Microsoft-Windows-InputSwitch
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | InitializeBackendStart | Diagnostic | N | N |
| 2 | InitializeBackendStop | Diagnostic | N | N |
| 3 | ShutdownBackendStart | Diagnostic | N | N |
| 4 | ShutdownBackendStop | Diagnostic | N | N |
| 5 | ShowInputSwitchStart | Diagnostic | N | N |
| 6 | ShowInputSwitchStop | Diagnostic | N | N |
| 7 | HideInputSwitchStart | Diagnostic | N | N |
| 8 | HideInputSwitchStop | Diagnostic | N | N |
| 9 | SelectInputMethodStart | Diagnostic | N | N |
| 10 | SelectInputMethodStop | Diagnostic | N | N |
| 11 | SelectInputModalityStart | Diagnostic | N | N |
| 12 | SelectInputModalityStop | Diagnostic | N | N |
| 13 | SelectInputModality | Diagnostic | N | N |
| 14 | ClickOrTouchOrEnterReceived | Diagnostic | N | N |
| 15 | ModalitySelectedStandard | Diagnostic | N | N |
| 16 | ModalitySelectedSplit | Diagnostic | N | N |
| 17 | ModalitySelectedHandwriting | Diagnostic | N | N |
| 18 | ModalitySelectedClassic | Diagnostic | N | N |
| 19 | ModalitySelectedOneHanded | Diagnostic | N | N |
| 20 | ModeIconUpdate | Diagnostic | N | N |
| 21 | ModeIconClear | Diagnostic | N | N |
| 22 | ModeIconLeftClick | Diagnostic | N | N |
| 23 | ModeIconRightClick | Diagnostic | N | N |
| 26 | IMEConsentUXFlyoutShowStart | Diagnostic | N | N |
| 27 | IMEConsentUXFlyoutShowStop | Diagnostic | N | N |
| 28 | IMEConsentUXFlyoutDismissStart | Diagnostic | N | N |
| 29 | IMEConsentUXFlyoutDismissStop | Diagnostic | N | N |
Event ID 1: InitializeBackendStart
#Event ID 3: ShutdownBackendStart
#Event ID 5: ShowInputSwitchStart
#Event ID 7: HideInputSwitchStart
#Event ID 9: SelectInputMethodStart
#Event ID 11: SelectInputModalityStart
#Event ID 14: ClickOrTouchOrEnterReceived
#Event ID 15: ModalitySelectedStandard
#Event ID 16: ModalitySelectedSplit
#Event ID 17: ModalitySelectedHandwriting
#Event ID 18: ModalitySelectedClassic
#Event ID 19: ModalitySelectedOneHanded
#Event ID 20: ModeIconUpdate
#Event ID 21: ModeIconClear
#Event ID 22: ModeIconLeftClick
#Event ID 23: ModeIconRightClick
#Event ID 26: IMEConsentUXFlyoutShowStart
#Event ID 27: IMEConsentUXFlyoutShowStop
#Event ID 28: IMEConsentUXFlyoutDismissStart
#Event ID 29: IMEConsentUXFlyoutDismissStop
#Provenance
ETW provider GUID bb8e7234-bbf4-48a7-8741-339206ed1dfb
Defined in InputSwitch.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3624, captured 2026-06-02 — Manifest XML pack, 2.0 MB