Microsoft-Windows-Kernel-Pep
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | PepRailRundown | Diagnostic | N | N |
| 2 | PepDeviceRundown | Diagnostic | N | N |
| 3 | PepComponentRundown | Diagnostic | N | N |
| 4 | PepRailVoltageChange | Diagnostic | N | N |
| 5 | PepComponentFrequencyChange | Diagnostic | N | N |
| 6 | PepPlatformIdleResidency | Diagnostic | N | N |
| 7 | PepPlatformIdleTransition | Diagnostic | N | N |
Event ID 1: PepRailRundown
#Fields #
| Name | Description |
|---|---|
VoltageRailId UInt32 | |
VoltageRailName UnicodeString | |
CurrentVoltageMv UInt32 | |
MaxVoltageMv UInt32 |
Event ID 2: PepDeviceRundown
#Fields #
| Name | Description |
|---|---|
DeviceId Pointer | |
DeviceName UnicodeString | |
PlatformStateDependencyCount UInt32 | |
PlatformStateDependency UInt8 |
Event ID 3: PepComponentRundown
#Fields #
| Name | Description |
|---|---|
VoltageRailId UInt32 | |
DeviceId Pointer | |
ComponentIndex UInt32 | |
CurrentFrequencyKHz UInt32 | |
MaxFrequencyKHz UInt32 | |
PlatformStateDependencyCount UInt32 | |
PlatformStateDependency Int64 | |
ComponentDescriptionLength UInt32 | |
ComponentDescription UnicodeString |
Event ID 4: PepRailVoltageChange
#Fields #
| Name | Description |
|---|---|
VoltageRailId UInt32 | |
OldRailVoltageMv UInt32 | |
NewRailVoltageMv UInt32 |
Event ID 5: PepComponentFrequencyChange
#Fields #
| Name | Description |
|---|---|
DeviceId Pointer | |
ComponentIndex UInt32 | |
OldComponentFrequencyKHz UInt32 | |
NewComponentFrequencyKHz UInt32 |
Provenance
ETW provider GUID 5412704e-b2e1-4624-8ffd-55777b8f7373
Defined in microsoft-windows-kernel-power-events.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4652, captured 2026-06-02 — Manifest XML pack, 2.0 MB