Microsoft-Windows-Input-HIDCLASS

Event	Title	Channel	Sample	Rule
1	Start Rundown	Microsoft-Windows-Input-HIDCLASS-Analytic	Y	N
2	Complete Rundown	Microsoft-Windows-Input-HIDCLASS-Analytic	Y	N
3	HIDCLASS device information	Microsoft-Windows-Input-HIDCLASS-Analytic	Y	N

Event ID 1: Start Rundown

Channel: Microsoft-Windows-Input-HIDCLASS-Analytic
Level: Informational
Task: HIDCLASSRundown
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Input-HIDCLASS",
    "guid": "{6465DA78-E7A0-4F39-B084-8F53C7C30DC6}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 1,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:25:24.189+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-0001-9217-828753F0DC01}"
    },
    "execution": {
      "process_id": 3964,
      "thread_id": 21716
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "HIDCLASS_RUNDOWN"
}

Event ID 2: Complete Rundown

Channel: Microsoft-Windows-Input-HIDCLASS-Analytic
Level: Informational
Task: HIDCLASSRundown
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Input-HIDCLASS",
    "guid": "{6465DA78-E7A0-4F39-B084-8F53C7C30DC6}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 1,
    "opcode": 2,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:25:24.189+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-0001-9217-828753F0DC01}"
    },
    "execution": {
      "process_id": 3964,
      "thread_id": 21716
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "HIDCLASS_RUNDOWN"
}

Event ID 3: HIDCLASS device information

Channel: Microsoft-Windows-Input-HIDCLASS-Analytic
Also via: realtime ETW trace
Level: Informational
Opcode: Information

Fields #

Name	Description
`DeviceStartStatus` UInt32
`VendorID` UInt16
`ProductID` UInt16
`VersionNumber` UInt16
`DeviceInstancePath` UnicodeString
`DeviceDescription` UnicodeString
`DeviceServiceName` UnicodeString
`DeviceUpperFilters` UnicodeString
`DeviceLowerFilters` UnicodeString
`CollectionCount` UInt32
`ReportDescriptorLength` UInt32
`ReportDescriptor` Binary
`DevicePowerState` UInt32
`StateMachineCurrentState` UInt32
`OpenCount` UInt32
`LastReadReportSuccessTime` UInt64
`NumReadReports` UInt64
`NumReadReportsSinceStart` UInt64
`NumReadReportsSincePresence` UInt64
`NumReadReportsSinceD0` UInt64
`NumReadReportsSinceCaptureState` UInt64
`Collections` CountedUtf16String

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Input-HIDCLASS",
    "guid": "{6465DA78-E7A0-4F39-B084-8F53C7C30DC6}",
    "event_source_name": "",
    "event_id": 3,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 10,
    "keywords": "0x0000000000000001",
    "time_created": "2026-06-02T05:25:24.189+00:00",
    "event_record_id": 0,
    "correlation": {
      "ActivityID": "{877F78A1-F053-0001-9217-828753F0DC01}"
    },
    "execution": {
      "process_id": 3964,
      "thread_id": 21716
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CollectionCount": 1,
    "Collections": "01000000010002000100000000C0692AC9000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
    "DeviceDescription": "USB Input Device",
    "DeviceInstancePath": "USB\\VID_0627&PID_0001\\28754-0000:00:01.2-1",
    "DeviceLowerFilters": "",
    "DeviceObject": "0xFFFF878DB92B6060",
    "DevicePowerState": 3,
    "DeviceServiceName": "HidUsb",
    "DeviceUpperFilters": "",
    "LastReadReportSuccessTime": 864000000000,
    "NumReadReports": 2,
    "NumReadReportsSinceCaptureState": 2,
    "NumReadReportsSinceD0": 2,
    "NumReadReportsSincePresence": 2,
    "NumReadReportsSinceStart": 2,
    "OpenCount": 2,
    "PhysicalDeviceObject": "0xFFFF878DB9263060",
    "ProductID": 1,
    "ReportDescriptor": "05010902A1010901A10005091901290515002501950575018102950175038101050109300931150026FF7F350046FF7F751095028102050109381581257F35004500750895018106C0C0",
    "ReportDescriptorLength": 74,
    "StateMachineCurrentState": 2016,
    "VendorID": 1575,
    "VersionNumber": 0
  },
  "message": ""
}

Example keys not documented in the fields table: DeviceObject, PhysicalDeviceObject

Provenance

ETW provider GUID {6465DA78-E7A0-4F39-B084-8F53C7C30DC6}

Defined in hidclass.sys, the binary that emits these events.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB