Microsoft-Windows-Memory-Diagnostic-Task-Handler
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | Windows removed bad memory regions from this PC. | System | N | N |
| 1002 | Windows reset the list of bad memory regions. | System | N | N |
| 1003 | Windows removed the maximum number of bad memory regions allowed for this PC. | System | N | N |
Event ID 1001: Windows removed bad memory regions from this PC.
#Fields #
| Name | Description |
|---|---|
RemovedMemorySize UInt64 |
Event ID 1002: Windows reset the list of bad memory regions.
#Provenance
ETW provider GUID babda89a-4d5e-48eb-af3d-e0e8410207c0
Defined in MemoryDiagnostic.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB