Microsoft-Windows-Kernel-Prm

Event	Title	Channel	Sample	Rule
1	PRM has been invoked.	Operational	N	N
2	PRM module update failed.	Operational	N	N
3	PRM invocation failed.	Operational	N	N
4	Excessive PRM handler runtime.	Operational	N	N

Event ID 1: PRM has been invoked.

Channel: Operational

Event ID 2: PRM module update failed.

Channel: Operational

Description

PRM module update failed. Module GUID ModuleGuid, module version ModuleVersion, status NtStatus.

Message #

PRM module update failed. Module GUID %1, module version %2, status %3.

Fields #

Name	Description
`ModuleGuid` GUID
`ModuleVersion` UInt64
`NtStatus` UInt64

Event ID 3: PRM invocation failed.

Channel: Operational

Description

PRM invocation failed. Handler GUID HandlerGuid, module GUID ModuleGuid, module version ModuleVersion, interface status InterfaceStatus, handler status HandlerStatus.

Message #

PRM invocation failed. Handler GUID %1, module GUID %2, module version %3, interface status %4, handler status %5.

Fields #

Name	Description
`HandlerGuid` GUID
`ModuleGuid` GUID
`ModuleVersion` UInt64
`InterfaceStatus` UInt64
`HandlerStatus` UInt64

Event ID 4: Excessive PRM handler runtime.

Channel: Operational

Description

Excessive PRM handler runtime. Handler GUID HandlerGuid, module GUID ModuleGuid, module version ModuleVersion, duration DurationInUs us.

Message #

Excessive PRM handler runtime. Handler GUID %1, module GUID %2, module version %3, duration %4 us.

Fields #

Name	Description
`HandlerGuid` GUID
`ModuleGuid` GUID
`ModuleVersion` UInt64
`DurationInUs` UInt64

Provenance

ETW provider GUID b931ed29-66f4-576e-0579-0b8818a5dc6b

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB