with error Win32Error. | Operational | N | N |
Event ID 1: Host guardian client service is launched.
#Event ID 2: Host guardian client service is shutdown.
#Event ID 3: Host guardian client is started.
#Event ID 4: Host guardian client service is stopped.
#Event ID 6: Message --> Win32Error.
#Event ID 7: Message --> Win32Error.
#Event ID 8: 'Win32Error' error registering service with service control manager.
#Event ID 8
#Description
'Win32Error' error registering service with service control manager.
Fields #
| Name | Description |
|---|---|
Win32Error UInt32 |
Event ID 9: Failed to load the attestation WMI provider (Str1) at namespace Str2 from path Str3.
#Event ID 10: Failed to load the service plugin from path Message.
#Provenance
ETW provider GUID 5d487fad-104b-5ca6-ca4e-14c206850501
Defined in hgclientservice.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB