Microsoft-Windows-Kernel-BootDiagnostics
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 501 | SystemBootStart | Diagnostic | N | N |
Event ID 501: SystemBootStart
#Provenance
ETW provider GUID 96ac7637-5950-4a30-b8f7-e07e8e5734c1
Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB