detection.wiki

Microsoft-Windows-IdCtrls

EventTitleChannelSampleRule
5001Cannot navigate to a non SSL URL - URL.OperationalNN
5002Invalid web page on document complete from URL.OperationalNN
5003Failed to navigate on URL for TargetFrameName TargetFrameName.OperationalNN
5004Blocked a popup window from URL for ReferrerUrl ReferrerUrl.OperationalNN
5005Failed to navigate on wizard ID WizardID through URL - URL.OperationalNN
5006Failed to execute [Method].OperationalNN
5007Failed to execute [Method] for [String].OperationalNN
5008Failed to invoke command in host for DISPID DISPID on parameter ArgErr.OperationalNN
5009Failed to navigate due to security problem SecurityProblem.OperationalNN
5010Failed to Get alternative URL for Wizard ID WizardID.OperationalNN
5011Security manager handle URL URL action Action as policy Policy.OperationalNN
5012Security manager allow ActiveX control for CLSID CLSID.OperationalNN
5013Security manager disallow ActiveX control for CLSID CLSID.OperationalNN
5014QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID.OperationalNN
5015QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID.OperationalNN
5016QueryCustomPolicy(ObjectSafety) default action for GUID CLSID.OperationalNN
5017Before navigate to URL.OperationalNN
5018Navigate completed on URL.OperationalNN
5019Document completed on URL.OperationalNN
5020Navigate Redirected to URL.OperationalNN
5021Window resized to cx: cx, cy: cy.OperationalNN
5022Succeeded on executing [Method].OperationalNN
5023Succeeded on executing [Method] for [String].OperationalNN
5024Executed [Method] for [String].OperationalNN
5025Showing browser windowOperationalNN
5026Showing progress windowOperationalNN
5027Failed to execute [Method] for [String].OperationalNN
7001Perf_IdControl_CreateControlStartAnalyticNN
7002Perf_IdControl_CreateControlStopAnalyticNN
7003Perf_IdControl_GetInitialURLStartAnalyticNN
7004Perf_IdControl_GetInitialURLStopAnalyticNN
7005Perf_IdControl_NavigateStartAnalyticNN
7006Perf_IdControl_NavigateStopAnalyticNN

Event ID 5001: Cannot navigate to a non SSL URL - URL.

#
Channel
Operational

Message #

Cannot navigate to a non SSL URL - %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5002: Invalid web page on document complete from URL.

#
Channel
Operational

Message #

Invalid web page on document complete from %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5003: Failed to navigate on URL for TargetFrameName TargetFrameName.

#
Channel
Operational

Description

Failed to navigate on URL for TargetFrameName TargetFrameName. (StatusCode StatusCode).

Message #

Failed to navigate on %1 for TargetFrameName %2. (StatusCode %3)

Fields #

NameDescription
URL UnicodeString
TargetFrameName UnicodeString
StatusCode UInt32NTSTATUS reference

Event ID 5004: Blocked a popup window from URL for ReferrerUrl ReferrerUrl.

#
Channel
Operational

Description

Blocked a popup window from URL for ReferrerUrl ReferrerUrl. (Flags Flags).

Message #

Blocked a popup window from %1 for ReferrerUrl %2. (Flags %3)

Fields #

NameDescription
URL UnicodeString
ReferrerUrl UnicodeString
Flags UInt32

Event ID 5005: Failed to navigate on wizard ID WizardID through URL - URL.

#
Channel
Operational

Description

Failed to navigate on wizard ID WizardID through URL - URL. (Result HRESULT).

Message #

Failed to navigate on wizard ID %1 through URL - %2. (Result %3)

Fields #

NameDescription
WizardID UInt32
URL UnicodeString
HRESULT UInt32

Event ID 5006: Failed to execute [Method].

#
Channel
Operational

Description

Failed to execute [Method]. (Result HRESULT).

Message #

Failed to execute [%1]. (Result %2)

Fields #

NameDescription
Method UnicodeString
HRESULT UInt32

Event ID 5007: Failed to execute [Method] for [String].

#
Channel
Operational

Description

Failed to execute [Method] for [String]. (Result HRESULT).

Message #

Failed to execute [%1] for [%2]. (Result %3)

Fields #

NameDescription
Method UnicodeString
String UnicodeString
HRESULT UInt32

Event ID 5008: Failed to invoke command in host for DISPID DISPID on parameter ArgErr.

#
Channel
Operational

Description

Failed to invoke command in host for DISPID DISPID on parameter ArgErr. (Result HRESULT).

Message #

Failed to invoke command in host for DISPID %1 on parameter %2. (Result %3)

Fields #

NameDescription
DISPID UInt32
ArgErr UInt32
HRESULT UInt32

References #

Event ID 5009: Failed to navigate due to security problem SecurityProblem.

#
Channel
Operational

Description

Failed to navigate due to security problem SecurityProblem. (Result HRESULT).

Message #

Failed to navigate due to security problem %1. (Result %2)

Fields #

NameDescription
SecurityProblem UInt32
HRESULT UInt32

References #

Event ID 5010: Failed to Get alternative URL for Wizard ID WizardID.

#
Channel
Operational

Description

Failed to Get alternative URL for Wizard ID WizardID. (Result HRESULT).

Message #

Failed to Get alternative URL for Wizard ID %1. (Result %2)

Fields #

NameDescription
WizardID UInt32
HRESULT UInt32

References #

Event ID 5011: Security manager handle URL URL action Action as policy Policy.

#
Channel
Operational

Description

Security manager handle URL URL action Action as policy Policy. (Result HRESULT).

Message #

Security manager handle URL %1 action %2 as policy %3. (Result %4)

Fields #

NameDescription
URL UnicodeString
Action UInt32
Policy UInt32
HRESULT UInt32

References #

Event ID 5012: Security manager allow ActiveX control for CLSID CLSID.

#
Channel
Operational

Description

Security manager allow ActiveX control for CLSID CLSID. (URL URL).

Message #

Security manager allow ActiveX control for CLSID %1. (URL %2)

Fields #

NameDescription
CLSID GUID
URL UnicodeString

References #

Event ID 5013: Security manager disallow ActiveX control for CLSID CLSID.

#
Channel
Operational

Description

Security manager disallow ActiveX control for CLSID CLSID. (URL URL).

Message #

Security manager disallow ActiveX control for CLSID %1. (URL %2)

Fields #

NameDescription
CLSID GUID
URL UnicodeString

References #

Event ID 5014: QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID.

#
Channel
Operational

Description

QueryCustomPolicy(ObjectSafety) default action for CLSID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) default action for CLSID %1. (URL %2)

Fields #

NameDescription
CLSID GUID
URL UnicodeString

Event ID 5015: QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID.

#
Channel
Operational

Description

QueryCustomPolicy(ObjectSafety) disallowed for CLSID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) disallowed for CLSID %1. (URL %2)

Fields #

NameDescription
CLSID GUID
URL UnicodeString

Event ID 5016: QueryCustomPolicy(ObjectSafety) default action for GUID CLSID.

#
Channel
Operational

Description

QueryCustomPolicy(ObjectSafety) default action for GUID CLSID. (URL URL).

Message #

QueryCustomPolicy(ObjectSafety) default action for GUID %1. (URL %2)

Fields #

NameDescription
CLSID GUID
URL UnicodeString

Event ID 5017: Before navigate to URL.

#
Channel
Operational

Message #

Before navigate to %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5018: Navigate completed on URL.

#
Channel
Operational

Message #

Navigate completed on %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5019: Document completed on URL.

#
Channel
Operational

Message #

Document completed on %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5020: Navigate Redirected to URL.

#
Channel
Operational

Message #

Navigate Redirected to %1.

Fields #

NameDescription
URL UnicodeString

Event ID 5021: Window resized to cx: cx, cy: cy.

#
Channel
Operational

Message #

Window resized to cx: %1, cy: %2.

Fields #

NameDescription
cx UInt32
cy UInt32

Event ID 5022: Succeeded on executing [Method].

#
Channel
Operational

Message #

Succeeded on executing [%1].

Fields #

NameDescription
Method UnicodeString

Event ID 5023: Succeeded on executing [Method] for [String].

#
Channel
Operational

Message #

Succeeded on executing [%1] for [%2].

Fields #

NameDescription
Method UnicodeString
String UnicodeString

Event ID 5024: Executed [Method] for [String].

#
Channel
Operational

Description

Executed [Method] for [String]. (Result HRESULT).

Message #

Executed [%1] for [%2]. (Result %3)

Fields #

NameDescription
Method UnicodeString
String UnicodeString
HRESULT UInt32

Event ID 5025: Showing browser window

#
Channel
Operational

References #

Event ID 5026: Showing progress window

#
Channel
Operational

Event ID 5027: Failed to execute [Method] for [String].

#
Channel
Operational

Description

Failed to execute [Method] for [String]. Extended error text: Extended String. (Result HRESULT).

Message #

Failed to execute [%1] for [%2]. Extended error text: %3. (Result %4)

Fields #

NameDescription
Method UnicodeString
String UnicodeString
ExtendedString UnicodeString
HRESULT UInt32

References #

Event ID 7001: Perf_IdControl_CreateControlStart

#
Channel
Analytic
Task
Perf_IdControl_CreateControl
Opcode
Start

Event ID 7002: Perf_IdControl_CreateControlStop

#
Channel
Analytic
Task
Perf_IdControl_CreateControl
Opcode
Stop

Event ID 7003: Perf_IdControl_GetInitialURLStart

#
Channel
Analytic
Task
Perf_IdControl_GetInitialURL
Opcode
Start

Event ID 7004: Perf_IdControl_GetInitialURLStop

#
Channel
Analytic
Task
Perf_IdControl_GetInitialURL
Opcode
Stop

Event ID 7005: Perf_IdControl_NavigateStart

#
Channel
Analytic
Task
Perf_IdControl_Navigate
Opcode
Start

Event ID 7006: Perf_IdControl_NavigateStop

#
Channel
Analytic
Task
Perf_IdControl_Navigate
Opcode
Stop

Provenance

ETW provider GUID 6d7662a9-034e-4b1f-a167-67819c401632

Defined in IdCtrls.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB