detection.wiki

Microsoft-Windows-OOBE-Machine-DUI

EventTitleChannelSampleRule
5100OOBE_DisplayUIStartDiagnosticNN
5105OOBE_DisplayUIStopDiagnosticNN
5106WizardPage_OnSetActiveDiagnosticNN
5107WizardPage_OnKillActiveDiagnosticNN
5108WizardPage_OnNextDiagnosticNN
5112WirelessPageVisibilityResultDiagnosticNN
5113CComputerNameWizardPage_AccentColorSelectionDiagnosticNN
5114CLocalizationWizardPage_LanguageSelectionDiagnosticNN
5115CConnectedUserWizardPage_InternetInitializeDiagnosticNN
5116CConnectedUserWizardPage_InternetInitialize5116DiagnosticNN
5117WebWizardHost_PopupCommandPressedDiagnosticNN
5118WebWizardHost_FinalBackDiagnosticNN
5119WebWizardHost_FinalNextDiagnosticNN
5120SettingWizardPage_UpdatesOptionSelectedDiagnosticNN
5121SettingWizardPage_BooleanSettingOptionSelectedDiagnosticNN
5122WirelessWizardPage_SectionReadyDiagnosticNN
5123WizardPage_OnPageShownDiagnosticNN
5124WizardPage_OnBackDiagnosticNN
5125WizardPage_OnSkipDiagnosticNN
5126EULAWizardPage_LoadEulasDiagnosticNN
5127EULAWizardPage_LoadEulas5127DiagnosticNN
5128RtfReader_LoadFileDiagnosticNN
5129RtfReader_LoadFile5129DiagnosticNN
5130RtfReader_ChangeColorDiagnosticNN
5131RtfReader_ChangeColor5131DiagnosticNN
5132TimezoneModule_PopulateTimezonesStartDiagnosticNN
5133TimezoneModule_PopulateTimezonesStopDiagnosticNN
5134RegionModule_ActivateStartDiagnosticNN
5135RegionModule_ActivateStopDiagnosticNN
5136CLocalizationWizardPage_LanguageSelectionStartDiagnosticNN
5137CLocalizationWizardPage_LanguageSelectionStopDiagnosticNN
5138RtfReader_SetFontSizeStartDiagnosticNN
5139RtfReader_SetFontSizeStopDiagnosticNN
5500EULAWizardPage_OEMEulaShownOperationalNN

Event ID 5100: OOBE_DisplayUIStart

#
Channel
Diagnostic
Task
OOBE_DisplayUI
Opcode
Start

Event ID 5105: OOBE_DisplayUIStop

#
Channel
Diagnostic
Task
OOBE_DisplayUI
Opcode
Stop

Event ID 5106: WizardPage_OnSetActive

#
Channel
Diagnostic
Task
WizardPage_OnSetActive

Fields #

NameDescription
PluginName UnicodeString

Event ID 5107: WizardPage_OnKillActive

#
Channel
Diagnostic
Task
WizardPage_OnKillActive

Fields #

NameDescription
PluginName UnicodeString

Event ID 5108: WizardPage_OnNext

#
Channel
Diagnostic
Task
WizardPage_OnNext

Fields #

NameDescription
PluginName UnicodeString

Event ID 5112: WirelessPageVisibilityResult

#
Channel
Diagnostic
Task
WirelessPageVisibilityResult
Opcode
Info

Fields #

NameDescription
DWORD UInt32

Event ID 5113: CComputerNameWizardPage_AccentColorSelection

#
Channel
Diagnostic
Task
CComputerNameWizardPage_AccentColorSelection

Fields #

NameDescription
DWORD UInt32

Event ID 5114: CLocalizationWizardPage_LanguageSelection

#
Channel
Diagnostic
Task
CLocalizationWizardPage_LanguageSelection

Fields #

NameDescription
DWORD UInt32

Event ID 5115: CConnectedUserWizardPage_InternetInitialize

#
Channel
Diagnostic
Task
CConnectedUserWizardPage_InternetInitialize

Event ID 5116: CConnectedUserWizardPage_InternetInitialize5116

#
Channel
Diagnostic
Task
CConnectedUserWizardPage_InternetInitialize

Fields #

NameDescription
val Boolean

Event ID 5117: WebWizardHost_PopupCommandPressed

#
Channel
Diagnostic
Task
WebWizardHost_PopupCommandPressed

Fields #

NameDescription
DWORD UInt32

Event ID 5118: WebWizardHost_FinalBack

#
Channel
Diagnostic
Task
WebWizardHost_FinalBack

Event ID 5119: WebWizardHost_FinalNext

#
Channel
Diagnostic
Task
WebWizardHost_FinalNext

Event ID 5120: SettingWizardPage_UpdatesOptionSelected

#
Channel
Diagnostic
Task
SettingWizardPage_UpdatesOptionSelected

Fields #

NameDescription
DWORD UInt32

Event ID 5121: SettingWizardPage_BooleanSettingOptionSelected

#
Channel
Diagnostic
Task
SettingWizardPage_BooleanSettingOptionSelected

Fields #

NameDescription
DWORD UInt32
Bool Boolean

Event ID 5122: WirelessWizardPage_SectionReady

#
Channel
Diagnostic
Task
WirelessWizardPage_SectionReady
Opcode
Info

Fields #

NameDescription
Text UnicodeString

Event ID 5123: WizardPage_OnPageShown

#
Channel
Diagnostic
Task
WizardPage_OnPageShown

Fields #

NameDescription
Text UnicodeString

Event ID 5124: WizardPage_OnBack

#
Channel
Diagnostic
Task
WizardPage_OnBack

Fields #

NameDescription
PluginName UnicodeString

Event ID 5125: WizardPage_OnSkip

#
Channel
Diagnostic
Task
WizardPage_OnSkip

Fields #

NameDescription
PluginName UnicodeString

Event ID 5126: EULAWizardPage_LoadEulas

#
Channel
Diagnostic
Task
EULAWizardPage_LoadEulas

Event ID 5127: EULAWizardPage_LoadEulas5127

#
Channel
Diagnostic
Task
EULAWizardPage_LoadEulas

Event ID 5128: RtfReader_LoadFile

#
Channel
Diagnostic
Task
RtfReader_LoadFile

Fields #

NameDescription
Text UnicodeString

Event ID 5129: RtfReader_LoadFile5129

#
Channel
Diagnostic
Task
RtfReader_LoadFile

Fields #

NameDescription
Text UnicodeString

Event ID 5130: RtfReader_ChangeColor

#
Channel
Diagnostic
Task
RtfReader_ChangeColor

Event ID 5131: RtfReader_ChangeColor5131

#
Channel
Diagnostic
Task
RtfReader_ChangeColor

Event ID 5132: TimezoneModule_PopulateTimezonesStart

#
Channel
Diagnostic
Task
TimezoneModule_PopulateTimezones
Opcode
Start

Event ID 5133: TimezoneModule_PopulateTimezonesStop

#
Channel
Diagnostic
Task
TimezoneModule_PopulateTimezones
Opcode
Stop

Event ID 5134: RegionModule_ActivateStart

#
Channel
Diagnostic
Task
RegionModule_Activate
Opcode
Start

Event ID 5135: RegionModule_ActivateStop

#
Channel
Diagnostic
Task
RegionModule_Activate
Opcode
Stop

Event ID 5136: CLocalizationWizardPage_LanguageSelectionStart

#
Channel
Diagnostic
Task
CLocalizationWizardPage_LanguageSelection
Opcode
Start

References #

Event ID 5137: CLocalizationWizardPage_LanguageSelectionStop

#
Channel
Diagnostic
Task
CLocalizationWizardPage_LanguageSelection
Opcode
Stop

References #

Event ID 5138: RtfReader_SetFontSizeStart

#
Channel
Diagnostic
Task
RtfReader_SetFontSize
Opcode
Start

References #

Event ID 5139: RtfReader_SetFontSizeStop

#
Channel
Diagnostic
Task
RtfReader_SetFontSize
Opcode
Stop

References #

Event ID 5500: EULAWizardPage_OEMEulaShown

#
Channel
Operational
Task
EULAWizardPage_OEMEulaShown

Provenance

ETW provider GUID f5dbaa02-15d6-4644-a784-7032d508bf64

Defined in msoobedui.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB