Microsoft-Windows-OOBE-Machine-Core

Event	Title	Channel	Sample	Rule
5004	ServiceStartResult	Diagnostic	N	N
5041	MandatoryTasksStart	Diagnostic	N	N
5042	MandatoryTasksStop	Diagnostic	N	N
5043	FinalizeStart	Diagnostic	N	N
5044	FinalizeStop	Diagnostic	N	N

Event ID 5004: ServiceStartResult

Channel: Diagnostic
Task: ServiceStartResult

Fields #

Name	Description
`Service` UnicodeString
`DWORD` UInt32
`Started` Boolean

Event ID 5041: MandatoryTasksStart

Channel: Diagnostic
Task: MandatoryTasks
Opcode: Start

References #

Event ID 5042: MandatoryTasksStop

Channel: Diagnostic
Task: MandatoryTasks
Opcode: Stop

References #

Event ID 5043: FinalizeStart

Channel: Diagnostic
Task: Finalize
Opcode: Start

References #

Event ID 5044: FinalizeStop

Channel: Diagnostic
Task: Finalize
Opcode: Stop

References #

Provenance

ETW provider GUID ec276cde-2a17-473c-a010-2ff78d5426d2

Defined in msoobe.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3451, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.5074, captured 2026-06-02 — Manifest XML pack, 2.0 MB