Microsoft-Windows-Kernel-Power

Event	Title	Channel	Sample	Rule
1	PowerTransitionStart	Diagnostic	N	N
2	PowerTransitionStop	Diagnostic	N	N
3	QueryAppsPhaseStart	Diagnostic	N	N
4	QueryAppsPhaseStop	Diagnostic	N	N
5	QueryServicesPhaseStart	Diagnostic	N	N
6	QueryServicesPhaseStop	Diagnostic	N	N
7	IrpStart_V1	Diagnostic	Y	N
8	IrpStop	Diagnostic	Y	N
9	The application AppName stopped the power transition.	System	N	N
10	The service ServiceName stopped the power transition.	System	N	N
11	IrpWaiting	Diagnostic	N	N
12	QueryAppsStart	Diagnostic	N	N
13	QueryAppsStop	Diagnostic	N	N
14	QueryServicesStart	Diagnostic	N	N
15	QueryServicesStop	Diagnostic	N	N
16	SuspendAppsStart	Diagnostic	N	N
17	SuspendAppsStop	Diagnostic	N	N
18	SuspendServicesStart	Diagnostic	N	N
19	SuspendServicesStop	Diagnostic	N	N
20	DriverStart	Diagnostic	Y	N
21	DriverStop	Diagnostic	Y	N
22	SuspendAppsPhaseStart	Diagnostic	N	N
23	SuspendAppsPhaseStop	Diagnostic	N	N
24	SuspendServicesPhaseStart	Diagnostic	N	N
25	SuspendServicesPhaseStop	Diagnostic	N	N
26	ResumeAppsPhaseStart	Diagnostic	N	N
27	ResumeServicesPhaseStart	Diagnostic	N	N
28	ResumeAppsStart	Diagnostic	N	N
29	ResumeServicesStart	Diagnostic	N	N
30	QueryFailedApps	Diagnostic	N	N
31	QueryFailedServices	Diagnostic	N	N
32	QueryFailedApp	Diagnostic	N	N
33	QueryFailedService	Diagnostic	N	N
34	Hibernate	Diagnostic	N	N
35	SuspendDevicesPhaseStart	Diagnostic	N	N
36	SuspendDevicesPhaseStop	Diagnostic	N	N
37	WakeDevicesPhaseStart	Diagnostic	N	N
38	WakeDevicesPhaseStop	Diagnostic	N	N
39	PowerTransition_V1	Diagnostic	N	N
40	The driver DriverName for device InstanceName stopped the power transition.	System	N	N
41	The last sleep transition was unsuccessful.	System	Y	N
42	The system is entering sleep.	System	Y	N
43	ZeroHiberFileStart	Diagnostic	N	N
44	ZeroHiberFileStop	Diagnostic	N	N
45	FlushVolumesStart	Diagnostic	N	N
46	FlushVolumesStop	Diagnostic	N	N
47	GracefulShutdownStart	Diagnostic	N	N
48	GracefulShutdownStop	Diagnostic	N	N
49	ZeroPageFileStart	Diagnostic	N	N
50	ZeroPageFileStop	Diagnostic	N	N
51	IoShutdownSystemStart	Diagnostic	N	N
52	IoShutdownSystemStop	Diagnostic	N	N
53	WaitForProcessesStart	Diagnostic	N	N
54	WaitForProcessesStop	Diagnostic	N	N
55	CmShutdownSystemStart	Diagnostic	N	N
56	CmShutdownSystemStop	Diagnostic	N	N
57	ShowUIPhaseStart	Diagnostic	N	N
58	ShowUIPhaseStop	Diagnostic	N	N
59	The system is entering Away Mode.	System	N	N
60	UserQueryAllowed	Diagnostic	N	N
61	KernelQueryAllowed	Diagnostic	N	N
62	The application or service AppName has overridden user power management settings …	Diagnostic	N	N
63	The application or service AppNameLength is attempting to update the system …	Diagnostic	Y	N
64	SuperfetchPhaseStart	Diagnostic	N	N
65	SuperfetchPhaseStop	Diagnostic	N	N
66	WinlogonPhaseStart	Diagnostic	N	N
67	WinlogonPhaseStop	Diagnostic	N	N
68	PreSleepCallbacksPhaseStart	Diagnostic	N	N
69	PreSleepCallbacksPhaseStop	Diagnostic	N	N
70	HideUIPhaseStart	Diagnostic	N	N
71	HideUIPhaseStop	Diagnostic	N	N
72	IdleCheck	Diagnostic	N	N
73	SetSystemState	Diagnostic	N	N
74	RegisterSystemState	Diagnostic	N	N
75	DeviceIdle	Diagnostic	Y	N
76	DeviceIdle	Diagnostic	Y	N
77	DeviceIdleCheck	Diagnostic	Y	N
78	DiskIdleCheck	Diagnostic	N	N
79	Timer tick distribution policy.	Diagnostic	N	N
80	ACPI thermal zone ThermalZoneDeviceInstance has changed to CoolingMode cooling.	Thermal-Diagnostic	N	N
81	ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive …	Thermal-Diagnostic	N	N
82	ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive …	Thermal-Operational	N	N
83	ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active …	Thermal-Diagnostic	N	N
84	ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active …	Thermal-Operational	N	N
85	The system was shut down due to a critical thermal event.	Thermal-Diagnostic	N	N
86	The system was shut down due to a critical thermal event.	System	N	N
87	The system was hibernated due to a critical thermal event.	Thermal-Diagnostic	N	N
88	The system was hibernated due to a critical thermal event.	System	N	N
89	ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.	System	N	N
90	Processor ProcessorId was throttled by an entity other than the kernel power …	Thermal-Diagnostic	N	N
91	Processor ProcessorId was throttled by an entity other than the kernel power …	Thermal-Operational	N	N
92	CreatePowerRequest_V1	Diagnostic	Y	N
93	ChangePowerRequest_V1	Diagnostic	Y	N
94	ClosePowerRequest	Diagnostic	Y	N
95	The system timer resolution has changed to a value of NewResolution.	Diagnostic	Y	N
96	The system timer resolution currently has a value of CurrentPeriod.	Diagnostic	Y	N
97	The system timer resolution currently has a value of RequestedPeriod.	Diagnostic	N	N
98	A driver is attempting to update the system timer resolution to a value of …	Diagnostic	N	N
99	PowerRequestRundown_V1	Diagnostic	Y	N
100	FlushAllPagesPhaseStart	Diagnostic	N	N
101	FlushAllPagesPhaseStop	Diagnostic	N	N
102	BuildNotifyListPhaseStart	Diagnostic	N	N
103	BuildNotifyListPhaseStop	Diagnostic	N	N
104	SleepDisableReasonRundown	Diagnostic	Y	N
105	Power source change.	System	N	N
106	AcDcStateRundown	Diagnostic	Y	N
107	The system has resumed from sleep	Diagnostic, System	N	N
108	PowerTransition108	Diagnostic	N	N
109	The kernel power manager has initiated a shutdown transition.	System	Y	N
110	SystemTimerResolutionStackRundown	Diagnostic	Y	N
111	PowerSettingRundown_V1	Diagnostic	Y	N
112	PowerSettingChange_V1	Diagnostic	Y	N
113	ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive …	Thermal-Diagnostic	N	N
114	ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive …	Thermal-Operational	N	N
115	ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active …	Thermal-Diagnostic	N	N
116	ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active …	Thermal-Operational	N	N
117	PowerTransition117_V2	Diagnostic	N	N
118	Idle resiliency activated with requested clock period: …	Diagnostic	N	N
119	Idle resiliency deactivated (Internal flags:Flags).	Diagnostic	N	N
120	PowerTransition120	Diagnostic	N	N
121	PowerTransition121_V1	Diagnostic	N	N
122	PowerTransition122	Diagnostic	N	N
123	PowerTransition123_V1	Diagnostic	N	N
124	PowerTransition124	Diagnostic	N	N
125	ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.	System	N	N
126	DevicesSuspendLevel	Diagnostic	N	N
127	DevicesSuspendLevel127	Diagnostic	N	N
128	DevicesWakeLevel	Diagnostic	N	N
129	DevicesWakeLevel129	Diagnostic	N	N
130	Firmware S3 times.	System	N	N
131	Firmware S3 times.	System	N	N
132	FirmwarePlatformRoleRundown	Diagnostic	Y	N
133	ResumeAppsPhaseStop	Diagnostic	N	N
134	ResumeServicesPhaseStop	Diagnostic	N	N
135	ConsoleDisplayState	Diagnostic	N	N
136	DeviceRundown	Diagnostic	Y	N
137	The system firmware has changed the processor's memory type range registers …	System	N	N
138	ThermalPerfTrack	Diagnostic	N	N
139	ThermalDurationPerfTrack	Diagnostic	N	N
140	CsConsumptionPerfTrack	Diagnostic	N	N
141	CsFanPerfTrack	Diagnostic	N	N
142	The system has rebooted without cleanly shutting down first.	System	N	N
143	CsDripsWatchdogPerfTrack	Diagnostic	N	N
144	ThermalEvent	Thermal-Diagnostic	N	N
145	ThermalZoneRundown_V2	Thermal-Diagnostic	N	N
146	PowerSettingCallbackStart	Diagnostic	Y	N
147	PowerSettingCallbackStop	Diagnostic	Y	N
148	EnergySaverState	Diagnostic	N	N
149	SessionDisplayOff	Diagnostic	N	N
150	SessionDisplayOn	Diagnostic	N	N
151	CoolingExtensionAdd	Thermal-Diagnostic	N	N
152	CoolingExtensionRundown	Thermal-Diagnostic	N	N
153	CoolingExtensionRemove	Thermal-Diagnostic	N	N
154	CoolingExtensionPassiveUpdate	Thermal-Diagnostic	N	N
155	CoolingExtensionActiveUpdate	Thermal-Diagnostic	N	N
156	ThermalRequestAdd	Thermal-Diagnostic	N	N
157	ThermalRequestRundown	Thermal-Diagnostic	N	N
158	ThermalRequestRemove	Thermal-Diagnostic	N	N
159	ThermalRequestPassiveUpdate	Thermal-Diagnostic	N	N
160	ThermalRequestActiveUpdate	Thermal-Diagnostic	N	N
161	CsDripsWatchdog_V3	Diagnostic	N	N
162	ThermalZoneThermalStandbyUpdate	Thermal-Diagnostic	N	N
163	ThermalZoneOverthrottledUpdate	Thermal-Diagnostic	N	N
164	ThermalStandbyNotification	Thermal-Diagnostic	N	N
165	SystemIdle_V1	Diagnostic	N	N
166	SystemIdle166_V1	Diagnostic	N	N
167	SystemIdle167	Diagnostic	N	N
168	SystemIdle168	Diagnostic	N	N
169	SystemIdleStart	Diagnostic	N	N
170	SystemIdleStop	Diagnostic	N	N
171	CsDeepSleepWatchdog_V1	Diagnostic	N	N
172	Connectivity state in standby: State, Reason: Reason.	System	Y	N
173	FlushSleepStudyLoggerStart	Diagnostic	N	N
174	FlushSleepStudyLoggerStop	Diagnostic	N	N
175	StandbyConnectivityRundown	Diagnostic	Y	N
176	CsComplianceRundown	Diagnostic	Y	N
177	CsComplianceUpdate	Diagnostic	N	N
178	Background Activity Policy updated from PreviousPolicy to NewPolicy.	Diagnostic	N	N
179	ForceIdleStateChange	Diagnostic	N	N
180	ForceIdleReset	Diagnostic	N	N
181	DeepSleepSetConstraint	Diagnostic	Y	N
182	DeepSleepClearConstraint	Diagnostic	Y	N
183	DeepSleepConstraintRundown	Diagnostic	Y	N
184	IRTimerExpiries	Diagnostic	N	N
185	RtcWakeInfo	Diagnostic	N	N
186	IrpPended	Diagnostic	N	N
187	User-mode process attempted to change the system state by calling …	System	N	N
188	PrepareSleepStart	Diagnostic	N	N
189	PrepareSleepStop	Diagnostic	N	N
190	TimerResolutionRequestIgnoreChange	Diagnostic	N	N
191	NonAttributedCpuReferenceUpdate	Diagnostic	N	N
200	task_0	Operational	N	N
201	task_0201	Operational	N	N
202	task_0202	Operational	N	N
203	task_0Stop	Operational	N	N
204	task_0204	Operational	N	N
205	task_0205	Operational	N	N
206	task_0206	Operational	N	N
207	task_0207	Operational	N	N
208	task_0208	Operational	N	N
300	PluginRegistration	Operational	N	N
301	PluginRegistrationRundown	Operational	N	N
302	DevicePreparation	Operational	Y	N
303	DeviceRegistration_V1	Operational	N	N
304	DeviceRegistrationRundown_V1	Operational	Y	N
305	DeviceUnregistration	Operational	N	N
306	StartDevicePowerManagement	Operational	N	N
307	DevicePowerRequirementToDevice	Operational	Y	N
308	DevicePowerState	Operational	Y	N
309	DevicePowered	Operational	Y	N
310	ComponentRegistration_V1	Operational	N	N
311	ComponentRegistrationRundown_V1	Operational	Y	N
312	ComponentCondition	Operational	Y	N
313	ComponentIdleState	Operational	Y	N
314	ComponentLatency	Operational	N	N
315	ComponentResidency	Operational	N	N
316	ComponentWake	Operational	N	N
317	DevicePowerRequirementFromPep	Operational	Y	N
318	DeviceIdleConstraints	Operational	N	N
319	ComponentIdleConstraints	Operational	N	N
320	DeviceVerboseRundown_V3	Operational	Y	N
321	PerformanceStateRegistration	Operational	N	N
322	PerformanceStateRegistrationRundown	Operational	N	N
323	PerformanceStateSetRegistration	Operational	N	N
324	PerformanceStateSetRegistrationRundown	Operational	N	N
325	ComponentPerformanceState	Operational	N	N
326	ComponentPerformanceState326	Operational	N	N
327	ComponentPerformanceState327	Operational	N	N
328	ComponentPerformanceState328	Operational	N	N
329	DebuggerTransitionRequirements	Operational	N	N
330	DefaultPepWorkerStart	Operational	Y	N
331	DefaultPepWorkerStop	Operational	Y	N
332	DefaultPepWorkerDeviceRecovered	Operational	N	N
333	DefaultPepWorkerDeviceOrphaned	Operational	N	N
400	SessionId: SessionId, Console:Console.	Diagnostic	N	N
401	SessionId: SessionId, Console:Console.	Diagnostic	N	N
402	SessionId: SessionId, Console:Console.	Diagnostic	N	N
403	SessionId: SessionId, Console:Console.	Diagnostic	N	N
404	SessionId: SessionId, Console:Console.	Diagnostic	N	N
405	SessionId: SessionId, Console:Console.	Diagnostic	N	N
406	SessionId: SessionId, Console:Console.	Diagnostic	N	N
407	SessionId: SessionId, Console:Console.	Diagnostic	N	N
408	User presence:User_presence.	Diagnostic	N	N
409	Reason code:Reason_code.	Diagnostic	N	N
410	Engaged.	Diagnostic	N	N
411	Engaged.	Diagnostic	N	N
412	Session Id:Session_Id, Value: Value.	Diagnostic	N	N
413	Session Id:Session_Id, Value: Value.	Diagnostic	N	N
414	Session Id:Session_Id, Value: Value.	Diagnostic	N	N
415	Old value:Old_value, New value: New_value.	Diagnostic	N	N
416	Value:Value, Zeroed: Zeroed, Computed: Computed.	Diagnostic	N	N
417	Value:Value, Zeroed: Zeroed, Computed: Computed.	Diagnostic	N	N
418	Value:Value, Zeroed: Zeroed, Computed: Computed.	Diagnostic	N	N
500	IO coalescing activated with spindown period: SpindownTimeout, …	Diagnostic	N	N
501	IO coalescing deactivated.	Diagnostic	N	N
502	IO coalescing flush command generated.	Diagnostic	N	N
503	IO coalescing disk device DiskDeviceObject is about to be spun down.	Diagnostic	N	N
504	SystemLatencyUpdate	Diagnostic	N	N
505	SystemLatencyRundown	Diagnostic	Y	N
506	The system is entering Modern Standby Reason.	System	N	N
507	The system is exiting Modern Standby Reason.	System	N	N
508	The system has been constrained to a periodic tick Reason.	System	N	N
509	DynamicTickStatusRundown	Diagnostic	Y	N
510	Scenario Power Manager (SPM) policy framework has current status: SpmStatus.	Diagnostic	N	N
511	SpmStatusRundown	Diagnostic	N	N
512	SpmPolicyAliasRundown	Diagnostic	N	N
513	SpmScenarioPolicyRundown	Diagnostic	N	N
518	IoShutdownFileSystemsStart	Diagnostic	N	N
519	IoShutdownFileSystemsStop	Diagnostic	N	N
520	The brightness on this system is managed by high-precision brightness aware …	System	N	N
521	Active battery count change.	System	Y	N
522	CsDripsDivergence	Diagnostic	N	N
523	Irp	Diagnostic	N	N
524	Index Battery Trigger Met.	System	N	N
525	NetRefreshTimerArmed	Diagnostic	N	N
526	NetRefreshTimerDisarmed	Diagnostic	N	N
527	PowerStateEventRundown	Diagnostic	Y	N
528	PowerStateEvent	Diagnostic	N	N
529	PowerAggregatorQueueOverflow	Diagnostic	N	N
530	PowerAggregatorRequest	Diagnostic	N	N
531	PowerAggregatorValidationEvent	Diagnostic	N	N
532	PowerAggregatorCompletionEvent	Diagnostic	N	N
533	PowerAggregatorSessionBegin	Diagnostic	N	N
534	PowerAggregatorSessionEnd	Diagnostic	N	N
535	DirectedDripsEngaged_V1	Diagnostic	N	N
536	DirectedDripsWorker_V1	Diagnostic	Y	N
537	DirectedDripsMarkDevice	Diagnostic	N	N
538	DirectedDripsNotifyAppsAndServices_V1	Diagnostic	N	N
539	DirectedDripsNotifyDevices_V1	Diagnostic	N	N
540	DirectedDripsInitialization	Diagnostic	N	N
541	SIdleUpdateNotificationWorker	Diagnostic	Y	N
542	PowerAggregatorInvalidRequestIndex	Diagnostic	N	N
544	DirectedDripsDisengageMaskChange	Diagnostic	Y	N
545	DirectedDripsDeviceVisit_V1	Diagnostic	N	N
546	DirectedDripsProblemDevice	Diagnostic	N	N
547	DirectedPowerTransitionStart	Diagnostic	N	N
548	DirectedPowerTransitionEnd_V1	Diagnostic	N	N
549	SystemIdleAssessment	Diagnostic	Y	N
550	SystemIdleEventAssessment	Diagnostic	Y	N
551	SystemIdleRundown	Diagnostic	Y	N
552	SystemIdleContextUpdate	Diagnostic	N	N
553	DirectedFxPowerStateFailure	Diagnostic	N	N
554	DirectedDripsDeviceStats	Diagnostic	N	N
555	ExecutePowerAction	Diagnostic	N	N
556	DirectedDripsErrorRecord	Diagnostic	N	N
557	A driver is attempting to update the system timer resolution to a value of …	Diagnostic	Y	N
558	PowerAggregatorHandleIntent_V1	Diagnostic	N	N
559	PowerAggregatorWorkerStart	Diagnostic	N	N
560	PowerAggregatorWorkerEnd	Diagnostic	N	N
561	PowerAggregatorInternalStateChange	Diagnostic	N	N
562	PowerAggregatorHandlerInvoke	Diagnostic	N	N
563	PowerAggregatorPdcPhasesExited	Diagnostic	N	N
564	PowerAggregatorPdcSleepTransition	Diagnostic	N	N
565	PowerAggregatorSuspendResume	Diagnostic	N	N
566	The system session has transitioned from PreviousSessionId to NextSessionId.	System	Y	N
567	SuspendAppsNotificationPhaseStart	Diagnostic	N	N
568	SuspendAppsNotificationPhaseStop	Diagnostic	N	N
569	SuspendServicesNotificationPhaseStart	Diagnostic	N	N
570	SuspendServicesNotificationPhaseStop	Diagnostic	N	N
571	ResumeAppsNotificationPhaseStart	Diagnostic	N	N
572	ResumeAppsNotificationPhaseStop	Diagnostic	N	N
573	ResumeServicesNotificationPhaseStart	Diagnostic	N	N
574	ResumeServicesNotificationPhaseStop	Diagnostic	N	N
575	DripsWakeSourceMapping	Diagnostic	N	N
576	AdaptiveSessionState_V1	Diagnostic	N	N
577	The system has prepared for a system initiated reboot from AdaptiveTargetState.	System	Y	N
578	The system has detected a system initiated reboot from AdaptiveTargetState.	System	Y	N
579	StateTransitionFailure	Diagnostic	N	N
580	NotifyConsoleUserPresent	Diagnostic	N	N
581	Win32kCallout	Diagnostic	N	N
582	Win32kCallout582	Diagnostic	N	N
583	Win32kCallout583	Diagnostic	N	N
584	Win32kCallout584	Diagnostic	N	N
585	Win32kCallout585	Diagnostic	N	N
586	Win32kCallout586	Diagnostic	N	N
587	IrpWatchdogTriggered	Diagnostic	N	N
588	PowerAggregatorDozeTimerArmed	Diagnostic	N	N
589	PowerAggregatorDozeTimerDisarmed	Diagnostic	N	N
590	PowerAggregatorDozeTimerTriggered	Diagnostic	N	N
591	PowerLimitRequestAdd	Thermal-Diagnostic	N	N
592	PowerLimitRequestRemove	Thermal-Diagnostic	N	N
593	PowerLimitRequestRundown	Thermal-Diagnostic	N	N
594	PowerLimitRequestUpdate	Thermal-Diagnostic	N	N
595	PowerLimitExtensionAdd	Thermal-Diagnostic	N	N
596	PowerLimitExtensionRemove	Thermal-Diagnostic	N	N
597	PowerLimitExtensionRundown	Thermal-Diagnostic	N	N
598	PowerLimitExtensionUpdate	Thermal-Diagnostic	N	N
599	EnergySaverStateV2	Diagnostic	N	N
600	SetHiberFileFailure	Diagnostic	N	N
601	Hibernate was disabled because invalid system binaries were detected	Operational, System	N	N
602	ModernStandbyNotification	Operational	N	N

Event ID 1: PowerTransitionStart

Channel: Diagnostic
Task: PowerTransition
Opcode: Start

Fields #

Name	Description
`Reason` UInt32
`Flags` UInt32
`Time` FILETIME

Event ID 2: PowerTransitionStop

Channel: Diagnostic
Task: PowerTransition
Opcode: Stop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`Time` FILETIME
`WakeSourceTypeLength` UInt16
`WakeSourceSubTypeLength` UInt16
`WakeSourceLength` UInt16
`WakeSourceContextLength` UInt16
`WakeSourceType` UnicodeString
`WakeSourceSubType` UnicodeString
`WakeSource` UnicodeString
`WakeSourceContext` UnicodeString

Event ID 3: QueryAppsPhaseStart

Channel: Diagnostic
Task: QueryApps
Opcode: PhaseStart

Event ID 4: QueryAppsPhaseStop

Channel: Diagnostic
Task: QueryApps
Opcode: PhaseStop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 5: QueryServicesPhaseStart

Channel: Diagnostic
Task: QueryServices
Opcode: PhaseStart

Event ID 6: QueryServicesPhaseStop

Channel: Diagnostic
Task: QueryServices
Opcode: PhaseStop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 7: IrpStart_V1

Channel: Diagnostic
Level: Informational
Task: Irp
Opcode: Start

Fields #

Name	Description
`Irp` Pointer
`PowerStateType` UInt32
`MinorFunction` UInt8
`TargetDevice` Pointer
`InstanceNameLength` UInt16
`InstanceName` UnicodeString
`PowerState` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "InstanceName": "USB\\VID_0627&PID_0001\\28754-0000:00:01.2-1",
    "InstanceNameLength": 42,
    "Irp": "0xFFFFC807B7CB9B50",
    "MinorFunction": 2,
    "PowerState": 0,
    "PowerStateType": 1,
    "TargetDevice": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 8: IrpStop

Channel: Diagnostic
Level: Informational
Task: Irp
Opcode: Stop

Fields #

Name	Description
`Irp` Pointer
`Status` UInt32	NTSTATUS reference
`FailedDriver` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 8,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8852
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.745Z",
    "version": 0
  },
  "event_data": {
    "FailedDriver": "\\Driver\\usbuhci",
    "Irp": "0xFFFFC807C7676AB0",
    "Status": 3221225760
  },
  "message": ""
}

Event ID 9: The application AppName stopped the power transition.

Channel: System
Task: QueryApps
Opcode: Veto

Message #

The application %4 stopped the power transition.

Fields #

Name	Description
`Pid` UInt32
`Window` Pointer
`AppNameLength` UInt16
`AppName` UnicodeString

Event ID 10: The service ServiceName stopped the power transition.

Channel: System
Task: QueryServices
Opcode: Veto

Message #

The service %3 stopped the power transition.

Fields #

Name	Description
`Pid` UInt32
`ServiceNameLength` UInt16
`ServiceName` UnicodeString

Event ID 11: IrpWaiting

Channel: Diagnostic
Task: IrpWaiting

Fields #

Name	Description
`Irp` Pointer

Event ID 12: QueryAppsStart

Channel: Diagnostic
Task: QueryApps
Opcode: Start

Fields #

Name	Description
`Pid` UInt32
`NameLength` UInt16
`Name` UnicodeString

Event ID 13: QueryAppsStop

Channel: Diagnostic
Task: QueryApps
Opcode: Stop

Fields #

Name	Description
`Pid` UInt32

Event ID 14: QueryServicesStart

Channel: Diagnostic
Task: QueryServices
Opcode: Start

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 15: QueryServicesStop

Channel: Diagnostic
Task: QueryServices
Opcode: Stop

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 16: SuspendAppsStart

Channel: Diagnostic
Task: SuspendApps
Opcode: Start

Fields #

Name	Description
`Pid` UInt32
`NameLength` UInt16
`Name` UnicodeString

Event ID 17: SuspendAppsStop

Channel: Diagnostic
Task: SuspendApps
Opcode: Stop

Fields #

Name	Description
`Pid` UInt32

Event ID 18: SuspendServicesStart

Channel: Diagnostic
Task: SuspendServices
Opcode: Start

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 19: SuspendServicesStop

Channel: Diagnostic
Task: SuspendServices
Opcode: Stop

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 20: DriverStart

Channel: Diagnostic
Level: Informational
Task: Driver
Opcode: Start

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer
`DriverName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 20,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 20
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "Device": "0xFFFFC807B6295470",
    "DriverName": "\\Driver\\HidUsb",
    "Irp": "0xFFFFC807B7CB9B50"
  },
  "message": ""
}

Event ID 21: DriverStop

Channel: Diagnostic
Level: Informational
Task: Driver
Opcode: Stop

Fields #

Name	Description
`Irp` Pointer
`Device` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 21,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 20
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "Device": "0xFFFFC807B6295470",
    "Irp": "0xFFFFC807B7CB9B50"
  },
  "message": ""
}

Event ID 22: SuspendAppsPhaseStart

Channel: Diagnostic
Task: SuspendApps
Opcode: PhaseStart

Event ID 23: SuspendAppsPhaseStop

Channel: Diagnostic
Task: SuspendApps
Opcode: PhaseStop

Event ID 24: SuspendServicesPhaseStart

Channel: Diagnostic
Task: SuspendServices
Opcode: PhaseStart

Event ID 25: SuspendServicesPhaseStop

Channel: Diagnostic
Task: SuspendServices
Opcode: PhaseStop

Event ID 26: ResumeAppsPhaseStart

Channel: Diagnostic
Task: ResumeApps
Opcode: PhaseStart

Event ID 27: ResumeServicesPhaseStart

Channel: Diagnostic
Task: ResumeServices
Opcode: PhaseStart

Event ID 28: ResumeAppsStart

Channel: Diagnostic
Task: ResumeApps
Opcode: Start

Fields #

Name	Description
`Pid` UInt32
`NameLength` UInt16
`Name` UnicodeString

Event ID 29: ResumeServicesStart

Channel: Diagnostic
Task: ResumeServices
Opcode: Start

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 30: QueryFailedApps

Channel: Diagnostic
Task: QueryFailedApps

Event ID 31: QueryFailedServices

Channel: Diagnostic
Task: QueryFailedServices

Event ID 32: QueryFailedApp

Channel: Diagnostic
Task: QueryFailedApp

Fields #

Name	Description
`Pid` UInt32
`NameLength` UInt16
`Name` UnicodeString

Event ID 33: QueryFailedService

Channel: Diagnostic
Task: QueryFailedService

Fields #

Name	Description
`NameLength` UInt16
`Name` UnicodeString

Event ID 34: Hibernate

Channel: Diagnostic
Task: Hibernate

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 35: SuspendDevicesPhaseStart

Channel: Diagnostic
Task: SuspendDevices
Opcode: PhaseStart

Fields #

Name	Description
`Query` Boolean
`TargetState` UInt32
`EffectiveState` UInt32

Event ID 36: SuspendDevicesPhaseStop

Channel: Diagnostic
Task: SuspendDevices
Opcode: PhaseStop

Event ID 37: WakeDevicesPhaseStart

Channel: Diagnostic
Task: WakeDevices
Opcode: PhaseStart

Event ID 38: WakeDevicesPhaseStop

Channel: Diagnostic
Task: WakeDevices
Opcode: PhaseStop

Event ID 39: PowerTransition_V1

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`SleepTime` UInt32
`ResumeTime` UInt32
`DriverWakeTime` UInt32
`HiberWriteTime` UInt32
`HiberReadTime` UInt32
`HiberPagesWritten` UInt32
`BiosInitTime` UInt32
`CheckpointTime` UInt32

Event ID 40: The driver DriverName for device InstanceName stopped the power transition.

Channel: System
Task: QueryDrivers
Opcode: Veto

Message #

The driver %2 for device %4 stopped the power transition.

Fields #

Name	Description
`DriverNameLength` UInt16
`DriverName` UnicodeString
`InstanceNameLength` UInt16
`InstanceName` UnicodeString

Event ID 41: The last sleep transition was unsuccessful.

Channel: System
Level: Critical
Collection Priority: Recommended (JSCU-NL)
Task: DirtyTransition

Description

The last sleep transition was unsuccessful. This error could be caused if the system stopped responding, failed, or lost power during the sleep transition.

Message #

The last sleep transition was unsuccessful. This error could be caused if the system stopped responding, failed, or lost power during the sleep transition.

Fields #

Name	Description
`BugcheckCode` UInt32
`BugcheckParameter1` Pointer
`BugcheckParameter2` Pointer
`BugcheckParameter3` Pointer
`BugcheckParameter4` Pointer
`SleepInProgress` UInt32
`PowerButtonTimestamp` UInt64
`BootAppStatus` UInt32
`Checkpoint` UInt8
`ConnectedStandbyInProgress` Boolean
`SystemSleepTransitionsToOn` UInt32
`CsEntryScenarioInstanceId` UInt8
`BugcheckInfoFromEFI` Boolean
`CheckpointStatus` UInt8
`CsEntryScenarioInstanceIdV2` UInt64
`LongPowerButtonPressDetected` Boolean
`LidReliability` Boolean
`InputSuppressionState` UInt8
`PowerButtonSuppressionState` UInt8
`LidState` UInt8
`WHEABootErrorCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 41,
    "version": 8,
    "level": 1,
    "task": 63,
    "opcode": 0,
    "keywords": -9223301668110598142,
    "time_created": "2026-05-29T16:32:46.0446910+00:00",
    "event_record_id": 6681,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BugcheckCode": "0",
    "BugcheckParameter1": "0x0",
    "BugcheckParameter2": "0x0",
    "BugcheckParameter3": "0x0",
    "BugcheckParameter4": "0x0",
    "SleepInProgress": "0",
    "PowerButtonTimestamp": "0",
    "BootAppStatus": "0",
    "Checkpoint": "0",
    "ConnectedStandbyInProgress": "false",
    "SystemSleepTransitionsToOn": "0",
    "CsEntryScenarioInstanceId": "0",
    "BugcheckInfoFromEFI": "false",
    "CheckpointStatus": "0",
    "CsEntryScenarioInstanceIdV2": "0",
    "LongPowerButtonPressDetected": "false"
  },
  "message": "The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly."
}

Event ID 42: The system is entering sleep.

Channel: System
Level: Informational
Task: PreSleepNotification

Fields #

Name	Description
`TargetState` UInt32
`EffectiveState` UInt32
`Reason` UInt32
`Flags` UInt32
`TransitionsToOn`

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "331C3B3A-2005-44C2-AC5E-77220C37D6B4",
    "event_source_name": "",
    "event_id": 42,
    "version": 2,
    "level": 4,
    "task": 64,
    "opcode": 0,
    "keywords": 9223372036854775812,
    "time_created": "2016-08-18T16:22:13.389648Z",
    "event_record_id": 5523,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 60
    },
    "channel": "System",
    "computer": "IE10Win7",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "TargetState": 2,
    "EffectiveState": 2,
    "Reason": 7,
    "Flags": 0
  }
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 43: ZeroHiberFileStart

Channel: Diagnostic
Task: ZeroHiberFile
Opcode: Start

Event ID 44: ZeroHiberFileStop

Channel: Diagnostic
Task: ZeroHiberFile
Opcode: Stop

Event ID 45: FlushVolumesStart

Channel: Diagnostic
Task: FlushVolumes
Opcode: Start

Event ID 46: FlushVolumesStop

Channel: Diagnostic
Task: FlushVolumes
Opcode: Stop

Event ID 47: GracefulShutdownStart

Channel: Diagnostic
Task: GracefulShutdown
Opcode: Start

Event ID 48: GracefulShutdownStop

Channel: Diagnostic
Task: GracefulShutdown
Opcode: Stop

Event ID 49: ZeroPageFileStart

Channel: Diagnostic
Task: ZeroPageFile
Opcode: Start

Event ID 50: ZeroPageFileStop

Channel: Diagnostic
Task: ZeroPageFile
Opcode: Stop

Event ID 51: IoShutdownSystemStart

Channel: Diagnostic
Task: IoShutdownSystem
Opcode: Start

Event ID 52: IoShutdownSystemStop

Channel: Diagnostic
Task: IoShutdownSystem
Opcode: Stop

Event ID 53: WaitForProcessesStart

Channel: Diagnostic
Task: WaitForProcesses
Opcode: Start

Event ID 54: WaitForProcessesStop

Channel: Diagnostic
Task: WaitForProcesses
Opcode: Stop

Event ID 55: CmShutdownSystemStart

Channel: Diagnostic
Task: CmShutdownSystem
Opcode: Start

Event ID 56: CmShutdownSystemStop

Channel: Diagnostic
Task: CmShutdownSystem
Opcode: Stop

Event ID 57: ShowUIPhaseStart

Channel: Diagnostic
Task: ShowUI
Opcode: PhaseStart

Event ID 58: ShowUIPhaseStop

Channel: Diagnostic
Task: ShowUI
Opcode: PhaseStop

Event ID 59: The system is entering Away Mode.

Channel: System
Task: AwayMode

Event ID 60: UserQueryAllowed

Channel: Diagnostic
Task: UserQueryAllowed

Fields #

Name	Description
`Value` Boolean

Event ID 61: KernelQueryAllowed

Channel: Diagnostic
Task: KernelQueryAllowed

Fields #

Name	Description
`Value` Boolean

Event ID 62: The application or service AppName has overridden user power management settings with a code of ExecutionState.

Channel: Diagnostic
Task: SetExecutionState

Message #

The application or service %3 has overridden user power management settings with a code of %1.

Fields #

Name	Description
`ExecutionState` UInt32
`AppNameLength` UInt16
`AppName` UnicodeString
`Pid` UInt32
`Tid` UInt32
`EffectiveExecutionState` UInt32
`IgnoreReason` UInt32

Event ID 63: The application or service AppNameLength is attempting to update the system timer resolution to a value of RequestedResolution.

Channel: Diagnostic
Level: Informational
Task: SystemTimeResolutionChange

Message #

The application or service %3 is attempting to update the system timer resolution to a value of %1.

Fields #

Name	Description
`RequestedResolution` UInt32
`Pid` UInt32
`AppNameLength` UInt16
`AppName` UnicodeString
`SubProcessTag` UInt32
`RequestIgnored` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 63,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7932,
      "thread_id": 12236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:31:35.991Z",
    "version": 0
  },
  "event_data": {
    "AppName": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
    "AppNameLength": 81,
    "Pid": 7932,
    "RequestIgnored": false,
    "RequestedResolution": 10000,
    "SubProcessTag": 0
  },
  "message": ""
}

Event ID 64: SuperfetchPhaseStart

Channel: Diagnostic
Task: Superfetch
Opcode: PhaseStart

Event ID 65: SuperfetchPhaseStop

Channel: Diagnostic
Task: Superfetch
Opcode: PhaseStop

Event ID 66: WinlogonPhaseStart

Channel: Diagnostic
Task: Winlogon
Opcode: PhaseStart

Event ID 67: WinlogonPhaseStop

Channel: Diagnostic
Task: Winlogon
Opcode: PhaseStop

Event ID 68: PreSleepCallbacksPhaseStart

Channel: Diagnostic
Task: PreSleepCallbacks
Opcode: PhaseStart

Event ID 69: PreSleepCallbacksPhaseStop

Channel: Diagnostic
Task: PreSleepCallbacks
Opcode: PhaseStop

Event ID 70: HideUIPhaseStart

Channel: Diagnostic
Task: HideUI
Opcode: PhaseStart

Event ID 71: HideUIPhaseStop

Channel: Diagnostic
Task: HideUI
Opcode: PhaseStop

Event ID 72: IdleCheck

Channel: Diagnostic
Task: IdleCheck

Fields #

Name	Description
`Threshold` UInt32
`LowestIdleness` UInt32
`AverageIdleness` UInt32
`AccruedIdleTime` UInt32
`NonIdleIgnored` Boolean
`IdleToSleep` Boolean
`NonIdleReferences` Boolean

Event ID 73: SetSystemState

Channel: Diagnostic
Task: SetSystemState

Fields #

Name	Description
`ExecutionState` UInt32
`MonitorReason` UInt32

Event ID 74: RegisterSystemState

Channel: Diagnostic
Task: RegisterSystemState

Fields #

Name	Description
`ExecutionState` UInt32
`StateHandle` Pointer

Event ID 75: DeviceIdle

Channel: Diagnostic
Level: Informational
Task: DeviceIdle
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 75,
    "version": 0,
    "level": 4,
    "task": 73,
    "opcode": 1,
    "keywords": "0x4000000000000010",
    "time_created": "2026-06-02T05:56:05.349+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11208
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeviceIdle"
}

Event ID 76: DeviceIdle

Channel: Diagnostic
Level: Informational
Task: DeviceIdle
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 76,
    "version": 0,
    "level": 4,
    "task": 73,
    "opcode": 2,
    "keywords": "0x4000000000000010",
    "time_created": "2026-06-02T05:56:05.349+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11208
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {},
  "message": "DeviceIdle"
}

Event ID 77: DeviceIdleCheck

Channel: Diagnostic
Level: Informational
Task: DeviceIdleCheck

Fields #

Name	Description
`Device` Pointer
`Pdo` Pointer
`InstancePathLength` UInt16
`InstancePath` UnicodeString
`ConservativeTimeout` UInt32
`PerformanceTimeout` UInt32
`IdleTime` UInt32
`BusyCount` UInt32
`TotalBusyCount` UInt32
`IdlePowerState` UInt8
`CurrentPowerState` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 77,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.582Z",
    "version": 0
  },
  "event_data": {
    "BusyCount": 30,
    "ConservativeTimeout": 4294967295,
    "CurrentPowerState": 0,
    "Device": "0xFFFFC807B40E6530",
    "IdlePowerState": 3,
    "IdleTime": 0,
    "InstancePath": "IDE\\CdRomQEMU_QEMU_DVD-ROM_______________________2.5+____\\5&25b02e98&0&0.0.0",
    "InstancePathLength": 76,
    "Pdo": "0xFFFFC807B40E6530",
    "PerformanceTimeout": 4294967295,
    "TotalBusyCount": 46218
  },
  "message": ""
}

Event ID 78: DiskIdleCheck

Channel: Diagnostic
Task: DiskIdleCheck

Fields #

Name	Description
`Device` Pointer
`Timeout` UInt32
`IgnoreThreshold` UInt32
`IdleTime` UInt32
`NonIdleTime` UInt32

Event ID 79: Timer tick distribution policy.

Channel: Diagnostic
Task: SkipTick

Message #

Timer tick distribution policy:             
             
Disabled: %1             
Overridden: %2

Fields #

Name	Description
`Disabled` Boolean	[Timer tick distribution policy] Disabled.
`Overridden` Boolean	[Timer tick distribution policy] Overridden.

Event ID 80: ACPI thermal zone ThermalZoneDeviceInstance has changed to CoolingMode cooling.

Channel: Thermal-Diagnostic
Task: CoolingModeChange

Message #

ACPI thermal zone %2 has changed to %4 cooling.

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`CoolingModeLength` UInt16
`CoolingMode` UnicodeString

Event ID 81: ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.

Channel: Thermal-Diagnostic
Task: PassiveCoolingDiagnostic

Message #

ACPI thermal zone %2 has %5 passive cooling.             
EventTime = %3             
_PSV = %7K             
_TMP = %8K             
_TC1 = %9             
_TC2 = %10             
_TSP = %11ms             
Delta P = %12             
_PSL - see event data.

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`PassiveCoolingStateLength` UInt16
`PassiveCoolingState` UnicodeString
`AffinityCount` UInt16
`_PSV` UInt32
`_TMP` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`DeltaP` Int32
`_PSL` Boolean

Event ID 82: ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.

Channel: Thermal-Operational
Task: PassiveCoolingOperational

Message #

ACPI thermal zone %2 has %5 passive cooling.             
EventTime = %3             
_PSV = %7K             
_TMP = %8K             
_TC1 = %9             
_TC2 = %10             
_TSP = %11ms             
Delta P = %12             
_PSL - see event data.

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`PassiveCoolingStateLength` UInt16
`PassiveCoolingState` UnicodeString
`AffinityCount` UInt16
`_PSV` UInt32
`_TMP` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`DeltaP` Int32
`_PSL` Boolean

Event ID 83: ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

Channel: Thermal-Diagnostic
Task: ActiveCoolingDiagnostic

Message #

ACPI thermal zone %2 has %5 active cooling.             
EventTime = %3             
_AC0 = %6K             
_AC1 = %7K             
_AC2 = %8K             
_AC3 = %9K             
_AC4 = %10K             
_AC5 = %11K             
_AC6 = %12K             
_AC7 = %13K             
_AC8 = %14K             
_AC9 = %15K             
_TMP = %16K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`ActiveCoolingStateLength` UInt16
`ActiveCoolingState` UnicodeString
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_TMP` UInt32

Event ID 84: ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

Channel: Thermal-Operational
Task: ActiveCoolingOperational

Message #

ACPI thermal zone %2 has %5 active cooling.             
EventTime = %3             
_AC0 = %6K             
_AC1 = %7K             
_AC2 = %8K             
_AC3 = %9K             
_AC4 = %10K             
_AC5 = %11K             
_AC6 = %12K             
_AC7 = %13K             
_AC8 = %14K             
_AC9 = %15K             
_TMP = %16K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`ActiveCoolingStateLength` UInt16
`ActiveCoolingState` UnicodeString
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_TMP` UInt32

Event ID 85: The system was shut down due to a critical thermal event.

Channel: Thermal-Diagnostic
Task: CriticalTripPointExceededDiagnostic

Message #

The system was shut down due to a critical thermal event.             
Shutdown Time = %3             
ACPI Thermal Zone = %2             
_CRT = %4K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`ShutdownTime` FILETIME
`_CRT` UInt32

Event ID 86: The system was shut down due to a critical thermal event.

Channel: System
Task: CriticalTripPointExceededSystem

Message #

The system was shut down due to a critical thermal event.             
Shutdown Time = %3             
ACPI Thermal Zone = %2             
_CRT = %4K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`ShutdownTime` FILETIME
`_CRT` UInt32

Event ID 87: The system was hibernated due to a critical thermal event.

Channel: Thermal-Diagnostic
Task: S4TripPointExceededDiagnostic

Message #

The system was hibernated due to a critical thermal event.
Hibernate Time = %3             
ACPI Thermal Zone = %2             
_HOT = %4K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`HibernateTime` FILETIME
`_HOT` UInt32

Event ID 88: The system was hibernated due to a critical thermal event.

Channel: System
Task: S4TripPointExceededSystem

Message #

The system was hibernated due to a critical thermal event.
Hibernate Time = %3             
ACPI Thermal Zone = %2             
_HOT = %4K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`HibernateTime` FILETIME
`_HOT` UInt32

Event ID 89: ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.

Channel: System
Task: ThermalZoneEnumerated

Message #

ACPI thermal zone %2 has been enumerated.             
_PSV = %4K             
_TC1 = %5             
_TC2 = %6             
_TSP = %7ms             
_AC0 = %8K             
_AC1 = %9K             
_AC2 = %10K             
_AC3 = %11K             
_AC4 = %12K             
_AC5 = %13K             
_AC6 = %14K             
_AC7 = %15K             
_AC8 = %16K             
_AC9 = %17K             
_CRT = %18K             
_HOT = %19K             
_PSL - see event data.

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`AffinityCount` UInt16
`_PSV` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_CRT` UInt32
`_HOT` UInt32
`_PSL` HexInt32

Event ID 90: Processor ProcessorId was throttled by an entity other than the kernel power manager.

Channel: Thermal-Diagnostic
Task: IllegalProcessorThrottleDiagnostic

Message #

Processor %1 was throttled by an entity other than the kernel power manager. 
IA32_CLOCK_MODULATION MSR = %2. 
Elapsed time since last event logged = %3s. 
Log interval = %4 events.

Fields #

Name	Description
`ProcessorId` UInt32
`ThrottleMSR` HexInt64
`ElapsedTime` UInt32
`LogInterval` UInt32

Event ID 91: Processor ProcessorId was throttled by an entity other than the kernel power manager.

Channel: Thermal-Operational
Task: IllegalProcessorThrottleOperational

Message #

Processor %1 was throttled by an entity other than the kernel power manager. 
IA32_CLOCK_MODULATION MSR = %2. 
Elapsed time since last event logged = %3s. 
Log interval = %4 events.

Fields #

Name	Description
`ProcessorId` UInt32
`ThrottleMSR` HexInt64
`ElapsedTime` UInt32
`LogInterval` UInt32

Event ID 92: CreatePowerRequest_V1

Channel: Diagnostic
Level: Informational
Task: CreatePowerRequest

Fields #

Name	Description
`Token` Pointer
`Type` UInt32
`ProcessID` UInt32
`SessionID` UInt32
`Legacy` Boolean
`SystemAllowed` Boolean
`DisplayAllowed` Boolean
`AwayModeAllowed` Boolean
`SystemCount` UInt32
`DisplayCount` UInt32
`AwayModeCount` UInt32
`CallerLength` UInt16
`ContextLength` UInt16
`Caller` UnicodeString
`Context` UnicodeString
`ExecutionRequiredAllowed` Boolean
`PerformanceBoostAllowed` Boolean
`FullScreenVideoAllowed` Boolean
`ExecutionRequiredCount` UInt32
`PerformanceBoostCount` UInt32
`FullScreenVideoCount` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 92,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 8508
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:33.421Z",
    "version": 0
  },
  "event_data": {
    "AwayModeAllowed": true,
    "AwayModeCount": 0,
    "Caller": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
    "CallerLength": 44,
    "Context": "",
    "ContextLength": 0,
    "DisplayAllowed": true,
    "DisplayCount": 0,
    "ExecutionRequiredAllowed": true,
    "ExecutionRequiredCount": 0,
    "FullScreenVideoAllowed": true,
    "FullScreenVideoCount": 0,
    "Legacy": false,
    "PerformanceBoostAllowed": true,
    "PerformanceBoostCount": 0,
    "ProcessID": 8992,
    "SessionID": 1,
    "SystemAllowed": true,
    "SystemCount": 0,
    "Token": "0xFFFFC807B600E360",
    "Type": 1
  },
  "message": ""
}

Event ID 93: ChangePowerRequest_V1

Channel: Diagnostic
Level: Informational
Task: ChangePowerRequest

Fields #

Name	Description
`Token` Pointer
`SystemCount` UInt32
`DisplayCount` UInt32
`AwayModeCount` UInt32
`ExecutionRequiredCount` UInt32
`PerformanceBoostCount` UInt32
`FullScreenVideoCount` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 93,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 8508
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:33.421Z",
    "version": 0
  },
  "event_data": {
    "AwayModeCount": 0,
    "DisplayCount": 0,
    "ExecutionRequiredCount": 0,
    "FullScreenVideoCount": 0,
    "PerformanceBoostCount": 0,
    "SystemCount": 1,
    "Token": "0xFFFFC807B600E360"
  },
  "message": ""
}

Event ID 94: ClosePowerRequest

Channel: Diagnostic
Level: Informational
Task: ClosePowerRequest

Fields #

Name	Description
`Token` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 94,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 8508
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:33.459Z",
    "version": 0
  },
  "event_data": {
    "Token": "0xFFFFC807B600E360"
  },
  "message": ""
}

Event ID 95: The system timer resolution has changed to a value of NewResolution.

Channel: Diagnostic
Level: Informational
Task: SystemTimeResolutionUpdate

Message #

The system timer resolution has changed to a value of %1.

Fields #

Name	Description
`NewResolution` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 95,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 7932,
      "thread_id": 12236
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:31:35.992Z",
    "version": 0
  },
  "event_data": {
    "NewResolution": 10000
  },
  "message": ""
}

Event ID 96: The system timer resolution currently has a value of CurrentPeriod.

Channel: Diagnostic
Level: Informational
Task: SystemTimeResolutionRundown

Message #

The system timer resolution currently has a value of %1.

Fields #

Name	Description
`CurrentPeriod` UInt32
`MinimumPeriod` UInt32
`MaximumPeriod` UInt32
`KernelRequestCount` UInt32
`KernelRequestedPeriod` UInt32
`InternalSetPeriod` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 96,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.800Z",
    "version": 0
  },
  "event_data": {
    "CurrentPeriod": 156250,
    "InternalSetPeriod": 156250,
    "KernelRequestCount": 0,
    "KernelRequestedPeriod": 0,
    "MaximumPeriod": 156250,
    "MinimumPeriod": 5000
  },
  "message": ""
}

Event ID 97: The system timer resolution currently has a value of RequestedPeriod.

Channel: Diagnostic
Task: SystemTimeResolutionRequestRundown

Message #

The system timer resolution currently has a value of %1.

Fields #

Name	Description
`RequestedPeriod` UInt32
`Pid` UInt32
`AppNameLength` UInt16
`AppName` UnicodeString
`RequestIgnored` Boolean

Event ID 98: A driver is attempting to update the system timer resolution to a value of RequestedResolution.

Channel: Diagnostic
Task: SystemTimeResolutionKernelChange

Message #

A driver is attempting to update the system timer resolution to a value of %1.

Fields #

Name	Description
`RequestedResolution` UInt32
`Tag` UInt32

Event ID 99: PowerRequestRundown_V1

Channel: Diagnostic
Level: Informational
Task: PowerRequestRundown

Fields #

Name	Description
`Token` Pointer
`Type` UInt32
`ProcessID` UInt32
`SessionID` UInt32
`Legacy` Boolean
`SystemAllowed` Boolean
`DisplayAllowed` Boolean
`AwayModeAllowed` Boolean
`SystemCount` UInt32
`DisplayCount` UInt32
`AwayModeCount` UInt32
`CallerLength` UInt16
`ContextLength` UInt16
`Caller` UnicodeString
`Context` UnicodeString
`ExecutionRequiredAllowed` Boolean
`PerformanceBoostAllowed` Boolean
`FullScreenVideoAllowed` Boolean
`ExecutionRequiredCount` UInt32
`PerformanceBoostCount` UInt32
`FullScreenVideoCount` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 99,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.801Z",
    "version": 0
  },
  "event_data": {
    "AwayModeAllowed": false,
    "AwayModeCount": 0,
    "Caller": "",
    "CallerLength": 0,
    "Context": "",
    "ContextLength": 0,
    "DisplayAllowed": false,
    "DisplayCount": 0,
    "ExecutionRequiredAllowed": false,
    "ExecutionRequiredCount": 0,
    "FullScreenVideoAllowed": false,
    "FullScreenVideoCount": 0,
    "Legacy": false,
    "PerformanceBoostAllowed": true,
    "PerformanceBoostCount": 0,
    "ProcessID": 0,
    "SessionID": 0,
    "SystemAllowed": true,
    "SystemCount": 0,
    "Token": "0xFFFFC807AFAC62C0",
    "Type": 0
  },
  "message": ""
}

Event ID 100: FlushAllPagesPhaseStart

Channel: Diagnostic
Task: FlushAllPages
Opcode: PhaseStart

Event ID 101: FlushAllPagesPhaseStop

Channel: Diagnostic
Task: FlushAllPages
Opcode: PhaseStop

Event ID 102: BuildNotifyListPhaseStart

Channel: Diagnostic
Task: BuildNotifyList
Opcode: PhaseStart

Event ID 103: BuildNotifyListPhaseStop

Channel: Diagnostic
Task: BuildNotifyList
Opcode: PhaseStop

Event ID 104: SleepDisableReasonRundown

Channel: Diagnostic
Level: Informational
Task: SleepDisableReasonRundown

Fields #

Name	Description
`AffectedState` UInt8
`PowerReasonCode` UInt32
`PowerReasonLength` UInt32
`PowerReasonInfo` Binary

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 104,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.806Z",
    "version": 0
  },
  "event_data": {
    "AffectedState": 1,
    "PowerReasonCode": 65793,
    "PowerReasonInfo": "",
    "PowerReasonLength": 16777216
  },
  "message": ""
}

Event ID 105: Power source change.

Channel: System
Task: AcDcStateChange

Fields #

Name	Description
`AcOnline` Boolean
`RemainingCapacity` UInt32
`FullChargeCapacity` UInt32

Event ID 106: AcDcStateRundown

Channel: Diagnostic
Level: Informational
Task: AcDcStateRundown

Fields #

Name	Description
`AcOnline` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 106,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.801Z",
    "version": 0
  },
  "event_data": {
    "AcOnline": true
  },
  "message": ""
}

Event ID 107: The system has resumed from sleep

Channel: Diagnostic, System
Task: PostSleepNotification

Fields #

Name	Description
`TargetState` UInt32
`EffectiveState` UInt32
`WakeFromState` UInt32
`ProgrammedWakeTimeAc`
`ProgrammedWakeTimeDc`
`WakeRequesterTypeAc`
`WakeRequesterTypeDc`

Event ID 108: PowerTransition108

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`CopyBytes` UInt64
`ElapsedTime` UInt32
`IoTime` UInt32
`InitTime` UInt32
`CopyTime` UInt32
`PagesWritten` UInt32
`PagesProcessed` UInt32
`DumpCount` UInt32
`FileRuns` UInt32
`ReadTime` UInt32
`ResumeAppTime` UInt32
`CompressTime` UInt32

Event ID 109: The kernel power manager has initiated a shutdown transition.

Channel: System
Level: Informational
Task: ShutdownAction

Message #

The kernel power manager has initiated a shutdown transition.

Action: %1 
Event Code: %2 
Reason: %3

Fields #

Name	Description
`ShutdownActionType` UInt32	Action.
`ShutdownEventCode` UInt32	Event Code.
`ShutdownReason` UInt32	Reason.

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 109,
    "version": 0,
    "level": 4,
    "task": 103,
    "opcode": 0,
    "keywords": -9223301668110597116,
    "time_created": "2026-06-13T05:22:39.4639734+00:00",
    "event_record_id": 7415,
    "correlation": {},
    "execution": {
      "process_id": 712,
      "thread_id": 716
    },
    "channel": "System",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "ShutdownActionType": "5",
    "ShutdownEventCode": "0",
    "ShutdownReason": "5"
  },
  "message": "The kernel power manager has initiated a shutdown transition.\r\n\r\nShutdown Reason: Kernel API"
}

Event ID 110: SystemTimerResolutionStackRundown

Channel: Diagnostic
Level: Informational
Task: SystemTimerResolutionStackRundown

Fields #

Name	Description
`RequestedPeriod` UInt32
`Pid` UInt32
`AppNameLength` UInt16
`AppName` UnicodeString
`StackSize` UInt32
`Stack` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 110,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.800Z",
    "version": 0
  },
  "event_data": {
    "AppName": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\150.0.4078.83\\msedgewebview2.exe",
    "AppNameLength": 110,
    "Pid": 8072,
    "RequestedPeriod": 10000,
    "Stack": "0x7FFEB2DF45D4",
    "StackSize": 12
  },
  "message": ""
}

Event ID 111: PowerSettingRundown_V1

Channel: Diagnostic
Level: Informational
Task: PowerSettingRundown

Fields #

Name	Description
`SettingGuid` GUID
`DataSize` UInt32
`Data` Binary
`Override` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.801Z",
    "version": 0
  },
  "event_data": {
    "Data": "00000000",
    "DataSize": 4,
    "Override": false,
    "SettingGuid": "{5D3E9A59-E9D5-4B00-A6BD-FF34FF516548}"
  },
  "message": ""
}

Event ID 112: PowerSettingChange_V1

Channel: Diagnostic
Level: Informational
Task: PowerSettingChange

Fields #

Name	Description
`SettingGuid` GUID
`DataSize` UInt32
`Data` Binary
`Override` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 112,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.583Z",
    "version": 0
  },
  "event_data": {
    "Data": "F9020000",
    "DataSize": 4,
    "Override": false,
    "SettingGuid": "{515C31D8-F734-163D-A0FD-11A08C91E8F1}"
  },
  "message": ""
}

Event ID 113: ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.

Channel: Thermal-Diagnostic
Task: PassiveCoolingDiagnostic

Message #

ACPI thermal zone %2 has %4 passive cooling.             
EventTime = %3             
_PSV = %5K             
_TMP = %6K             
_TC1 = %7             
_TC2 = %8             
_TSP = %9ms             
Delta P = %10

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`PassiveCoolingState` UInt16
`_PSV` UInt32
`_TMP` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`DeltaP` Int32
`MinimumThrottle` Int32

Event ID 114: ACPI thermal zone ThermalZoneDeviceInstance has PassiveCoolingState passive cooling.

Channel: Thermal-Operational
Task: PassiveCoolingOperational

Message #

ACPI thermal zone %2 has %4 passive cooling.             
EventTime = %3             
_PSV = %5K             
_TMP = %6K             
_TC1 = %7             
_TC2 = %8             
_TSP = %9ms             
Delta P = %10

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`PassiveCoolingState` UInt16
`_PSV` UInt32
`_TMP` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`DeltaP` Int32
`MinimumThrottle` Int32

Event ID 115: ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

Channel: Thermal-Diagnostic
Task: ActiveCoolingDiagnostic

Message #

ACPI thermal zone %2 has %4 active cooling.             
EventTime = %3             
_AC0 = %5K             
_AC1 = %6K             
_AC2 = %7K             
_AC3 = %8K             
_AC4 = %9K             
_AC5 = %10K             
_AC6 = %11K             
_AC7 = %12K             
_AC8 = %13K             
_AC9 = %14K             
_TMP = %15K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`ActiveCoolingState` UInt16
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_TMP` UInt32

Event ID 116: ACPI thermal zone ThermalZoneDeviceInstance has ActiveCoolingState active cooling.

Channel: Thermal-Operational
Task: ActiveCoolingOperational

Message #

ACPI thermal zone %2 has %4 active cooling.             
EventTime = %3             
_AC0 = %5K             
_AC1 = %6K             
_AC2 = %7K             
_AC3 = %8K             
_AC4 = %9K             
_AC5 = %10K             
_AC6 = %11K             
_AC7 = %12K             
_AC8 = %13K             
_AC9 = %14K             
_TMP = %15K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`EventTime` FILETIME
`ActiveCoolingState` UInt16
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_TMP` UInt32

Event ID 117: PowerTransition117_V2

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`TotalResumeTime` UInt32
`POSTTime` UInt32
`ResumeBootMgrTime` UInt32
`ResumeAppTime` UInt32
`ResumeAppStartTime` UInt32
`ResumeLibraryInitTime` UInt32
`ResumeInitTime` UInt32
`ResumeHiberFileTime` UInt32
`ResumeRestoreImageStartTimestamp` UInt32
`ResumeIoTime` UInt32
`ResumeDecompressTime` UInt32
`ResumeMapTime` UInt32
`ResumeUnmapTime` UInt32
`ResumeUserInOutTime` UInt32
`ResumeAllocateTime` UInt32
`ResumeKernelSwitchTimestamp` UInt32
`KernelReturnFromHandlerTimestamp` UInt32
`SleeperThreadEndTimestamp` UInt32
`TimeStampCounterAtSwitchTime` UInt32
`KernelReturnSystemPowerStateTimestamp` UInt32
`HiberHiberFileTime` UInt32
`InitTime` UInt32
`HiberSharedBufferTime` UInt32
`TotalHibernateTime` UInt32
`KernelResumeHiberFileTime` UInt32
`KernelResumeInitTime` UInt32
`KernelResumeSharedBufferTime` UInt32
`DeviceResumeTime` UInt32
`KernelAnimationTime` UInt32
`KernelPagesProcessed` UInt32
`KernelPagesWritten` UInt64
`BootPagesProcessed` UInt32
`BootPagesWritten` UInt64
`HiberWriteRate` UInt32
`HiberCompressRate` UInt32
`ResumeReadRate` UInt32
`ResumeDecompressRate` UInt32
`FileRuns` UInt32
`NoMultiStageResumeReason` UInt32
`MaxHuffRatio` UInt32
`SecurePagesProcessed` UInt32
`HiberChecksumTime` UInt32
`HiberChecksumIoTime` UInt32
`ResumeChecksumTime` UInt32
`ResumeChecksumIoTime` UInt32
`KernelChecksumTime` UInt32
`KernelChecksumIoTime` UInt32
`WinresumeExitTimestamp` UInt32
`TcbLoaderStartTimestamp` UInt32
`TcbLoaderEndTimestamp` UInt32
`RemappedPageLookupCycles` UInt32
`TcbLaunchPrepareCycles` UInt32
`TcbLaunchPrepareDataCycles` UInt32
`DecryptVsmPagesPhase0Cycles` UInt32
`DecryptVsmPagesPhase1Cycles` UInt32
`DecryptVsmPagesPhase2Cycles` UInt32
`TcbLoaderAuthenticateCycles` UInt32
`TcbLoaderDecryptCycles` UInt32
`TcbLoaderValidateCycles` UInt32

Event ID 118: Idle resiliency activated with requested clock period: RequestedResolution(Internal flags:Flags, Ticks:Ticks).

Channel: Diagnostic
Task: IdleResiliencyStart

Message #

Idle resiliency activated with requested clock period: %1(Internal flags:%2, Ticks:%3).

Fields #

Name	Description
`RequestedResolution` UInt32
`Flags` UInt32
`Ticks` UInt32

Event ID 119: Idle resiliency deactivated (Internal flags:Flags).

Channel: Diagnostic
Task: IdleResiliencyEnd

Message #

Idle resiliency deactivated (Internal flags:%2).

Fields #

Name	Description
`RequestedResolution` UInt32
`Flags` UInt32
`Ticks` UInt32

Event ID 120: PowerTransition120

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`HiberfileSizeKB` UInt32
`TotalHibernateTime` UInt32
`HiberHiberFileTime` UInt32

Event ID 121: PowerTransition121_V1

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`DriverWakeTime` UInt32
`TotalResumeTime` UInt32
`BiosInitTime` UInt32
`ResumeAppsTime` UInt32
`ResumeServicesTime` UInt32

Event ID 122: PowerTransition122

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`TotalResumeTime` UInt32
`PhasePagesWrittenMB` UInt32
`ResumeAppAndKernelResumeHiberFileTime` UInt32
`POSTAndDeviceResumeTime` UInt32
`RatesAndResumeAppsServicesTime` UInt32
`PhasePagesProcessedMB` UInt32

Event ID 123: PowerTransition123_V1

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`HiberfileSize` UInt32
`TotalHybridShutdownTime` UInt32
`HiberfileCreateTime` UInt32
`SystemShutdownTime` UInt32

Event ID 124: PowerTransition124

Channel: Diagnostic
Task: PowerTransition

Fields #

Name	Description
`TotalResumeTime` UInt32
`PhasePagesWrittenMB` UInt32
`ResumeAppAndKernelResumeHiberFileTime` UInt32
`POSTAndDeviceResumeTime` UInt32
`RatesAndResumeAppsServicesTime` UInt32
`PhasePagesProcessedMB` UInt32

Event ID 125: ACPI thermal zone ThermalZoneDeviceInstance has been enumerated.

Channel: System
Task: ThermalZoneEnumerated

Message #

ACPI thermal zone %2 has been enumerated.             
_PSV = %3K             
_TC1 = %4             
_TC2 = %5             
_TSP = %6ms             
_AC0 = %7K             
_AC1 = %8K             
_AC2 = %9K             
_AC3 = %10K             
_AC4 = %11K             
_AC5 = %12K             
_AC6 = %13K             
_AC7 = %14K             
_AC8 = %15K             
_AC9 = %16K             
_CRT = %17K             
_HOT = %18K

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`_PSV` UInt32
`_TC1` UInt32
`_TC2` UInt32
`_TSP` UInt32
`_AC0` UInt32
`_AC1` UInt32
`_AC2` UInt32
`_AC3` UInt32
`_AC4` UInt32
`_AC5` UInt32
`_AC6` UInt32
`_AC7` UInt32
`_AC8` UInt32
`_AC9` UInt32
`_CRT` UInt32
`_HOT` UInt32
`MinimumThrottle` Int32
`_CR3` UInt32
`OverThrottleThreshold` UInt32
`DescriptionLength` UInt16
`Description` UnicodeString
`_TZP` UInt32

Event ID 126: DevicesSuspendLevel

Channel: Diagnostic
Task: DevicesSuspendLevel

Fields #

Name	Description
`Level` UInt32
`MinorFunction` UInt8

Event ID 127: DevicesSuspendLevel127

Channel: Diagnostic
Task: DevicesSuspendLevel

Fields #

Name	Description
`Level` UInt32
`MinorFunction` UInt8

Event ID 128: DevicesWakeLevel

Channel: Diagnostic
Task: DevicesWakeLevel

Fields #

Name	Description
`Level` UInt32
`MinorFunction` UInt8

Event ID 129: DevicesWakeLevel129

Channel: Diagnostic
Task: DevicesWakeLevel

Fields #

Name	Description
`Level` UInt32
`MinorFunction` UInt8

Event ID 130: Firmware S3 times.

Channel: System
Task: PowerTransition

Description

Firmware S3 times. SuspendStart: Firmware_S3_times_SuspendStart, SuspendEnd: SuspendEnd.

Message #

Firmware S3 times. SuspendStart: %1, SuspendEnd: %2

Fields #

Name	Description
`SuspendStart` UInt64
`SuspendEnd` UInt64

Event ID 131: Firmware S3 times.

Channel: System
Task: PowerTransition

Description

Firmware S3 times. ResumeCount: Firmware_S3_times_ResumeCount, FullResume: FullResume, AverageResume: AverageResume.

Message #

Firmware S3 times. ResumeCount: %1, FullResume: %2, AverageResume: %3

Fields #

Name	Description
`ResumeCount` UInt32
`FullResume` UInt32
`AverageResume` UInt32

Event ID 132: FirmwarePlatformRoleRundown

Channel: Diagnostic
Level: Informational
Task: FirmwarePlatformRoleRundown

Fields #

Name	Description
`PlatformRole` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 132,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.807Z",
    "version": 0
  },
  "event_data": {
    "PlatformRole": 0
  },
  "message": ""
}

Event ID 133: ResumeAppsPhaseStop

Channel: Diagnostic
Task: ResumeApps
Opcode: PhaseStop

Event ID 134: ResumeServicesPhaseStop

Channel: Diagnostic
Task: ResumeServices
Opcode: PhaseStop

Event ID 135: ConsoleDisplayState

Channel: Diagnostic
Task: ConsoleDisplayState

Fields #

Name	Description
`DisplayState` UInt32

Event ID 136: DeviceRundown

Channel: Diagnostic
Level: Informational
Task: DeviceRundown

Fields #

Name	Description
`DeviceNode` Pointer
`PowerState` UInt8
`InstancePathLength` UInt16
`InstancePath` UnicodeString
`FriendlyNameLength` UInt16
`FriendlyName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 136,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 11660
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.806Z",
    "version": 0
  },
  "event_data": {
    "DeviceNode": "0xFFFFC807B55DE8A0",
    "FriendlyName": "volume",
    "FriendlyNameLength": 6,
    "InstancePath": "STORAGE\\Volume\\{2482d0d2-e67f-11f0-9fb1-806e6f6e6963}#0000000000100000",
    "InstancePathLength": 70,
    "PowerState": 0
  },
  "message": ""
}

Event ID 137: The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (SSleepState).

Channel: System
Task: MtrrChanged

Description

The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (SSleepState). This can result in reduced resume performance.

Message #

The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (S%1). This can result in reduced resume performance.

Fields #

Name	Description
`SleepState` UInt32

Event ID 138: ThermalPerfTrack

Channel: Diagnostic
Task: ThermalPerfTrack

Fields #

Name	Description
`Throttle` UInt32
`Temperature` UInt32
`ZoneLength` UInt16
`Zone` UnicodeString

Event ID 139: ThermalDurationPerfTrack

Channel: Diagnostic
Task: ThermalDurationPerfTrack

Fields #

Name	Description
`ThrottleDuration` UInt32
`ZoneLength` UInt16
`Zone` UnicodeString

Event ID 140: CsConsumptionPerfTrack

Channel: Diagnostic
Task: CsConsumptionPerfTrack

Fields #

Name	Description
`EnergyDrain` UInt32
`Duration` UInt32
`DripsTransitions` UInt32
`Flags` UInt32

Event ID 141: CsFanPerfTrack

Channel: Diagnostic
Task: CsFanPerfTrack

Fields #

Name	Description
`FanDuration` UInt32
`ActivationDelay` UInt32

Event ID 142: The system has rebooted without cleanly shutting down first.

Channel: System
Task: AbnormalReset

Description

The system has rebooted without cleanly shutting down first. This error is caused because the system stopped responding and the hardware watchdog triggered a system reset.

Message #

The system has rebooted without cleanly shutting down first. This error is caused because the system stopped responding and the hardware watchdog triggered a system reset.

Fields #

Name	Description
`ResetReasonMask` UInt32

Event ID 143: CsDripsWatchdogPerfTrack

Channel: Diagnostic
Task: CsDripsWatchdogPerfTrack

Fields #

Name	Description
`ResiliencyPhaseNonActivatedNoDripsMs` UInt32
`NonActivatedCpuTimeMs` UInt32
`DurationThisPeriodMs` UInt32
`ActionsTakenAndOnAc` UInt32

Event ID 144: ThermalEvent

Channel: Thermal-Diagnostic
Task: ThermalEvent

Fields #

Name	Description
`InitiatorLength` UInt16
`Initiator` UnicodeString
`Type` UInt32
`Temperature` UInt32
`TripPointTemperature` UInt32

Event ID 145: ThermalZoneRundown_V2

Channel: Thermal-Diagnostic
Task: ThermalZoneRundown

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`ActiveCoolingState` UInt16
`ActivePoint` Int32
`PassiveCoolingState` UInt16
`ThrottleLimit` Int32
`ThermalStandby` Boolean
`OverThrottled` Boolean
`DescriptionLength` UInt16
`Description` UnicodeString

Event ID 146: PowerSettingCallbackStart

Channel: Diagnostic
Level: Informational
Task: PowerSettingCallback
Opcode: Start

Fields #

Name	Description
`Callback` Pointer
`SettingGuid` GUID
`DataSize` UInt32
`Data` Binary

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 146,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.582Z",
    "version": 0
  },
  "event_data": {
    "Callback": "0xFFFFF801657DEC90",
    "Data": "F9020000",
    "DataSize": 4,
    "SettingGuid": "{515C31D8-F734-163D-A0FD-11A08C91E8F1}"
  },
  "message": ""
}

Event ID 147: PowerSettingCallbackStop

Channel: Diagnostic
Level: Informational
Task: PowerSettingCallback
Opcode: Stop

Fields #

Name	Description
`Callback` Pointer
`SettingGuid` GUID

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 147,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.583Z",
    "version": 0
  },
  "event_data": {
    "Callback": "0xFFFFF801657DEC90",
    "SettingGuid": "{515C31D8-F734-163D-A0FD-11A08C91E8F1}"
  },
  "message": ""
}

Event ID 148: EnergySaverState

Channel: Diagnostic
Task: EnergySaverState

Fields #

Name	Description
`State` Int32
`Reason` Int32

Event ID 149: SessionDisplayOff

Channel: Diagnostic
Task: SessionDisplayOff

Fields #

Name	Description
`Session` UInt32
`Console` Boolean
`Reason` UInt32

Event ID 150: SessionDisplayOn

Channel: Diagnostic
Task: SessionDisplayOn

Fields #

Name	Description
`Session` UInt32
`Console` Boolean
`Reason` UInt32

Event ID 151: CoolingExtensionAdd

Channel: Thermal-Diagnostic
Task: CoolingExtensionAdd

Fields #

Name	Description
`PassiveSupported` Boolean
`ActiveSupported` Boolean
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`DeviceId` UnicodeString

Event ID 152: CoolingExtensionRundown

Channel: Thermal-Diagnostic
Task: CoolingExtensionRundown

Fields #

Name	Description
`PassiveSupported` Boolean
`ActiveSupported` Boolean
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`DeviceId` UnicodeString

Event ID 153: CoolingExtensionRemove

Channel: Thermal-Diagnostic
Task: CoolingExtensionRemove

Fields #

Name	Description
`PassiveSupported` Boolean
`ActiveSupported` Boolean
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`DeviceId` UnicodeString

Event ID 154: CoolingExtensionPassiveUpdate

Channel: Thermal-Diagnostic
Task: CoolingExtensionPassiveUpdate

Fields #

Name	Description
`Throttle` UInt8
`Token` Pointer

Event ID 155: CoolingExtensionActiveUpdate

Channel: Thermal-Diagnostic
Task: CoolingExtensionActiveUpdate

Fields #

Name	Description
`ActiveEngaged` Boolean
`Token` Pointer

Event ID 156: ThermalRequestAdd

Channel: Thermal-Diagnostic
Task: ThermalRequestAdd

Fields #

Name	Description
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`CallerLength` UInt16
`ContextLength` UInt16
`PolicyLength` UInt16
`DeviceId` UnicodeString
`Caller` UnicodeString
`Context` UnicodeString
`Policy` Binary

Event ID 157: ThermalRequestRundown

Channel: Thermal-Diagnostic
Task: ThermalRequestRundown

Fields #

Name	Description
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`CallerLength` UInt16
`ContextLength` UInt16
`PolicyLength` UInt16
`DeviceId` UnicodeString
`Caller` UnicodeString
`Context` UnicodeString
`Policy` Binary

Event ID 158: ThermalRequestRemove

Channel: Thermal-Diagnostic
Task: ThermalRequestRemove

Fields #

Name	Description
`Throttle` UInt8
`ActiveEngaged` Boolean
`Token` Pointer
`DeviceIdLength` UInt16
`CallerLength` UInt16
`ContextLength` UInt16
`PolicyLength` UInt16
`DeviceId` UnicodeString
`Caller` UnicodeString
`Context` UnicodeString
`Policy` Binary

Event ID 159: ThermalRequestPassiveUpdate

Channel: Thermal-Diagnostic
Task: ThermalRequestPassiveUpdate

Fields #

Name	Description
`Throttle` UInt8
`Token` Pointer

Event ID 160: ThermalRequestActiveUpdate

Channel: Thermal-Diagnostic
Task: ThermalRequestActiveUpdate

Fields #

Name	Description
`ActiveEngaged` Boolean
`Token` Pointer

Event ID 161: CsDripsWatchdog_V3

Channel: Diagnostic
Task: CsDripsWatchdog

Fields #

Name	Description
`ResiliencyPhaseNonActivatedNoDripsMs` UInt32
`NonActivatedCpuTimeMs` UInt32
`DurationThisPeriodMs` UInt32
`OnAc` Boolean
`EnergyDrainMw` UInt32
`DeviceConstraint` Boolean
`ActionsTaken` UInt32
`DeviceServiceNameLength` UInt16
`DeviceServiceName` UnicodeString
`ChildServiceNameLength` UInt16
`ChildServiceName` UnicodeString
`PepPreVeto` UInt32
`InvocationCount` UInt32

Event ID 162: ThermalZoneThermalStandbyUpdate

Channel: Thermal-Diagnostic
Task: ThermalZoneThermalStandbyUpdate

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`Engaged` Boolean

Event ID 163: ThermalZoneOverthrottledUpdate

Channel: Thermal-Diagnostic
Task: ThermalZoneOverthrottledUpdate

Fields #

Name	Description
`ThermalZoneDeviceInstanceLength` UInt16
`ThermalZoneDeviceInstance` UnicodeString
`Engaged` Boolean

Event ID 164: ThermalStandbyNotification

Channel: Thermal-Diagnostic
Task: ThermalStandbyNotification

Event ID 165: SystemIdle_V1

Channel: Diagnostic
Task: SystemIdle

Fields #

Name	Description
`IdleInformationUpdated` Boolean
`TimeoutSource` UInt32
`Action` UInt32
`MinState` UInt32
`Timeout` UInt32
`Flags` UInt32
`Reason` UInt32

Event ID 166: SystemIdle166_V1

Channel: Diagnostic
Task: SystemIdle

Fields #

Name	Description
`AccumulatedIdleTime` UInt32
`SystemIdle` Boolean
`Flags` UInt32
`Action` UInt32
`MinState` UInt32
`DozeS4Timeout` UInt32
`PredictedUserReturnTime` FILETIME

Event ID 167: SystemIdle167

Channel: Diagnostic
Task: SystemIdle

Fields #

Name	Description
`Reason` UInt32
`S0LowPowerDozeTimerCancelled` Boolean

Event ID 168: SystemIdle168

Channel: Diagnostic
Task: SystemIdle

Fields #

Name	Description
`CancelledDueToUserInput` Boolean

Event ID 169: SystemIdleStart

Channel: Diagnostic
Task: SystemIdle
Opcode: Start

Fields #

Name	Description
`Source` UInt32
`Time` FILETIME

Event ID 170: SystemIdleStop

Channel: Diagnostic
Task: SystemIdle
Opcode: Stop

Fields #

Name	Description
`Reason` UInt32

Event ID 171: CsDeepSleepWatchdog_V1

Channel: Diagnostic
Task: CsDeepSleepWatchdog

Fields #

Name	Description
`ResiliencyPhaseNonActivatedNoDeepSleepMs` UInt32
`NonActivatedCpuTimeMs` UInt32
`DurationThisPeriodMs` UInt32
`OnAc` Boolean
`ActionsTaken` UInt32
`PowerSettingPending` Boolean

Event ID 172: Connectivity state in standby: State, Reason: Reason.

Channel: System
Level: Informational
Task: StandbyConnectivityUpdate

Message #

Connectivity state in standby: %1, Reason: %2

Fields #

Name	Description
`State` UInt32	Connectivity state in standby.
`Reason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 172,
    "version": 0,
    "level": 4,
    "task": 203,
    "opcode": 0,
    "keywords": -9223372036854774780,
    "time_created": "2026-05-29T16:32:46.0451209+00:00",
    "event_record_id": 6682,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 456
    },
    "channel": "System",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "State": "2",
    "Reason": "6"
  },
  "message": "Connectivity state in standby: Disconnected, Reason: NIC compliance"
}

Event ID 173: FlushSleepStudyLoggerStart

Channel: Diagnostic
Task: FlushSleepStudyLogger
Opcode: Start

Event ID 174: FlushSleepStudyLoggerStop

Channel: Diagnostic
Task: FlushSleepStudyLogger
Opcode: Stop

Event ID 175: StandbyConnectivityRundown

Channel: Diagnostic
Level: Informational
Task: StandbyConnectivityRundown

Fields #

Name	Description
`State` UInt32
`Reason` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 175,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.807Z",
    "version": 0
  },
  "event_data": {
    "Reason": 6,
    "State": 2
  },
  "message": ""
}

Event ID 176: CsComplianceRundown

Channel: Diagnostic
Level: Informational
Task: CsComplianceRundown

Fields #

Name	Description
`Type` UInt32
`State` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 176,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.807Z",
    "version": 0
  },
  "event_data": {
    "State": 0,
    "Type": 0
  },
  "message": ""
}

Event ID 177: CsComplianceUpdate

Channel: Diagnostic
Task: CsComplianceUpdate

Fields #

Name	Description
`Type` UInt32
`State` UInt32

Event ID 178: Background Activity Policy updated from PreviousPolicy to NewPolicy.

Channel: Diagnostic
Task: BackgroundActivityPolicyUpdate

Message #

Background Activity Policy updated from %1 to %2.

Fields #

Name	Description
`PreviousPolicy` UInt32
`NewPolicy` UInt32

Event ID 179: ForceIdleStateChange

Channel: Diagnostic
Task: ForceIdleStateChange

Fields #

Name	Description
`PrevState` UInt32
`NewState` UInt32

Event ID 180: ForceIdleReset

Channel: Diagnostic
Task: ForceIdleReset

Fields #

Name	Description
`Reason` UInt32

Event ID 181: DeepSleepSetConstraint

Channel: Diagnostic
Level: Informational
Task: DeepSleepSetConstraint

Fields #

Name	Description
`Constraint` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 181,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.582Z",
    "version": 0
  },
  "event_data": {
    "Constraint": 3
  },
  "message": ""
}

Event ID 182: DeepSleepClearConstraint

Channel: Diagnostic
Level: Informational
Task: DeepSleepClearConstraint

Fields #

Name	Description
`Constraint` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 182,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 10892
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:20.583Z",
    "version": 0
  },
  "event_data": {
    "Constraint": 3
  },
  "message": ""
}

Event ID 183: DeepSleepConstraintRundown

Channel: Diagnostic
Level: Informational
Task: DeepSleepConstraintRundown

Fields #

Name	Description
`ConstraintCount` UInt16
`Constraints` AnsiString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 183,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.808Z",
    "version": 0
  },
  "event_data": {
    "ConstraintCount": 3,
    "Constraints": "\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0006"
  },
  "message": ""
}

Event ID 184: IRTimerExpiries

Channel: Diagnostic
Task: IRTimerExpiries

Fields #

Name	Description
`ExpiryCount` UInt32
`RelativeId` UInt16
`ComponentName` UnicodeString

Event ID 185: RtcWakeInfo

Channel: Diagnostic
Task: RtcWakeInfo

Fields #

Name	Description
`WokeSystem` Boolean
`RejectReason` UInt32
`Uncertain` Boolean
`Spurious` Boolean
`FixedWakeSourceMask` UInt32
`AcAlarmSignaled` Boolean
`DcAlarmSignaled` Boolean
`RtcSignaled` Boolean
`AcProgrammedTime` FILETIME
`DcProgrammedTime` FILETIME
`UsingAcTime` Boolean
`WakeTime` FILETIME
`AdjustedWakeTime` FILETIME
`FullWake` Boolean

Event ID 186: IrpPended

Channel: Diagnostic
Task: Irp
Opcode: Pended

Fields #

Name	Description
`Irp` Pointer

Event ID 187: User-mode process attempted to change the system state by calling SetSuspendState or SetSystemPowerState APIs.

Channel: System
Task: NtInitiatePowerActionApiCall

Fields #

Name	Description
`ApiCallerNameLength` UInt16
`ApiCallerName` UnicodeString
`SystemAction` UInt32
`LightestSystemState` UInt32

Event ID 188: PrepareSleepStart

Channel: Diagnostic
Task: PrepareSleep
Opcode: Start

Event ID 189: PrepareSleepStop

Channel: Diagnostic
Task: PrepareSleep
Opcode: Stop

Event ID 190: TimerResolutionRequestIgnoreChange

Channel: Diagnostic
Task: TimerResolutionRequestIgnoreChange

Fields #

Name	Description
`RequestIgnored` Boolean
`Pid` UInt32

Event ID 191: NonAttributedCpuReferenceUpdate

Channel: Diagnostic
Task: NonAttributedCpuReferenceUpdate

Fields #

Name	Description
`Count` UInt32

Event ID 200: task_0

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmSid` SID
`SqmWindowsSessionId` UInt32
`SqmSessionFlags` UInt32

Event ID 201: task_0201

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID

Event ID 202: task_0202

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 203: task_0Stop

Channel: Operational
Opcode: Stop

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 204: task_0204

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 205: task_0205

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 206: task_0206

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 207: task_0207

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStringDatapointValue` UnicodeString

Event ID 208: task_0208

Channel: Operational
Opcode: Info

Fields #

Name	Description
`SqmType` UInt32
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Event ID 300: PluginRegistration

Channel: Operational
Task: PluginRegistration

Fields #

Name	Description
`Plugin` Pointer
`Attributes` UInt64

Event ID 301: PluginRegistrationRundown

Channel: Operational
Task: PluginRegistrationRundown

Fields #

Name	Description
`Plugin` Pointer
`Attributes` UInt64

Event ID 302: DevicePreparation

Channel: Operational
Level: Informational
Task: DevicePreparation

Fields #

Name	Description
`Token` Pointer
`Plugin` Pointer
`IdLength` UInt16
`Id` UnicodeString
`Prepared` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 302,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 11360
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:47.225Z",
    "version": 0
  },
  "event_data": {
    "Id": "ROOT\\VMS_VSMP\\0001",
    "IdLength": 18,
    "Plugin": "0x0",
    "Prepared": false,
    "Token": "0xFFFFC807C10F1630"
  },
  "message": ""
}

Event ID 303: DeviceRegistration_V1

Channel: Operational
Task: DeviceRegistration

Fields #

Name	Description
`Token` Pointer
`Plugin` Pointer
`PowerState` UInt8
`Status` UInt32	NTSTATUS reference
`IdLength` UInt16
`Id` UnicodeString
`ComponentCount` UInt32
`VetoMasks` UInt32

Event ID 304: DeviceRegistrationRundown_V1

Channel: Operational
Level: Informational
Task: DeviceRegistrationRundown

Fields #

Name	Description
`Token` Pointer
`Plugin` Pointer
`PowerState` UInt8
`Status` UInt32	NTSTATUS reference
`IdLength` UInt16
`Id` UnicodeString
`ComponentCount` UInt32
`VetoMasks` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 304,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.806Z",
    "version": 0
  },
  "event_data": {
    "ComponentCount": 1,
    "Id": "\\_SB.PCI0",
    "IdLength": 9,
    "Plugin": "0x0",
    "PowerState": 0,
    "Status": 0,
    "Token": "0xFFFFC807AFC7FBF0",
    "VetoMasks": 0
  },
  "message": ""
}

Event ID 305: DeviceUnregistration

Channel: Operational
Task: DeviceUnregistration

Fields #

Name	Description
`Token` Pointer

Event ID 306: StartDevicePowerManagement

Channel: Operational
Task: StartDevicePowerManagement

Fields #

Name	Description
`Token` Pointer

Event ID 307: DevicePowerRequirementToDevice

Channel: Operational
Level: Informational
Task: DevicePowerRequirementToDevice

Fields #

Name	Description
`Token` Pointer
`PowerRequired` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 307,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "PowerRequired": true,
    "Token": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 308: DevicePowerState

Channel: Operational
Level: Informational
Task: DevicePowerState

Fields #

Name	Description
`Token` Pointer
`PowerState` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 308,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.781Z",
    "version": 0
  },
  "event_data": {
    "PowerState": 0,
    "Token": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 309: DevicePowered

Channel: Operational
Level: Informational
Task: DevicePowered

Fields #

Name	Description
`Token` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 309,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 8560
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.781Z",
    "version": 0
  },
  "event_data": {
    "Token": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 310: ComponentRegistration_V1

Channel: Operational
Task: ComponentRegistration

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Active` Boolean
`IdleState` UInt32
`IdleStateCount` UInt32
`IdleStates` UInt16

Event ID 311: ComponentRegistrationRundown_V1

Channel: Operational
Level: Informational
Task: ComponentRegistrationRundown

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Active` Boolean
`IdleState` UInt32
`IdleStateCount` UInt32
`IdleStates` UInt16

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 311,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.806Z",
    "version": 0
  },
  "event_data": {
    "Active": true,
    "Component": 0,
    "IdleState": 0,
    "IdleStateCount": 2,
    "IdleStates": "00000000000000000000000000000000FFFFFFFF0000000040420F00000000000000000000000000FFFFFFFF00000000",
    "Token": "0xFFFFC807AFC7FBF0"
  },
  "message": ""
}

Event ID 312: ComponentCondition

Channel: Operational
Level: Informational
Task: ComponentCondition

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Active` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 312,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 3844
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.781Z",
    "version": 0
  },
  "event_data": {
    "Active": true,
    "Component": 0,
    "Token": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 313: ComponentIdleState

Channel: Operational
Level: Informational
Task: ComponentIdleState

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`IdleState` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 313,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 28
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.782Z",
    "version": 0
  },
  "event_data": {
    "Component": 0,
    "IdleState": 0,
    "Token": "0xFFFFC807B0FEF8A0"
  },
  "message": ""
}

Event ID 314: ComponentLatency

Channel: Operational
Task: ComponentLatency

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Latency` UInt64

Event ID 315: ComponentResidency

Channel: Operational
Task: ComponentResidency

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Residency` UInt64

Event ID 316: ComponentWake

Channel: Operational
Task: ComponentWake

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`ArmedForWake` Boolean

Event ID 317: DevicePowerRequirementFromPep

Channel: Operational
Level: Informational
Task: DevicePowerRequirementFromPep

Fields #

Name	Description
`Token` Pointer
`PowerRequired` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 317,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "PowerRequired": true,
    "Token": "0xFFFFC807B620AC40"
  },
  "message": ""
}

Event ID 318: DeviceIdleConstraints

Channel: Operational
Task: DeviceIdleConstraints

Fields #

Name	Description
`Token` Pointer
`StateCount` UInt32
`MinimumDStates` UInt32

Event ID 319: ComponentIdleConstraints

Channel: Operational
Task: ComponentIdleConstraints

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`StateCount` UInt32
`MinimumFStates` UInt32

Event ID 320: DeviceVerboseRundown_V3

Channel: Operational
Level: Informational
Task: DeviceVerboseRundown

Fields #

Name	Description
`DeviceNode` Pointer
`DeviceIdLength` UInt16
`DeviceId` UnicodeString
`InstancePathLength` UInt16
`InstancePath` UnicodeString
`ServiceNameLength` UInt16
`ServiceName` UnicodeString
`PlatformStateDependents` UInt32
`Pdo` Pointer
`ParentDeviceNode` Pointer
`Flags` UInt32
`FriendlyNameLength` UInt16
`FriendlyName` UnicodeString
`DripsRequiredState` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 320,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.806Z",
    "version": 0
  },
  "event_data": {
    "DeviceId": "\\_SB.PCI0",
    "DeviceIdLength": 9,
    "DeviceNode": "0xFFFFC807AFC7FBF0",
    "DripsRequiredState": 5,
    "Flags": 4096,
    "FriendlyName": "PCI Bus (\\_SB.PCI0)",
    "FriendlyNameLength": 19,
    "InstancePath": "ACPI\\PNP0A03\\0",
    "InstancePathLength": 14,
    "ParentDeviceNode": "0xFFFFC807AFEE8C30",
    "Pdo": "0xFFFFC807B0FD4D90",
    "PlatformStateDependents": 0,
    "ServiceName": "pci",
    "ServiceNameLength": 3
  },
  "message": ""
}

Event ID 321: PerformanceStateRegistration

Channel: Operational
Task: PerformanceStateRegistration

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`SetCount` UInt32

Event ID 322: PerformanceStateRegistrationRundown

Channel: Operational
Task: PerformanceStateRegistrationRundown

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`SetCount` UInt32

Event ID 323: PerformanceStateSetRegistration

Channel: Operational
Task: PerformanceStateSetRegistration

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Set` UInt32
`NameLength` UInt16
`Name` UnicodeString
`Type` UInt32
`Unit` UInt32
`Minimum` UInt64
`Maximum` UInt64
`StateCount` UInt32
`StateValues` UInt64
`CurrentState` UInt64

Event ID 324: PerformanceStateSetRegistrationRundown

Channel: Operational
Task: PerformanceStateSetRegistrationRundown

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Set` UInt32
`NameLength` UInt16
`Name` UnicodeString
`Type` UInt32
`Unit` UInt32
`Minimum` UInt64
`Maximum` UInt64
`StateCount` UInt32
`StateValues` UInt64
`CurrentState` UInt64

Event ID 325: ComponentPerformanceState

Channel: Operational
Task: ComponentPerformanceState

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`PerformanceStateSetCount` UInt32
`PerformanceStateSets` UInt8

Event ID 326: ComponentPerformanceState326

Channel: Operational
Task: ComponentPerformanceState

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Progress` UInt32

Event ID 327: ComponentPerformanceState327

Channel: Operational
Task: ComponentPerformanceState

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`Succeeded` Boolean

Event ID 328: ComponentPerformanceState328

Channel: Operational
Task: ComponentPerformanceState

Fields #

Name	Description
`Token` Pointer
`Component` UInt32
`DeviceTransition` Boolean
`PowerState` UInt32
`PerformanceStateSetCount` UInt32
`PerformanceStateSets` UInt16

Event ID 329: DebuggerTransitionRequirements

Channel: Operational
Task: DebuggerTransitionRequirements

Fields #

Name	Description
`Token` Pointer
`StateCount` UInt32
`TransitionRequired` UInt8

Event ID 330: DefaultPepWorkerStart

Channel: Operational
Level: Informational
Task: DefaultPepWorker
Opcode: Start

Fields #

Name	Description
`StartDevice` Pointer

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 330,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 1,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "StartDevice": "0xFFFFC807B4209010"
  },
  "message": ""
}

Event ID 331: DefaultPepWorkerStop

Channel: Operational
Level: Informational
Task: DefaultPepWorker
Opcode: Stop

Fields #

Name	Description
`EndDevice` Pointer
`WorkType` Int8
`Phase` UInt8
`NumberExtraDevices` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Operational",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 331,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 24
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 2,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:52.777Z",
    "version": 0
  },
  "event_data": {
    "EndDevice": "0xFFFFC807B620AC40",
    "NumberExtraDevices": 0,
    "Phase": 0,
    "WorkType": -1
  },
  "message": ""
}

Event ID 332: DefaultPepWorkerDeviceRecovered

Channel: Operational
Task: DefaultPepWorkerDeviceRecovered

Fields #

Name	Description
`EndDevice` Pointer
`WorkType` Int8
`Phase` UInt8
`NumberExtraDevices` UInt8

Event ID 333: DefaultPepWorkerDeviceOrphaned

Channel: Operational
Task: DefaultPepWorkerDeviceOrphaned

Fields #

Name	Description
`EndDevice` Pointer
`WorkType` Int8
`Phase` UInt8
`NumberExtraDevices` UInt8

Event ID 400: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionCreated

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 401: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionClosed

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 402: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionConnected

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 403: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionDisconnected

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 404: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: ActiveInput

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 405: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: PassiveInput

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 406: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionLocked

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 407: SessionId: SessionId, Console:Console.

Channel: Diagnostic
Task: SessionUnlocked

Message #

SessionId: %1, Console:%2

Fields #

Name	Description
`SessionId` UInt32
`Console` Boolean

Event ID 408: User presence:User_presence.

Channel: Diagnostic
Task: SensorInput

Message #

User presence:%1

Fields #

Name	Description
`UserPresence` UInt32

Event ID 409: Reason code:Reason_code.

Channel: Diagnostic
Task: SensorInvalid

Message #

Reason code:%1

Fields #

Name	Description
`Code` UInt32

Event ID 410: Engaged.

Channel: Diagnostic
Task: SensorSmoothing

Description

Engaged:Engaged

Message #

Engaged:%1

Fields #

Name	Description
`Engaged` UInt32

Event ID 411: Engaged.

Channel: Diagnostic
Task: SensorWatchdog

Description

Engaged:Engaged

Message #

Engaged:%1

Fields #

Name	Description
`Engaged` UInt32

Event ID 412: Session Id:Session_Id, Value: Value.

Channel: Diagnostic
Task: DisplaySessionStatus

Message #

Session Id:%1, Value: %2

Fields #

Name	Description
`SessionId` UInt32
`State` UInt32

Event ID 413: Session Id:Session_Id, Value: Value.

Channel: Diagnostic
Task: UserSessionStatus

Message #

Session Id:%1, Value: %2

Fields #

Name	Description
`SessionId` UInt32
`State` UInt32

Event ID 414: Session Id:Session_Id, Value: Value.

Channel: Diagnostic
Task: UserGlobalStatus

Message #

Session Id:%1, Value: %2

Fields #

Name	Description
`SessionId` UInt32
`State` UInt32
`TransitionCount` UInt32

Event ID 415: Old value:Old_value, New value: New_value.

Channel: Diagnostic
Task: SensorInputChanged

Message #

Old value:%1, New value: %2

Fields #

Name	Description
`Old` UInt32
`New` UInt32

Event ID 416: Value:Value, Zeroed: Zeroed, Computed: Computed.

Channel: Diagnostic
Task: InputState

Message #

Value:%1, Zeroed: %2, Computed: %3

Fields #

Name	Description
`Value` UInt32
`Zeroed` UInt32
`Computed` UInt32

Event ID 417: Value:Value, Zeroed: Zeroed, Computed: Computed.

Channel: Diagnostic
Task: DisplayState

Message #

Value:%1, Zeroed: %2, Computed: %3

Fields #

Name	Description
`Value` UInt32
`Zeroed` UInt32
`Computed` UInt32

Event ID 418: Value:Value, Zeroed: Zeroed, Computed: Computed.

Channel: Diagnostic
Task: PolicyChange

Message #

Value:%1, Zeroed: %2, Computed: %3

Fields #

Name	Description
`SensorDisplayTimeout` UInt32
`DisplayTimeout` UInt32
`SensorInputTimeout` UInt32
`InputTimeout` UInt32
`SessionLockedTimeout` UInt32
`SensorEnabled` UInt32

Event ID 500: IO coalescing activated with spindown period: SpindownTimeout, Timer:TimerInterval, Flush:FlushInterval, Flags:Flags.

Channel: Diagnostic
Task: IoCoalescingOn

Message #

IO coalescing activated with spindown period: %1, Timer:%2, Flush:%3, Flags:%4.

Fields #

Name	Description
`SpindownTimeout` UInt32
`TimerInterval` UInt32
`FlushInterval` UInt32
`Flags` UInt32

Event ID 501: IO coalescing deactivated.

Channel: Diagnostic
Task: IoCoalescingOff

Event ID 502: IO coalescing flush command generated.

Channel: Diagnostic
Task: IoCoalescingFlush

Event ID 503: IO coalescing disk device DiskDeviceObject is about to be spun down.

Channel: Diagnostic
Task: IoCoalescingDiskIdle

Message #

IO coalescing disk device %1 is about to be spun down.

Fields #

Name	Description
`DiskDeviceObject` Pointer

Event ID 504: SystemLatencyUpdate

Channel: Diagnostic
Task: SystemLatencyUpdate

Fields #

Name	Description
`SystemLatency` UInt32

Event ID 505: SystemLatencyRundown

Channel: Diagnostic
Level: Informational
Task: SystemLatencyRundown

Fields #

Name	Description
`SystemLatency` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 505,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.801Z",
    "version": 0
  },
  "event_data": {
    "SystemLatency": 13001
  },
  "message": ""
}

Event ID 506: The system is entering Modern Standby Reason.

Channel: System
Task: CsEnterReason

Description

The system is entering Modern Standby.

Message #

The system is entering Modern Standby 

Reason: %1.

Fields #

Name	Description
`Reason` UInt32
`LidOpenState` Boolean
`ExternalMonitorConnectedState` Boolean
`ScenarioInstanceId` UInt8
`BatteryRemainingCapacityOnEnter` UInt32
`BatteryFullChargeCapacityOnEnter` UInt32
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32

Event ID 507: The system is exiting Modern Standby Reason.

Channel: System
Task: CsExitReason

Description

The system is exiting Modern Standby.

Message #

The system is exiting Modern Standby 

Reason: %10.

Fields #

Name	Description
`EnergyDrain` UInt32
`ActiveResidencyInUs` UInt64
`NonDripsTimeActivatedInUs` UInt64
`FirstDripsEntryInUs` UInt64
`DripsResidencyInUs` UInt64
`DurationInUs` UInt64
`DripsTransitions` UInt32
`FullChargeCapacityRatio` UInt8
`AudioPlaying` Boolean
`Reason` UInt32
`AudioPlaybackInUs` UInt64
`NonActivatedCpuInUs` UInt64
`PowerStateAc` Boolean
`HwDripsResidencyInUs` UInt64
`ExitLatencyInUs` UInt64
`DisconnectedStandby` Boolean
`AoAcCompliantNic` Boolean
`NonAttributedCpuInUs` UInt64
`ModernSleepEnabledActionsBitmask` UInt32
`ModernSleepAppliedActionsBitmask` UInt32
`LidOpenState` Boolean
`ExternalMonitorConnectedState` Boolean
`ScenarioInstanceId` UInt8
`IsCsSessionInProgressOnExit` Boolean
`BatteryRemainingCapacityOnExit` UInt32
`BatteryFullChargeCapacityOnExit` UInt32
`ScenarioInstanceIdV2` UInt64
`BootId` UInt32
`InputSuppressionActionCount` UInt32
`NonResiliencyTimeInUs` UInt64
`ResiliencyDripsTimeInUs` UInt64
`ResiliencyHwDripsTimeInUs` UInt64
`GdiOnTime` UInt64
`DwmSyncFlushTime` UInt64
`MonitorPowerOnTime` UInt64
`SleepEntered` Boolean
`ScreenOffEnergyCapacityAtStart` UInt32
`ScreenOffEnergyCapacityAtEnd` UInt32
`ScreenOffDurationInUs` UInt64
`SleepEnergyCapacityAtStart` UInt32
`SleepEnergyCapacityAtEnd` UInt32
`SleepDurationInUs` UInt64
`ScreenOffFullEnergyCapacityAtStart` UInt32
`ScreenOffFullEnergyCapacityAtEnd` UInt32
`SleepFullEnergyCapacityAtStart` UInt32
`SleepFullEnergyCapacityAtEnd` UInt32
`PowerSchemeInfo` UInt32
`PowerButtonSuppressionActionCount` UInt32
`ScreenOffSwDripsResidencyInUs` UInt64
`ScreenOffHwDripsResidencyInUs` UInt64
`SleepSwDripsResidencyInUs` UInt64
`SleepHwDripsResidencyInUs` UInt64

Event ID 508: The system has been constrained to a periodic tick Reason.

Channel: System
Task: DynamicTickDisabled

Description

The system has been constrained to a periodic tick.

Message #

The system has been constrained to a periodic tick 

Reason: %1.

Fields #

Name	Description
`Reason` UInt8

Event ID 509: DynamicTickStatusRundown

Channel: Diagnostic
Level: Informational
Task: DynamicTickStatusRundown

Fields #

Name	Description
`Flags` UInt8

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 509,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.808Z",
    "version": 0
  },
  "event_data": {
    "Flags": 0
  },
  "message": ""
}

Event ID 510: Scenario Power Manager (SPM) policy framework has current status: SpmStatus.

Channel: Diagnostic
Task: SpmStatusUpdate

Message #

Scenario Power Manager (SPM) policy framework has current status: %1.

Fields #

Name	Description
`SpmStatus` UInt8

Event ID 511: SpmStatusRundown

Channel: Diagnostic
Task: SpmStatusRundown

Fields #

Name	Description
`SpmStatus` UInt8

Event ID 512: SpmPolicyAliasRundown

Channel: Diagnostic
Task: SpmPolicyAliasRundown

Fields #

Name	Description
`PolicyGuid` GUID
`PolicyAliasLength` UInt16
`PolicyAlias` UnicodeString

Event ID 513: SpmScenarioPolicyRundown

Channel: Diagnostic
Task: SpmScenarioPolicyRundown

Fields #

Name	Description
`ScenarioGuid` GUID
`ScenarioNameLength` UInt16
`ScenarioName` UnicodeString
`Flags` UInt32
`DefaultSettingsScenarioGuid` GUID
`PolicyCount` UInt16
`PolicySettings` Int32

Event ID 518: IoShutdownFileSystemsStart

Channel: Diagnostic
Task: IoShutdownFileSystems
Opcode: Start

Event ID 519: IoShutdownFileSystemsStop

Channel: Diagnostic
Task: IoShutdownFileSystems
Opcode: Stop

Event ID 520: The brightness on this system is managed by high-precision brightness aware service.

Channel: System
Task: BrightnessEngineSwap

Event ID 521: Active battery count change.

Channel: System
Level: Informational
Task: BatteryCountChange

Fields #

Name	Description
`ValidBatteryCount` UInt32
`ErrorBatteryCount` UInt32
`AbandonedBatteryCount` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "331C3B3A-2005-44C2-AC5E-77220C37D6B4",
    "event_source_name": "",
    "event_id": 521,
    "version": 0,
    "level": 4,
    "task": 220,
    "opcode": 0,
    "keywords": 9223372036854776836,
    "time_created": "2022-04-04T13:11:11.019552+00:00",
    "event_record_id": 1541,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 260
    },
    "channel": "System",
    "computer": "WIN-TKC15D7KHUR",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "ValidBatteryCount": 1,
    "ErrorBatteryCount": 0,
    "AbandonedBatteryCount": 0
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 522: CsDripsDivergence

Channel: Diagnostic
Task: CsDripsDivergence

Fields #

Name	Description
`HwDripsTotalTimeValid` Boolean
`DripsTotalTimeThisPeriodUs` UInt64
`HwDripsTotalTimeThisPeriodUs` UInt64
`PopDripsSwHwDivergenceThreshold` UInt32

Event ID 523: Irp

Channel: Diagnostic
Task: Irp

Fields #

Name	Description
`Irp` Pointer
`Status` UInt32	NTSTATUS reference
`FailedDriver` UnicodeString
`ElapsedTime` UInt64

Event ID 524: Index Battery Trigger Met.

Channel: System
Task: BatteryTriggerMet

Message #

%1 Battery Trigger Met

Fields #

Name	Description
`Index` UInt32
`ActiveBatteryCount` UInt32
`RemainingPercentage` UInt32
`IsAcOnline` UInt32
`BatteryActionInternalFlags` HexInt32
`IsPowerActionCallIgnored` UInt32
`IsPowerPolicyEnabled` UInt32
`PowerPolicyAction` UInt32
`PowerPolicyBatteryLevel` UInt32
`PowerPolicyEventCode` UInt32
`PowerPolicyMinState` UInt32

Event ID 525: NetRefreshTimerArmed

Channel: Diagnostic
Task: NetRefreshTimerArmed

Fields #

Name	Description
`DurationInUs` UInt64

Event ID 526: NetRefreshTimerDisarmed

Channel: Diagnostic
Task: NetRefreshTimerDisarmed

Event ID 527: PowerStateEventRundown

Channel: Diagnostic
Level: Informational
Task: PowerStateEventRundown

Fields #

Name	Description
`Event` UInt32
`Class` UInt32
`Count` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 527,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.808Z",
    "version": 0
  },
  "event_data": {
    "Class": 0,
    "Count": 0,
    "Event": 0
  },
  "message": ""
}

Event ID 528: PowerStateEvent

Channel: Diagnostic
Task: PowerStateEvent

Fields #

Name	Description
`Event` UInt32
`Intent` UInt32

Event ID 529: PowerAggregatorQueueOverflow

Channel: Diagnostic
Task: PowerAggregatorQueueOverflow

Fields #

Name	Description
`Intent` UInt32
`Class` UInt32
`PowerEvent` UInt32

Event ID 530: PowerAggregatorRequest

Channel: Diagnostic
Task: PowerAggregatorRequest

Fields #

Name	Description
`SessionId` UInt32
`RequestQueueId` UInt32
`Intent` UInt32
`Class` UInt32
`PowerEvent` UInt32
`VetoReason` UInt32

Event ID 531: PowerAggregatorValidationEvent

Channel: Diagnostic
Task: PowerAggregatorValidationEvent

Fields #

Name	Description
`SessionId` UInt32
`Action` UInt32
`Result` UInt32

Event ID 532: PowerAggregatorCompletionEvent

Channel: Diagnostic
Task: PowerAggregatorCompletionEvent

Fields #

Name	Description
`SessionId` UInt32
`Result` UInt32

Event ID 533: PowerAggregatorSessionBegin

Channel: Diagnostic
Task: PowerAggregatorSessionBegin

Fields #

Name	Description
`SessionId` UInt32
`PowerEvent` UInt32
`Action` UInt32
`AudioActivity` Boolean
`DisconnectedStandbyMode` UInt32
`DsEnabled` Boolean

Event ID 534: PowerAggregatorSessionEnd

Channel: Diagnostic
Task: PowerAggregatorSessionEnd

Fields #

Name	Description
`SessionId` UInt32
`Result` UInt32

Event ID 535: DirectedDripsEngaged_V1

Channel: Diagnostic
Task: DirectedDripsEngaged

Fields #

Name	Description
`CsSessionId` UInt8
`Engaged` Boolean
`CsSessionIdV2` UInt64

Event ID 536: DirectedDripsWorker_V1

Channel: Diagnostic
Level: Informational
Task: DirectedDripsWorker

Fields #

Name	Description
`CsSessionId` UInt8
`WorkFlags` UInt64
`CsSessionIdV2` UInt64

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 536,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 808
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:47.064Z",
    "version": 0
  },
  "event_data": {
    "CsSessionId": 0,
    "CsSessionIdV2": 0,
    "WorkFlags": 2
  },
  "message": ""
}

Event ID 537: DirectedDripsMarkDevice

Channel: Diagnostic
Task: DirectedDripsMarkDevice

Fields #

Name	Description
`CsSessionId` UInt8
`DeviceObject` Pointer

Event ID 538: DirectedDripsNotifyAppsAndServices_V1

Channel: Diagnostic
Task: DirectedDripsNotifyAppsAndServices

Fields #

Name	Description
`CsSessionId` UInt8
`Suspended` Boolean
`Result` UInt32
`DurationMs` UInt64
`CsSessionIdV2` UInt64

Event ID 539: DirectedDripsNotifyDevices_V1

Channel: Diagnostic
Task: DirectedDripsNotifyDevices

Fields #

Name	Description
`CsSessionId` UInt8
`Suspended` Boolean
`Result` UInt32
`DurationMs` UInt64
`CsSessionIdV2` UInt64

Event ID 540: DirectedDripsInitialization

Channel: Diagnostic
Task: DirectedDripsInitialization

Fields #

Name	Description
`EnableResult` UInt32
`InitializationResult` UInt32

Event ID 541: SIdleUpdateNotificationWorker

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SIdleUpdateNotificationWorker
Opcode: win:Info

Fields #

Name	Description
`SystemIdle` Boolean
`Status` UInt32	NTSTATUS reference
`TimeoutSource` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 541,
    "version": 1,
    "level": 4,
    "task": 240,
    "opcode": 0,
    "keywords": "0x4000000000000004",
    "time_created": "2026-06-02T05:56:05.349+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11208
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Status": 0,
    "SystemIdle": false,
    "TimeoutSource": 5
  },
  "message": "SIdleUpdateNotificationWorker"
}

Event ID 542: PowerAggregatorInvalidRequestIndex

Channel: Diagnostic
Task: PowerAggregatorInvalidRequestIndex

Fields #

Name	Description
`RequestIndex` UInt32
`NumberOfRequests` UInt32
`QueueSize` UInt32

Event ID 544: DirectedDripsDisengageMaskChange

Channel: Diagnostic
Level: Informational
Task: DirectedDripsDisengageMaskChange

Fields #

Name	Description
`OldMask` UInt32
`NewMask` UInt32
`SetFlags` UInt32
`ClearedFlags` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 544,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 808
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-21 22:12:47.064Z",
    "version": 0
  },
  "event_data": {
    "ClearedFlags": 0,
    "NewMask": 16,
    "OldMask": 0,
    "SetFlags": 16
  },
  "message": ""
}

Event ID 545: DirectedDripsDeviceVisit_V1

Channel: Diagnostic
Task: DirectedDripsDeviceVisit

Fields #

Name	Description
`BroadcastTreeId` UInt32
`IsRootDevice` Boolean
`DeviceNode` Pointer
`InstancePathLength` UInt32
`InstancePath` UnicodeString
`VisitType` UInt32

Event ID 546: DirectedDripsProblemDevice

Channel: Diagnostic
Task: DirectedDripsProblemDevice

Fields #

Name	Description
`BroadcastTreeId` UInt32
`DeviceNode` Pointer
`Reason` UInt32

Event ID 547: DirectedPowerTransitionStart

Channel: Diagnostic
Task: DirectedPowerTransitionStart

Fields #

Name	Description
`DeviceNode` Pointer
`PowerDown` Boolean

Event ID 548: DirectedPowerTransitionEnd_V1

Channel: Diagnostic
Task: DirectedPowerTransitionEnd

Fields #

Name	Description
`DeviceNode` Pointer
`PowerDown` Boolean
`DevicePowerState` UInt32

Event ID 549: SystemIdleAssessment

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SystemIdleAssessment
Opcode: win:Info

Fields #

Name	Description
`IdleTimeout` UInt32
`NotIdleEvents` UInt32
`IsSystemIdle` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 549,
    "version": 0,
    "level": 4,
    "task": 251,
    "opcode": 0,
    "keywords": "0x4000000000000004",
    "time_created": "2026-06-02T05:56:05.349+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11208
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "IdleTimeout": 0,
    "IsSystemIdle": false,
    "NotIdleEvents": 14
  },
  "message": "SystemIdleAssessment"
}

Event ID 550: SystemIdleEventAssessment

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SystemIdleEventAssessment
Opcode: win:Info

Fields #

Name	Description
`EventType` UInt32
`TimeSinceEvent` UInt32
`IdleTimeout` UInt32
`WasIgnored` Boolean
`BusyReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 550,
    "version": 0,
    "level": 4,
    "task": 252,
    "opcode": 0,
    "keywords": "0x4000000000000004",
    "time_created": "2026-06-02T05:56:05.349+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 11208
    },
    "channel": "ETW Trace",
    "computer": "DESKTOP-FF3N5XK",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "BusyReason": 0,
    "EventType": 0,
    "IdleTimeout": 0,
    "TimeSinceEvent": 121456,
    "WasIgnored": true
  },
  "message": "SystemIdleEventAssessment"
}

Event ID 551: SystemIdleRundown

Channel: Diagnostic
Level: Informational
Task: SystemIdleRundown

Fields #

Name	Description
`ScanInterval` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Power/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 551,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 11688,
      "thread_id": 10152
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-Kernel-Power",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 06:32:10.809Z",
    "version": 0
  },
  "event_data": {
    "ScanInterval": 30
  },
  "message": ""
}

Event ID 552: SystemIdleContextUpdate

Channel: Diagnostic
Task: SystemIdleContextUpdate

Fields #

Name	Description
`Reason` UInt32
`PreviousTimeoutSource` UInt32
`PreviousTimeout` UInt32
`NewTimeoutSource` UInt32
`NewTimeout` UInt32

Event ID 553: DirectedFxPowerStateFailure

Channel: Diagnostic
Task: DirectedFxPowerStateFailure

Fields #

Name	Description
`FxDevice` Pointer
`DeviceNode` Pointer
`InstancePathLength` UInt32
`InstancePath` UnicodeString

Event ID 554: DirectedDripsDeviceStats

Channel: Diagnostic
Task: DirectedDripsDeviceStats

Fields #

Name	Description
`CsSessionId` UInt8
`DeviceNode` Pointer
`FriendlyNameLength` UInt32
`FriendlyName` UnicodeString
`HardwareIdLength` UInt32
`HardwareId` UnicodeString
`DeviceClassNameLength` UInt32
`DeviceClassName` UnicodeString
`DeviceClassGuidLength` UInt32
`DeviceClassGuid` UnicodeString
`BroadcastTreeId` UInt32
`DfxTransitionCount` UInt32
`Ps4TransitionCount` UInt32
`Flags` UInt32

Event ID 555: ExecutePowerAction

Channel: Diagnostic
Task: ExecutePowerAction

Fields #

Name	Description
`Reason` UInt32
`TriggerFlags` UInt32
`UserNotify` UInt32
`PowerAction` UInt32
`PowerActionFlags` UInt32
`PowerActionEventCode` UInt32
`MinState` UInt32
`SubstitutionPolicy` UInt32
`LocalPowerAction` UInt32
`LocalPowerActionFlags` UInt32
`LocalPowerActionEventCode` UInt32
`Disabled` Boolean
`RequesterNameLength` UInt32
`RequesterName` AnsiString

Event ID 556: DirectedDripsErrorRecord

Channel: Diagnostic
Task: DirectedDripsErrorRecord

Fields #

Name	Description
`SessionId` UInt64
`RootDeviceNode` Pointer
`ErrorDeviceNode` Pointer
`ReasonCode` UInt32
`Count` UInt32

Event ID 557: A driver is attempting to update the system timer resolution to a value of RequestedResolution.

Channel: Diagnostic
Also via: realtime ETW trace
Level: Informational
Task: SystemTimeResolutionKernelChangeInternal
Opcode: win:Info

Message #

A driver is attempting to update the system timer resolution to a value of %1.

Fields #

Name	Description
`RequestedResolution` UInt32
`Tag` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 557,
    "version": 0,
    "level": 4,
    "task": 259,
    "opcode": 0,
    "keywords": "0x4000000000000004",
    "time_created": "2026-06-02T05:27:45.331+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 14928
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "RequestedResolution": 65000,
    "Tag": 1397707336
  },
  "message": "SystemTimeResolutionKernelChangeInternal"
}

Event ID 558: PowerAggregatorHandleIntent_V1

Channel: Diagnostic
Task: PowerAggregatorHandleIntent

Fields #

Name	Description
`Intent` UInt32
`Class` UInt32
`Cause` UInt32
`Status` UInt32	NTSTATUS reference
`CurrentTargetState` UInt32
`NextTargetState` UInt32
`PartA_PrivTags` UInt64
`TriageContextLength` UInt32
`TriageContext` Binary

Event ID 559: PowerAggregatorWorkerStart

Channel: Diagnostic
Task: PowerAggregatorWorkerStart

Event ID 560: PowerAggregatorWorkerEnd

Channel: Diagnostic
Task: PowerAggregatorWorkerEnd

Event ID 561: PowerAggregatorInternalStateChange

Channel: Diagnostic
Task: PowerAggregatorInternalStateChange

Fields #

Name	Description
`CurrentInternalState` UInt32
`NextInternalState` UInt32

Event ID 562: PowerAggregatorHandlerInvoke

Channel: Diagnostic
Task: PowerAggregatorHandlerInvoke

Fields #

Name	Description
`CurrentTargetState` UInt32
`CurrentInternalState` UInt32

Event ID 563: PowerAggregatorPdcPhasesExited

Channel: Diagnostic
Task: PowerAggregatorPdcPhasesExited

Event ID 564: PowerAggregatorPdcSleepTransition

Channel: Diagnostic
Task: PowerAggregatorPdcSleepTransition

Fields #

Name	Description
`IsSleepEnter` Boolean
`Token` UInt32
`CurrentTargetState` UInt32
`CurrentInternalState` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 565: PowerAggregatorSuspendResume

Channel: Diagnostic
Task: PowerAggregatorSuspendResume

Fields #

Name	Description
`Suspended` Boolean
`SuspendCount` Int32

Event ID 566: The system session has transitioned from PreviousSessionId to NextSessionId.

Channel: System
Level: Informational
Task: SystemSessionSwitch

Message #

The system session has transitioned from %3 to %10.

Reason %2 

BootId: %1

Fields #

Name	Description
`BootId` UInt32
`Reason` UInt32
`PreviousSessionId` UInt64
`PreviousSessionType` UInt32
`PreviousSessionDurationInUs` UInt64
`PreviousEnergyCapacityAtStart` UInt32
`PreviousFullEnergyCapacityAtStart` UInt32
`PreviousEnergyCapacityAtEnd` UInt32
`PreviousFullEnergyCapacityAtEnd` UInt32
`NextSessionId` UInt64
`NextSessionType` UInt32
`PowerStateAc` Boolean
`MonitorReason` UInt32

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 566,
    "version": 0,
    "level": 4,
    "task": 268,
    "opcode": 0,
    "keywords": -9223372036854774268,
    "time_created": "2026-05-28T03:43:33.2479340+00:00",
    "event_record_id": 1658,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 4644
    },
    "channel": "System",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "BootId": "4",
    "Reason": "32",
    "PreviousSessionId": "1",
    "PreviousSessionType": "1",
    "PreviousSessionDurationInUs": "10032016120",
    "PreviousEnergyCapacityAtStart": "0",
    "PreviousFullEnergyCapacityAtStart": "0",
    "PreviousEnergyCapacityAtEnd": "0",
    "PreviousFullEnergyCapacityAtEnd": "0",
    "NextSessionId": "3",
    "NextSessionType": "0",
    "PowerStateAc": "true",
    "MonitorReason": "32"
  },
  "message": "The system session has transitioned from 1 to 3.\r\n\r\nReason: 4"
}

Event ID 567: SuspendAppsNotificationPhaseStart

Channel: Diagnostic
Task: SuspendAppsNotification
Opcode: PhaseStart

Event ID 568: SuspendAppsNotificationPhaseStop

Channel: Diagnostic
Task: SuspendAppsNotification
Opcode: PhaseStop

Event ID 569: SuspendServicesNotificationPhaseStart

Channel: Diagnostic
Task: SuspendServicesNotification
Opcode: PhaseStart

Event ID 570: SuspendServicesNotificationPhaseStop

Channel: Diagnostic
Task: SuspendServicesNotification
Opcode: PhaseStop

Event ID 571: ResumeAppsNotificationPhaseStart

Channel: Diagnostic
Task: ResumeAppsNotification
Opcode: PhaseStart

Event ID 572: ResumeAppsNotificationPhaseStop

Channel: Diagnostic
Task: ResumeAppsNotification
Opcode: PhaseStop

Event ID 573: ResumeServicesNotificationPhaseStart

Channel: Diagnostic
Task: ResumeServicesNotification
Opcode: PhaseStart

Event ID 574: ResumeServicesNotificationPhaseStop

Channel: Diagnostic
Task: ResumeServicesNotification
Opcode: PhaseStop

Event ID 575: DripsWakeSourceMapping

Channel: Diagnostic
Task: DripsWakeSourceMapping

Fields #

Name	Description
`Token` UInt32
`ReasonDescriptionLength` UInt32
`ReasonDescription` UnicodeString

Event ID 576: AdaptiveSessionState_V1

Channel: Diagnostic
Task: AdaptiveSessionState

Fields #

Name	Description
`SessionId` UInt32
`LastInputTimestamp` UInt64
`LastDisplayOffTimestamp` UInt64
`SessionDisplayState` UInt32
`DisplayTimeout` UInt32
`InputTimeout` UInt32
`NotifyOnNextUserInput` Boolean
`DisplayTimeoutSource` UInt32
`DimTimeout` UInt32
`DimTimeoutSource` UInt32

Event ID 577: The system has prepared for a system initiated reboot from AdaptiveTargetState.

Channel: System
Level: Informational
Task: SystemInitiatedRebootPrepare

Message #

The system has prepared for a system initiated reboot from %1.

Fields #

Name	Description
`AdaptiveTargetState` UInt32
`IsUnattended` Boolean
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "{331C3B3A-2005-44C2-AC5E-77220C37D6B4}",
    "event_source_name": "",
    "event_id": 577,
    "version": 0,
    "level": 4,
    "task": 280,
    "opcode": 0,
    "keywords": -9223372036854775804,
    "time_created": "2026-06-13T13:53:28.1336123+00:00",
    "event_record_id": 2614,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 3184
    },
    "channel": "System",
    "computer": "telemetry-W11-d.cell-d.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "AdaptiveTargetState": "0",
    "IsUnattended": "false",
    "Status": "279"
  },
  "message": "The system has prepared for a system initiated reboot from Active."
}

Event ID 578: The system has detected a system initiated reboot from AdaptiveTargetState.

Channel: System
Level: Informational
Task: AdaptiveOverrideBootState

Message #

The system has detected a system initiated reboot from %1.

Fields #

Name	Description
`AdaptiveTargetState` UInt32
`IsUnattended` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-Kernel-Power",
    "guid": "331C3B3A-2005-44C2-AC5E-77220C37D6B4",
    "event_source_name": "",
    "event_id": 578,
    "version": 0,
    "level": 4,
    "task": 281,
    "opcode": 0,
    "keywords": 9223372036854775812,
    "time_created": "2026-03-14T01:39:48.147324+00:00",
    "event_record_id": 2398,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 8
    },
    "channel": "System",
    "computer": "LAB-WIN11.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "AdaptiveTargetState": 6,
    "IsUnattended": false
  },
  "message": ""
}

Event ID 579: StateTransitionFailure

Channel: Diagnostic
Task: StateTransitionFailure

Fields #

Name	Description
`ThreadToken` Pointer
`Status` UInt32	NTSTATUS reference
`FailurePoint` UInt32

Event ID 580: NotifyConsoleUserPresent

Channel: Diagnostic
Task: NotifyConsoleUserPresent

Fields #

Name	Description
`Result` UInt8
`VirtualConsole` UInt8
`SessionId` UInt32
`MonitorOnReason` UInt32

Event ID 581: Win32kCallout

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParamToken` Pointer
`AttachMode` UInt8
`IsSingleSession` UInt8
`SessionId` UInt32
`Type` UInt8
`IsSync` UInt8

Event ID 582: Win32kCallout582

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParamToken` Pointer
`PsStatus` UInt32
`SkipReason` UInt32

Event ID 583: Win32kCallout583

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParamToken` Pointer
`AttachMode` UInt8
`IsSingleSession` UInt8
`SessionId` UInt32
`EventNumber` UInt8
`EventCode` Pointer

Event ID 584: Win32kCallout584

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParamToken` Pointer
`PsStatus` UInt32
`SkipReason` UInt32

Event ID 585: Win32kCallout585

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParameterToken` Pointer
`AttachMode` UInt8
`IsSingleSession` UInt8
`SessionId` UInt32
`PowerAction` UInt32
`MinState` UInt32
`PowerActionFlags` UInt32
`PowerStateTask` UInt32

Event ID 586: Win32kCallout586

Channel: Diagnostic
Task: Win32kCallout

Fields #

Name	Description
`ParamToken` Pointer
`PsStatus` UInt32
`SkipReason` UInt32

Event ID 587: IrpWatchdogTriggered

Channel: Diagnostic
Task: IrpWatchdogTriggered

Fields #

Name	Description
`Irp` Pointer
`DeviceInstancePathLength` UInt32
`DeviceInstancePath` UnicodeString

Event ID 588: PowerAggregatorDozeTimerArmed

Channel: Diagnostic
Task: PowerAggregatorDozeTimerArmed

Fields #

Name	Description
`TimerType` UInt32
`Duration` Int64

Event ID 589: PowerAggregatorDozeTimerDisarmed

Channel: Diagnostic
Task: PowerAggregatorDozeTimerDisarmed

Fields #

Name	Description
`TimerType` UInt32

Event ID 590: PowerAggregatorDozeTimerTriggered

Channel: Diagnostic
Task: PowerAggregatorDozeTimerTriggered

Fields #

Name	Description
`TimerType` UInt32

Event ID 591: PowerLimitRequestAdd

Channel: Thermal-Diagnostic
Task: PowerLimitRequestAdd

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`CallerLength` UInt32
`Caller` UnicodeString
`ContextLength` UInt32
`Context` UnicodeString
`ReasonLength` UInt32
`Reason` Binary
`LimitCount` UInt32
`Values` Float

Event ID 592: PowerLimitRequestRemove

Channel: Thermal-Diagnostic
Task: PowerLimitRequestRemove

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`CallerLength` UInt32
`Caller` UnicodeString
`ContextLength` UInt32
`Context` UnicodeString
`ReasonLength` UInt32
`Reason` Binary
`LimitCount` UInt32
`Values` Float

Event ID 593: PowerLimitRequestRundown

Channel: Thermal-Diagnostic
Task: PowerLimitRequestRundown

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`CallerLength` UInt32
`Caller` UnicodeString
`ContextLength` UInt32
`Context` UnicodeString
`ReasonLength` UInt32
`Reason` Binary
`LimitCount` UInt32
`Values` Float

Event ID 594: PowerLimitRequestUpdate

Channel: Thermal-Diagnostic
Task: PowerLimitRequestUpdate

Fields #

Name	Description
`Token` Pointer
`ReasonLength` UInt32
`Reason` Binary
`LimitCount` UInt32
`Values` Int16

Event ID 595: PowerLimitExtensionAdd

Channel: Thermal-Diagnostic
Task: PowerLimitExtensionAdd

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`LimitCount` UInt32
`Attributes` Int16

Event ID 596: PowerLimitExtensionRemove

Channel: Thermal-Diagnostic
Task: PowerLimitExtensionRemove

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`LimitCount` UInt32
`Attributes` Int16

Event ID 597: PowerLimitExtensionRundown

Channel: Thermal-Diagnostic
Task: PowerLimitExtensionRundown

Fields #

Name	Description
`Token` Pointer
`DeviceIdLength` UInt32
`DeviceId` UnicodeString
`LimitCount` UInt32
`Attributes` Int16

Event ID 598: PowerLimitExtensionUpdate

Channel: Thermal-Diagnostic
Task: PowerLimitExtensionUpdate

Fields #

Name	Description
`Token` Pointer
`LimitCount` UInt32
`Values` Int8

Event ID 599: EnergySaverStateV2

Channel: Diagnostic
Task: EnergySaverStateV2

Fields #

Name	Description
`State` Int32
`Reason` Int32

Event ID 600: SetHiberFileFailure

Channel: Diagnostic
Task: SetHiberFileFailure

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`FailurePoint` UInt32

Event ID 601: Hibernate was disabled because invalid system binaries were detected

Channel: Operational, System
Task: HibernateRevoked

Description

Hibernate was disabled because invalid system binaries were detected. Min SVN required was , Actual SVN is . OS version of Invalid Binary: .

Fields #

Name	Description
`MinSVN` UInt32
`HiberrsmSVN` UInt32
`HiberrsmOSVersion` UInt32

Event ID 602: ModernStandbyNotification

Channel: Operational
Task: ModernStandbyNotification

Fields #

Name	Description
`PrevState` UInt32
`TargetState` UInt32
`Promoted` UInt32
`Entered` UInt32
`SettingGuid` GUID
`NewSettingValue` UInt32

Provenance

ETW provider GUID {331C3B3A-2005-44C2-AC5E-77220C37D6B4}

Defined in microsoft-windows-kernel-power-events.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, sample captured from a live trace, binary version 10.0.26100.4652, captured 2026-06-02 — Manifest XML pack, 2.0 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4652, captured 2026-06-02 — Manifest XML pack, 2.0 MB