Microsoft-Windows-Kernel-WDI

Event	Title	Channel	Sample	Rule
32	The Scenario Event Mapper started a scenario for provider ProviderID (event ID …	Analytic	N	N
33	The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID …	Analytic	N	N
34	An in-flight scenario from provider ProviderID (event ID EventID) timed out and …	Analytic	N	N
35	The Scenario Event Mapper was unable to start a new scenario for provider …	Debug	N	N
36	The Scenario Event Mapper was unable to start a scenario for provider ProviderID …	Debug	N	N
37	The Scenario Event Mapper was unable to stop a scenario for provider ProviderID …	Debug	N	N
38	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N	N
39	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N	N
40	The Scenario Event Mapper is configured with more than the maximum number of end …	Operational	N	N
41	The Scenario Event Mapper is configured with more than the maximum number of …	Operational	N	N
42	The Scenario Event Mapper is configured with an unsupported scenario.	Operational	N	N
43	task_0	Operational	N	N
44	task_044	Operational	N	N
45	task_045	Operational	N	N

Event ID 32: The Scenario Event Mapper started a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: ScenariostartenablescontextproviderstotheWDIcontextlogger.

Description

The Scenario Event Mapper started a scenario for provider ProviderID (event ID EventID) with ActionCount context providers. The context logger dropped event count was DroppedEventCount.

Message #

The Scenario Event Mapper started a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`DroppedEventCount` UInt32
`ActionCount` UInt8
`SemActions` Int16

Event ID 33: The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID EventID) with ActionCount context providers.

Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: ScenarioenddisablescontextproviderstotheWDIcontextlogger.

Description

The Scenario Event Mapper stopped a scenario for provider ProviderID (event ID EventID) with ActionCount context providers. The context logger dropped event count was DroppedEventCount.

Message #

The Scenario Event Mapper stopped a scenario for provider %1 (event ID %2) with %4 context providers.  The context logger dropped event count was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`DroppedEventCount` UInt32
`ActionCount` UInt8
`SemActions` Int16

Event ID 34: An in-flight scenario from provider ProviderID (event ID EventID) timed out and was stopped automatically by the Scenario Event Mapper.

Channel: Analytic
Task: SEMScenarioLifecycle
Opcode: Whenascenariohasremainedin_flightbeyondthemaximumtimewindowitisautomaticallyterminatedbytheSEM.

Message #

An in-flight scenario from provider %1 (event ID %2) timed out and was stopped automatically by the Scenario Event Mapper.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 35: The Scenario Event Mapper was unable to start a new scenario for provider ProviderID (event ID EventID) because the maximum number of scenarios are already in f...

Channel: Debug
Task: SEMScenarioLifecycle
Opcode: TheSEMreceivedarequesttostartanewscenario,butthemaximumnumberofscenarioswerealreadyin_flight.

Description

The Scenario Event Mapper was unable to start a new scenario for provider ProviderID (event ID EventID) because the maximum number of scenarios are already in flight.

Message #

The Scenario Event Mapper was unable to start a new scenario for provider %1 (event ID %2) because the maximum number of scenarios are already in flight.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`ScenarioCount` UInt8
`ScenarioInflightItems` UInt8

Event ID 36: The Scenario Event Mapper was unable to start a scenario for provider ProviderID (event ID EventID).

Channel: Debug
Task: SEMScenarioLifecycle
Opcode: AscenariostartattemptfailedintheSEM.

Description

The Scenario Event Mapper was unable to start a scenario for provider ProviderID (event ID EventID). The error code was NTStatus.

Message #

The Scenario Event Mapper was unable to start a scenario for provider %1 (event ID %2).  The error code was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 37: The Scenario Event Mapper was unable to stop a scenario for provider ProviderID (event ID EventID).

Channel: Debug
Task: SEMScenarioLifecycle
Opcode: AscenarioendattemptfailedintheSEM.

Description

The Scenario Event Mapper was unable to stop a scenario for provider ProviderID (event ID EventID). The error code was NTStatus.

Message #

The Scenario Event Mapper was unable to stop a scenario for provider %1 (event ID %2).  The error code was %3.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 38: The Scenario Event Mapper is configured with more than the maximum number of scenarios.

Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithmorescenariosthanthemaximumallowedcount.

Description

The Scenario Event Mapper is configured with more than the maximum number of scenarios. The scenario for provider ProviderID (event ID EventID) will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of scenarios.  The scenario for provider %1 (event ID %2) will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 39: The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider ProviderID (event ID EventID).

Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithascenariowithtoomanycontextproviders.

Description

The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider ProviderID (event ID EventID). The scenario will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of context providers for the scenario with provider %1 (event ID %2).  The scenario will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 40: The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider ProviderID (event ID EventID).

Channel: Operational
Task: SEMInitialization
Opcode: TheSEMisconfiguredwithascenariothathastoomanyendevents.

Description

The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider ProviderID (event ID EventID). The scenario will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of end events for the scenario with provider %1 (event ID %2).  The scenario will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16

Event ID 41: The Scenario Event Mapper is configured with more than the maximum number of providers.

Channel: Operational
Task: SEMInitialization
Opcode: Thenumberofprovidersspecifiedacrossallscenariosisabovethemaximumallowedamount.

Description

The Scenario Event Mapper is configured with more than the maximum number of providers. The provider ProviderID will be ignored.

Message #

The Scenario Event Mapper is configured with more than the maximum number of providers.  The provider %1 will be ignored.

Fields #

Name	Description
`ProviderID` GUID

Event ID 42: The Scenario Event Mapper is configured with an unsupported scenario.

Channel: Operational
Task: SEMInitialization
Opcode: ThereisaninvalidconfigurationparameterintheSEMregistrynamespace.

Description

The Scenario Event Mapper is configured with an unsupported scenario. The scenario for provider ProviderID (event ID EventID) encountered error code NTStatus and will be ignored.

Message #

The Scenario Event Mapper is configured with an unsupported scenario. The scenario for provider %1 (event ID %2) encountered error code %3 and will be ignored.

Fields #

Name	Description
`ProviderID` GUID
`EventID` UInt16
`NTStatus` UInt32	NTSTATUS reference

Event ID 43: task_0

Channel: Operational

Fields #

Name	Description
`SqmType` UInt32
`SqmSid` SID

Event ID 44: task_044

Channel: Operational

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmDWORDDatapointValue` UInt32

Event ID 45: task_045

Channel: Operational

Fields #

Name	Description
`SqmSessionGuid` GUID
`SqmID` UInt32
`SqmType` UInt32
`SqmStreamRowLength` UInt32
`SqmStreamRow` Int16

Provenance

ETW provider GUID 2ff3e6b7-cb90-4700-9621-443f389734ed

Defined in Microsoft-Windows-System-Events.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3932, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB