Microsoft-Windows-HostGuardianService-CA
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Platform CA trustlet started. | Operational | N | N |
| 2 | Platform CA trustel stopped. | Operational | N | N |
| 3 | Message. | Debug | N | N |
| 3 | Event ID 3 | Operational | N | N |
| 4 | Message. | Debug | N | N |
| 4 | Event ID 4 | Operational | N | N |
| 5 | Message. | Debug | N | N |
| 5 | Event ID 5 | Operational | N | N |
Provenance
ETW provider GUID 9fb3388c-a54c-4e98-bdd1-445a82ed4bf7
Defined in vmplatformca.exe, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB