Microsoft-Windows-LimitsManagement

Event	Title	Channel	Sample	Rule
1	MonitorEnumerated	Diagnostic	N	N
2	MonitorRundown	Diagnostic	N	N
3	MonitorValueChange	Diagnostic	N	N
4	MonitorMitigatingChange	Diagnostic	N	N
5	MonitorThresholdChange	Diagnostic	N	N
6	MonitorRemoved	Diagnostic	N	N
7	MitigationEvent	Diagnostic	N	N
8	PolicyEnumerated	Diagnostic	N	N
9	PolicyRundown	Diagnostic	N	N
10	PolicyRemoved	Diagnostic	N	N
11	MitigationEnumerated	Diagnostic	N	N
12	MitigationRundown	Diagnostic	N	N
13	MitigationValueChange	Diagnostic	N	N
14	MitigationRemoved	Diagnostic	N	N

Event ID 1: MonitorEnumerated

Channel: Diagnostic
Task: MonitorEnumerated

Fields #

Name	Description
`Token` UInt64
`Type` UInt32
`LowerThreshold` UInt32
`UpperThreshold` UInt32
`Value` UInt32
`Mitigating` Boolean
`Name` UnicodeString

Event ID 2: MonitorRundown

Channel: Diagnostic
Task: MonitorRundown

Fields #

Name	Description
`Token` UInt64
`Type` UInt32
`LowerThreshold` UInt32
`UpperThreshold` UInt32
`Value` UInt32
`Mitigating` Boolean
`Name` UnicodeString

Event ID 3: MonitorValueChange

Channel: Diagnostic
Task: MonitorValueChange

Fields #

Name	Description
`Token` UInt64
`Value` UInt32

Event ID 4: MonitorMitigatingChange

Channel: Diagnostic
Task: MonitorMitigatingChange

Fields #

Name	Description
`Token` UInt64
`Mitigating` Boolean

Event ID 5: MonitorThresholdChange

Channel: Diagnostic
Task: MonitorThresholdChange

Fields #

Name	Description
`Token` UInt64
`LowerThreshold` UInt32
`UpperThreshold` UInt32

Event ID 6: MonitorRemoved

Channel: Diagnostic
Task: MonitorRemoved

Fields #

Name	Description
`Token` UInt64

Event ID 7: MitigationEvent

Channel: Diagnostic
Task: MitigationEvent

Fields #

Name	Description
`Event` UInt32
`Type` UInt32
`LowerThreshold` UInt32
`UpperThreshold` UInt32
`Value` UInt32
`Initiator` UnicodeString

Event ID 8: PolicyEnumerated

Channel: Diagnostic
Task: PolicyEnumerated

Fields #

Name	Description
`Token` UInt64
`Name` UnicodeString
`Parameters` UnicodeString

Event ID 9: PolicyRundown

Channel: Diagnostic
Task: PolicyRundown

Fields #

Name	Description
`Token` UInt64
`Name` UnicodeString
`Parameters` UnicodeString

Event ID 10: PolicyRemoved

Channel: Diagnostic
Task: PolicyRemoved

Fields #

Name	Description
`Token` UInt64

Event ID 11: MitigationEnumerated

Channel: Diagnostic
Task: MitigationEnumerated

Fields #

Name	Description
`Token` UInt64
`Type` UInt32
`DisengagedValue` UInt32
`FullyEngagedValue` UInt32
`Value` UInt32
`Name` UnicodeString

Event ID 12: MitigationRundown

Channel: Diagnostic
Task: MitigationRundown

Fields #

Name	Description
`Token` UInt64
`Type` UInt32
`DisengagedValue` UInt32
`FullyEngagedValue` UInt32
`Value` UInt32
`Name` UnicodeString

Event ID 13: MitigationValueChange

Channel: Diagnostic
Task: MitigationValueChange

Fields #

Name	Description
`Token` UInt64
`Value` UInt32

Event ID 14: MitigationRemoved

Channel: Diagnostic
Task: MitigationRemoved

Fields #

Name	Description
`Token` UInt64

Provenance

ETW provider GUID 73aa0094-facb-4aeb-bd1d-a7b98dd5c799

Defined in powrprof.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB