Microsoft-Windows-MPS-CLNT
Event ID 200: MPS_CLNT_API_RestoreDefaultsStart
#Event ID 201: MPS_CLNT_API_RestoreDefaultsStop
#Event ID 202: MPS_CLNT_API_EnumFirewallRulesStart
#Event ID 203: MPS_CLNT_API_EnumFirewallRulesStop
#Event ID 204: MPS_CLNT_API_DeleteFirewallRuleStart
#Event ID 205: MPS_CLNT_API_DeleteFirewallRuleStop
#Event ID 206: MPS_CLNT_API_DeleteAllFirewallRulesStart
#Event ID 207: MPS_CLNT_API_DeleteAllFirewallRulesStop
#Event ID 208: MPS_CLNT_API_AddFirewallRuleStart
#Event ID 209: MPS_CLNT_API_AddFirewallRuleStop
#Event ID 210: MPS_CLNT_API_SetFirewallRuleStart
#Event ID 211: MPS_CLNT_API_SetFirewallRuleStop
#Event ID 212: MPS_CLNT_API_GetConfigStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 212,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.003Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 213: MPS_CLNT_API_GetConfigStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 213,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.003Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 214: MPS_CLNT_API_SetConfigStart
#Event ID 215: MPS_CLNT_API_SetConfigStop
#Event ID 216: MPS_CLNT_API_GetGlobalConfigStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 216,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:47.998Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 217: MPS_CLNT_API_GetGlobalConfigStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 217,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.000Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 218: MPS_CLNT_API_SetGlobalConfigStart
#Event ID 219: MPS_CLNT_API_SetGlobalConfigStop
#Event ID 220: MPS_CLNT_API_OpenPolicyStoreStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 220,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:47.998Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 221: MPS_CLNT_API_OpenPolicyStoreStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 221,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.001Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 222: MPS_CLNT_API_ClosePolicyStoreStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 222,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.013Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 223: MPS_CLNT_API_ClosePolicyStoreStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 223,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.015Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 224: MPS_CLNT_API_AddConnectionSecurityRuleStart
#Event ID 225: MPS_CLNT_API_AddConnectionSecurityRuleStop
#Event ID 226: MPS_CLNT_API_SetConnectionSecurityRuleStart
#Event ID 227: MPS_CLNT_API_SetConnectionSecurityRuleStop
#Event ID 228: MPS_CLNT_API_DeleteConnectionSecurityRuleStart
#Event ID 229: MPS_CLNT_API_DeleteConnectionSecurityRuleStop
#Event ID 230: MPS_CLNT_API_DeleteAllConnectionSecurityRulesStart
#Event ID 231: MPS_CLNT_API_DeleteAllConnectionSecurityRulesStop
#Event ID 232: MPS_CLNT_API_EnumConnectionSecurityRulesStart
#Event ID 233: MPS_CLNT_API_EnumConnectionSecurityRulesStop
#Event ID 234: MPS_CLNT_API_AddAuthenticationSetStart
#Event ID 235: MPS_CLNT_API_AddAuthenticationSetStop
#Event ID 236: MPS_CLNT_API_DeleteAuthenticationSetStart
#Event ID 237: MPS_CLNT_API_DeleteAuthenticationSetStop
#Event ID 238: MPS_CLNT_API_SetAuthenticationSetStart
#Event ID 239: MPS_CLNT_API_SetAuthenticationSetStop
#Event ID 240: MPS_CLNT_API_DeleteAllAuthenticationSetsStart
#Event ID 241: MPS_CLNT_API_DeleteAllAuthenticationSetsStop
#Event ID 242: MPS_CLNT_API_EnumAuthenticationSetsStart
#Event ID 243: MPS_CLNT_API_EnumAuthenticationSetsStop
#Event ID 244: MPS_CLNT_API_AddCryptoSetStart
#Event ID 245: MPS_CLNT_API_AddCryptoSetStop
#Event ID 246: MPS_CLNT_API_SetCryptoSetStart
#Event ID 247: MPS_CLNT_API_SetCryptoSetStop
#Event ID 248: MPS_CLNT_API_DeleteCryptoSetStart
#Event ID 249: MPS_CLNT_API_DeleteCryptoSetStop
#Event ID 250: MPS_CLNT_API_DeleteAllCryptoSetsStart
#Event ID 251: MPS_CLNT_API_DeleteAllCryptoSetsStop
#Event ID 252: MPS_CLNT_API_EnumCryptoSetsStart
#Event ID 253: MPS_CLNT_API_EnumCryptoSetsStop
#Event ID 254: MPS_CLNT_API_EnumPhase1SAsStart
#Event ID 255: MPS_CLNT_API_EnumPhase1SAsStop
#Event ID 256: MPS_CLNT_API_DeletePhase1SAsStart
#Event ID 257: MPS_CLNT_API_DeletePhase1SAsStop
#Event ID 258: MPS_CLNT_API_EnumPhase2SAsStart
#Event ID 259: MPS_CLNT_API_EnumPhase2SAsStop
#Event ID 260: MPS_CLNT_API_VerifyFirewallRuleStart
#Event ID 261: MPS_CLNT_API_VerifyFirewallRuleStop
#Event ID 262: MPS_CLNT_API_VerifyConnectionSecurityRuleStart
#Event ID 263: MPS_CLNT_API_VerifyConnectionSecurityRuleStop
#Event ID 264: MPS_CLNT_API_VerifyAuthenticationSetStart
#Event ID 265: MPS_CLNT_API_VerifyAuthenticationSetStop
#Event ID 266: MPS_CLNT_API_VerifyCryptoSetStart
#Event ID 267: MPS_CLNT_API_VerifyCryptoSetStop
#Event ID 268: MPS_CLNT_API_ImportPolicyStart
#Event ID 269: MPS_CLNT_API_ImportPolicyStop
#Event ID 270: MPS_CLNT_API_ExportPolicyStart
#Event ID 271: MPS_CLNT_API_ExportPolicyStop
#Event ID 272: MPS_CLNT_API_DeletePhase2SAsStart
#Event ID 273: MPS_CLNT_API_DeletePhase2SAsStop
#Event ID 274: MPS_CLNT_API_FreeFirewallRulesStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 274,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.010Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 275: MPS_CLNT_API_FreeFirewallRulesStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 275,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.010Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 276: MPS_CLNT_API_FreeConnectionSecurityRulesStart
#Event ID 277: MPS_CLNT_API_FreeConnectionSecurityRulesStop
#Event ID 278: MPS_CLNT_API_FreeAuthenticationSetsStart
#Event ID 279: MPS_CLNT_API_FreeAuthenticationSetsStop
#Event ID 280: MPS_CLNT_API_FreeCryptoSetsStart
#Event ID 281: MPS_CLNT_API_FreeCryptoSetsStop
#Event ID 282: MPS_CLNT_API_FreePhase1SAsStart
#Event ID 283: MPS_CLNT_API_FreePhase1SAsStop
#Event ID 284: MPS_CLNT_API_FreePhase2SAsStart
#Event ID 285: MPS_CLNT_API_FreePhase2SAsStop
#Event ID 286: MPS_CLNT_API_StatusMessageFromStatusCodeStart
#Event ID 287: MPS_CLNT_API_StatusMessageFromStatusCodeStop
#Event ID 288: MPS_CLNT_API_FreeMainModeRulesStart
#Event ID 289: MPS_CLNT_API_FreeMainModeRulesStop
#Event ID 290: MPS_CLNT_API_EnumMainModeRulesStart
#Event ID 291: MPS_CLNT_API_EnumMainModeRulesStop
#Event ID 292: MPS_CLNT_API_DeleteMainModeRuleStart
#Event ID 293: MPS_CLNT_API_DeleteMainModeRuleStop
#Event ID 294: MPS_CLNT_API_DeleteAllMainModeRulesStart
#Event ID 295: MPS_CLNT_API_DeleteAllMainModeRulesStop
#Event ID 296: MPS_CLNT_API_AddMainModeRuleStart
#Event ID 297: MPS_CLNT_API_AddMainModeRuleStop
#Event ID 298: MPS_CLNT_API_SetMainModeRuleStart
#Event ID 299: MPS_CLNT_API_SetMainModeRuleStop
#Event ID 300: MPS_CLNT_API_VerifyMainModeRuleStart
#Event ID 301: MPS_CLNT_API_VerifyMainModeRuleStop
#Event ID 302: MPS_CLNT_API_QueryFirewallRulesStart
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 302,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 1,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.008Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 303: MPS_CLNT_API_QueryFirewallRulesStop
#Example Event #
{
"system": {
"channel": "Microsoft-Windows-MPS-CLNT/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 303,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 4728,
"thread_id": 5164
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 2,
"provider": "Microsoft-Windows-MPS-CLNT",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:47:48.010Z",
"version": 0
},
"event_data": {},
"message": ""
}
Event ID 304: MPS_CLNT_API_QueryConnectionSecurityRulesStart
#Event ID 305: MPS_CLNT_API_QueryConnectionSecurityRulesStop
#Event ID 306: MPS_CLNT_API_QueryMainModeRulesStart
#Event ID 307: MPS_CLNT_API_QueryMainModeRulesStop
#Event ID 308: MPS_CLNT_API_QueryAuthenticationSetsStart
#Event ID 309: MPS_CLNT_API_QueryAuthenticationSetsStop
#Event ID 310: MPS_CLNT_API_QueryCryptoSetsStart
#Event ID 311: MPS_CLNT_API_QueryCryptoSetsStop
#Event ID 312: MPS_CLNT_API_VerifyFirewallRuleQueryStart
#Event ID 313: MPS_CLNT_API_VerifyFirewallRuleQueryStop
#Event ID 314: MPS_CLNT_API_VerifyConnectionSecurityRuleQueryStart
#Event ID 315: MPS_CLNT_API_VerifyConnectionSecurityRuleQueryStop
#Event ID 316: MPS_CLNT_API_VerifyMainModeRuleQueryStart
#Event ID 317: MPS_CLNT_API_VerifyMainModeRuleQueryStop
#Event ID 318: MPS_CLNT_API_VerifyAuthenticationSetQueryStart
#Event ID 319: MPS_CLNT_API_VerifyAuthenticationSetQueryStop
#Event ID 320: MPS_CLNT_API_VerifyCryptoSetQueryStart
#Event ID 321: MPS_CLNT_API_VerifyCryptoSetQueryStop
#Event ID 322: MPS_CLNT_API_FreeQueryStart
#Event ID 323: MPS_CLNT_API_FreeQueryStop
#Provenance
ETW provider GUID 37945dc2-899b-44d1-b79c-dd4a9e57ff98
Defined in mpssvc.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3328, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4768, captured 2026-06-02 — Manifest XML pack, 2.0 MB