Microsoft-Windows-LUA

Event	Title	Channel	Sample	Rule
15001	ConsentUI_GetUserDesktopSnapshotStart	Diagnostic	N	N
15002	ConsentUI_GetUserDesktopSnapshotStop	Diagnostic	N	N
15003	ConsentUI_WindowThreadStart	Diagnostic	N	N
15004	ConsentUI_WindowThreadStop	Diagnostic	N	N
15005	ConsentUI_WindowThread	Diagnostic	N	N
15006	ConsentUI_SwitchDesktopStart	Diagnostic	N	N
15007	ConsentUI_SwitchDesktopStop	Diagnostic	N	N
15008	ConsentUI_ReturnUserDesktopStart	Diagnostic	N	N
15009	ConsentUI_ReturnUserDesktopStop	Diagnostic	N	N
15010	ConsentUI_WindowThreadStart15010	Diagnostic	N	N
15011	ConsentUI_WindowThreadStop15011	Diagnostic	N	N
15012	ConsentUI_CheckActiveDesktopStart	Diagnostic	N	N
15013	ConsentUI_CheckActiveDesktopStop	Diagnostic	N	N
15014	ConsentUI_CheckActiveDesktopStart15014	Diagnostic	N	N
15015	ConsentUI_CheckActiveDesktopStop15015	Diagnostic	N	N
15016	ConsentUI_WindowThreadStart15016	Diagnostic	N	N
15017	ConsentUI_WindowThreadStop15017	Diagnostic	N	N
15018	ConsentUI_WindowThreadStart15018	Diagnostic	N	N
15019	ConsentUI_WindowThreadStop15019	Diagnostic	N	N
15020	ConsentUI_WindowThreadStart15020	Diagnostic	N	N
15021	ConsentUI_WindowThreadStop15021	Diagnostic	N	N
15022	ConsentUI_ExperienceStart	Diagnostic	N	N
15023	ConsentUI_ExperienceStop	Diagnostic	N	N
15024	ConsentUI_ExperienceStart15024	Diagnostic	N	N
15025	ConsentUI_ExperienceStop15025	Diagnostic	N	N
15026	ConsentUI_ExperienceStart15026	Diagnostic	N	N
15027	ConsentUI_ExperienceStop15027	Diagnostic	N	N
15028	ConsentUI_LEASVC	Diagnostic	N	N
15029	ConsentUI_AMScanStart	Diagnostic	N	N
15030	ConsentUI_AMScanStop	Diagnostic	N	N
15031	Success: Elevation prompt for executable FullCommandLine (ProgramName published …	Diagnostic	N	N
15031	Success: Elevation prompt for executable FullCommandLine (ProgramName published …	Elevation	N	N
15032	Elevation prompt for executable FullCommandLine (ProgramName published by …	Diagnostic	N	N
15032	Elevation prompt for executable FullCommandLine (ProgramName published by …	Elevation	N	N
16001	AppInfo_PerfTrack_ElevationPathStart	Diagnostic	N	N
16002	AppInfo_PerfTrack_ElevationPathStop	Diagnostic	N	N
16003	AppInfo_PerfTrack_ElevationPathStart16003	Diagnostic	N	N
16004	AppInfo_PerfTrack_ElevationPathStop16004	Diagnostic	N	N
16005	AppInfo_PerfTrack_ElevationPathStart16005	Diagnostic	N	N
16006	AppInfo_PerfTrack_ElevationPathStop16006	Diagnostic	N	N
16007	AppInfo_PerfTrack_ElevationPathStart16007	Diagnostic	N	N
16008	AppInfo_PerfTrack_ElevationPathStop16008	Diagnostic	N	N
16009	AppInfo_PerfTrack_ElevationPathStop16009	Diagnostic	N	N
16010	AppInfo_PerfTrack_ElevationPathStart16010	Diagnostic	N	N
16011	AppInfo_PerfTrack_ElevationPathStop16011	Diagnostic	N	N

Event ID 15001: ConsentUI_GetUserDesktopSnapshotStart

Channel: Diagnostic
Task: ConsentUI_GetUserDesktopSnapshot
Opcode: Start

Event ID 15002: ConsentUI_GetUserDesktopSnapshotStop

Channel: Diagnostic
Task: ConsentUI_GetUserDesktopSnapshot
Opcode: Stop

Event ID 15003: ConsentUI_WindowThreadStart

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Start

Event ID 15004: ConsentUI_WindowThreadStop

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Stop

Event ID 15005: ConsentUI_WindowThread

Channel: Diagnostic
Task: ConsentUI_WindowThread

Event ID 15006: ConsentUI_SwitchDesktopStart

Channel: Diagnostic
Task: ConsentUI_SwitchDesktop
Opcode: Start

Event ID 15007: ConsentUI_SwitchDesktopStop

Channel: Diagnostic
Task: ConsentUI_SwitchDesktop
Opcode: Stop

Event ID 15008: ConsentUI_ReturnUserDesktopStart

Channel: Diagnostic
Task: ConsentUI_ReturnUserDesktop
Opcode: Start

Event ID 15009: ConsentUI_ReturnUserDesktopStop

Channel: Diagnostic
Task: ConsentUI_ReturnUserDesktop
Opcode: Stop

Event ID 15010: ConsentUI_WindowThreadStart15010

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Start

Event ID 15011: ConsentUI_WindowThreadStop15011

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Stop

Event ID 15012: ConsentUI_CheckActiveDesktopStart

Channel: Diagnostic
Task: ConsentUI_CheckActiveDesktop
Opcode: Start

Event ID 15013: ConsentUI_CheckActiveDesktopStop

Channel: Diagnostic
Task: ConsentUI_CheckActiveDesktop
Opcode: Stop

Event ID 15014: ConsentUI_CheckActiveDesktopStart15014

Channel: Diagnostic
Task: ConsentUI_CheckActiveDesktop
Opcode: Start

Event ID 15015: ConsentUI_CheckActiveDesktopStop15015

Channel: Diagnostic
Task: ConsentUI_CheckActiveDesktop
Opcode: Stop

Event ID 15016: ConsentUI_WindowThreadStart15016

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Start

Event ID 15017: ConsentUI_WindowThreadStop15017

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Stop

Event ID 15018: ConsentUI_WindowThreadStart15018

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Start

Event ID 15019: ConsentUI_WindowThreadStop15019

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Stop

Event ID 15020: ConsentUI_WindowThreadStart15020

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Start

Event ID 15021: ConsentUI_WindowThreadStop15021

Channel: Diagnostic
Task: ConsentUI_WindowThread
Opcode: Stop

Event ID 15022: ConsentUI_ExperienceStart

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Start

Event ID 15023: ConsentUI_ExperienceStop

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Stop

Event ID 15024: ConsentUI_ExperienceStart15024

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Start

Event ID 15025: ConsentUI_ExperienceStop15025

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Stop

Event ID 15026: ConsentUI_ExperienceStart15026

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Start

Event ID 15027: ConsentUI_ExperienceStop15027

Channel: Diagnostic
Task: ConsentUI_Experience
Opcode: Stop

Event ID 15028: ConsentUI_LEASVC

Channel: Diagnostic
Task: ConsentUI_LEASVC

Fields #

Name	Description
`Parameters` Pointer

Event ID 15029: ConsentUI_AMScanStart

Channel: Diagnostic
Task: ConsentUI_AMScan
Opcode: Start

Event ID 15030: ConsentUI_AMScanStop

Channel: Diagnostic
Task: ConsentUI_AMScan
Opcode: Stop

Event ID 15031: Success: Elevation prompt for executable FullCommandLine (ProgramName published by Publisher) answered by UserName, will elevate as

Channel: Diagnostic
Task: CredUI_Elevation

Description

Success: Elevation prompt for executable ( published by ) answered by , will elevate as .

Fields #

Name	Description
`ProgramName` UnicodeString
`Publisher` UnicodeString
`FullCommandLine` UnicodeString
`UserName` UnicodeString
`ShadowAdmin` UnicodeString
`ShadowAdminSID` UnicodeString
`ReturnCode` UInt32
`ReturnMessage` UnicodeString

Event ID 15031: Success: Elevation prompt for executable FullCommandLine (ProgramName published by Publisher) answered by UserName, will elevate as ShadowAdmin.

Channel: Elevation
Task: CredUI_Elevation

Message #

Success: Elevation prompt for executable %3 (%1 published by %2) answered by %4, will elevate as %5.

Fields #

Name	Description
`ProgramName` UnicodeString
`Publisher` UnicodeString
`FullCommandLine` UnicodeString
`UserName` UnicodeString
`ShadowAdmin` UnicodeString
`ShadowAdminSID` UnicodeString
`ReturnCode` UInt32
`ReturnMessage` UnicodeString

Event ID 15032: Elevation prompt for executable FullCommandLine (ProgramName published by Publisher) answered by

Channel: Diagnostic
Task: CredUI_Elevation_Failure

Description

Elevation prompt for executable ( published by ) answered by . Error : .

Fields #

Name	Description
`ProgramName` UnicodeString
`Publisher` UnicodeString
`FullCommandLine` UnicodeString
`UserName` UnicodeString
`ShadowAdmin` UnicodeString
`ShadowAdminSID` UnicodeString
`ReturnCode` UInt32
`ReturnMessage` UnicodeString

Event ID 15032: Elevation prompt for executable FullCommandLine (ProgramName published by Publisher) answered by UserName.

Channel: Elevation
Task: CredUI_Elevation_Failure

Description

Elevation prompt for executable FullCommandLine (ProgramName published by Publisher) answered by UserName. Error ReturnCode: ReturnMessage.

Message #

Elevation prompt for executable %3 (%1 published by %2) answered by %4. Error %7: %8.

Fields #

Name	Description
`ProgramName` UnicodeString
`Publisher` UnicodeString
`FullCommandLine` UnicodeString
`UserName` UnicodeString
`ShadowAdmin` UnicodeString
`ShadowAdminSID` UnicodeString
`ReturnCode` UInt32
`ReturnMessage` UnicodeString

Event ID 16001: AppInfo_PerfTrack_ElevationPathStart

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Start

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16002: AppInfo_PerfTrack_ElevationPathStop

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16003: AppInfo_PerfTrack_ElevationPathStart16003

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Start

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16004: AppInfo_PerfTrack_ElevationPathStop16004

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16005: AppInfo_PerfTrack_ElevationPathStart16005

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Start

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16006: AppInfo_PerfTrack_ElevationPathStop16006

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16007: AppInfo_PerfTrack_ElevationPathStart16007

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Start

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16008: AppInfo_PerfTrack_ElevationPathStop16008

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16009: AppInfo_PerfTrack_ElevationPathStop16009

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16010: AppInfo_PerfTrack_ElevationPathStart16010

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Start

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Event ID 16011: AppInfo_PerfTrack_ElevationPathStop16011

Channel: Diagnostic
Task: AppInfo_PerfTrack_ElevationPath
Opcode: Stop

Fields #

Name	Description
`EventId` UInt32
`UACElevateFileID` UnicodeString

Provenance

ETW provider GUID 93c05d69-51a3-485e-877f-1806a8731346

Defined in appinfo.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4484, captured 2026-06-02 — Manifest XML pack, 2.0 MB