Microsoft-Windows-OOBE-Machine-DUI

34 events across 2 channels

Event	Title	Channel	Sample
5100	OOBE_DisplayUIStart	Diagnostic	N
5105	OOBE_DisplayUIStop	Diagnostic	N
5106	WizardPage_OnSetActive	Diagnostic	N
5107	WizardPage_OnKillActive	Diagnostic	N
5108	WizardPage_OnNext	Diagnostic	N
5112	WirelessPageVisibilityResult	Diagnostic	N
5113	CComputerNameWizardPage_AccentColorSelection	Diagnostic	N
5114	CLocalizationWizardPage_LanguageSelection	Diagnostic	N
5115	CConnectedUserWizardPage_InternetInitialize	Diagnostic	N
5116	CConnectedUserWizardPage_InternetInitialize5116	Diagnostic	N
5117	WebWizardHost_PopupCommandPressed	Diagnostic	N
5118	WebWizardHost_FinalBack	Diagnostic	N
5119	WebWizardHost_FinalNext	Diagnostic	N
5120	SettingWizardPage_UpdatesOptionSelected	Diagnostic	N
5121	SettingWizardPage_BooleanSettingOptionSelected	Diagnostic	N
5122	WirelessWizardPage_SectionReady	Diagnostic	N
5123	WizardPage_OnPageShown	Diagnostic	N
5124	WizardPage_OnBack	Diagnostic	N
5125	WizardPage_OnSkip	Diagnostic	N
5126	EULAWizardPage_LoadEulas	Diagnostic	N
5127	EULAWizardPage_LoadEulas5127	Diagnostic	N
5128	RtfReader_LoadFile	Diagnostic	N
5129	RtfReader_LoadFile5129	Diagnostic	N
5130	RtfReader_ChangeColor	Diagnostic	N
5131	RtfReader_ChangeColor5131	Diagnostic	N
5132	TimezoneModule_PopulateTimezonesStart	Diagnostic	N
5133	TimezoneModule_PopulateTimezonesStop	Diagnostic	N
5134	RegionModule_ActivateStart	Diagnostic	N
5135	RegionModule_ActivateStop	Diagnostic	N
5136	CLocalizationWizardPage_LanguageSelectionStart	Diagnostic	N
5137	CLocalizationWizardPage_LanguageSelectionStop	Diagnostic	N
5138	RtfReader_SetFontSizeStart	Diagnostic	N
5139	RtfReader_SetFontSizeStop	Diagnostic	N
5500	EULAWizardPage_OEMEulaShown	Operational	N

Event ID 5100: OOBE_DisplayUIStart

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: OOBE_DisplayUI
Opcode: Start

Event ID 5105: OOBE_DisplayUIStop

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: OOBE_DisplayUI
Opcode: Stop

Event ID 5106: WizardPage_OnSetActive

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnSetActive

Fields #

Name	Description
`PluginName` UnicodeString

Event ID 5107: WizardPage_OnKillActive

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnKillActive

Fields #

Name	Description
`PluginName` UnicodeString

Event ID 5108: WizardPage_OnNext

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnNext

Fields #

Name	Description
`PluginName` UnicodeString

Event ID 5112: WirelessPageVisibilityResult

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WirelessPageVisibilityResult
Opcode: Info

Fields #

Name	Description
`DWORD` UInt32

Event ID 5113: CComputerNameWizardPage_AccentColorSelection

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CComputerNameWizardPage_AccentColorSelection

Fields #

Name	Description
`DWORD` UInt32

Event ID 5114: CLocalizationWizardPage_LanguageSelection

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CLocalizationWizardPage_LanguageSelection

Fields #

Name	Description
`DWORD` UInt32

Event ID 5115: CConnectedUserWizardPage_InternetInitialize

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CConnectedUserWizardPage_InternetInitialize

Event ID 5116: CConnectedUserWizardPage_InternetInitialize5116

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CConnectedUserWizardPage_InternetInitialize

Fields #

Name	Description
`val` Boolean

Event ID 5117: WebWizardHost_PopupCommandPressed

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WebWizardHost_PopupCommandPressed

Fields #

Name	Description
`DWORD` UInt32

Event ID 5118: WebWizardHost_FinalBack

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WebWizardHost_FinalBack

Event ID 5119: WebWizardHost_FinalNext

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WebWizardHost_FinalNext

Event ID 5120: SettingWizardPage_UpdatesOptionSelected

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: SettingWizardPage_UpdatesOptionSelected

Fields #

Name	Description
`DWORD` UInt32

Event ID 5121: SettingWizardPage_BooleanSettingOptionSelected

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: SettingWizardPage_BooleanSettingOptionSelected

Fields #

Name	Description
`DWORD` UInt32
`Bool` Boolean

Event ID 5122: WirelessWizardPage_SectionReady

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WirelessWizardPage_SectionReady
Opcode: Info

Fields #

Name	Description
`Text` UnicodeString

Event ID 5123: WizardPage_OnPageShown

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnPageShown

Fields #

Name	Description
`Text` UnicodeString

Event ID 5124: WizardPage_OnBack

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnBack

Fields #

Name	Description
`PluginName` UnicodeString

Event ID 5125: WizardPage_OnSkip

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: WizardPage_OnSkip

Fields #

Name	Description
`PluginName` UnicodeString

Event ID 5126: EULAWizardPage_LoadEulas

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: EULAWizardPage_LoadEulas

Event ID 5127: EULAWizardPage_LoadEulas5127

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: EULAWizardPage_LoadEulas

Event ID 5128: RtfReader_LoadFile

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_LoadFile

Fields #

Name	Description
`Text` UnicodeString

Event ID 5129: RtfReader_LoadFile5129

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_LoadFile

Fields #

Name	Description
`Text` UnicodeString

Event ID 5130: RtfReader_ChangeColor

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_ChangeColor

Event ID 5131: RtfReader_ChangeColor5131

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_ChangeColor

Event ID 5132: TimezoneModule_PopulateTimezonesStart

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: TimezoneModule_PopulateTimezones
Opcode: Start

Event ID 5133: TimezoneModule_PopulateTimezonesStop

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: TimezoneModule_PopulateTimezones
Opcode: Stop

Event ID 5134: RegionModule_ActivateStart

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RegionModule_Activate
Opcode: Start

Event ID 5135: RegionModule_ActivateStop

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RegionModule_Activate
Opcode: Stop

Event ID 5136: CLocalizationWizardPage_LanguageSelectionStart

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CLocalizationWizardPage_LanguageSelection
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5136
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5136

Event ID 5137: CLocalizationWizardPage_LanguageSelectionStop

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: CLocalizationWizardPage_LanguageSelection
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5137
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5137

Event ID 5138: RtfReader_SetFontSizeStart

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_SetFontSize
Opcode: Start

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5138
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5138

Event ID 5139: RtfReader_SetFontSizeStop

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Diagnostic
Task: RtfReader_SetFontSize
Opcode: Stop

References #

Microsoft Learn https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5139
Ultimate Windows Security https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=5139

Event ID 5500: EULAWizardPage_OEMEulaShown

Provider: Microsoft-Windows-OOBE-Machine-DUI
Channel: Operational
Task: EULAWizardPage_OEMEulaShown

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID f5dbaa02-15d6-4644-a784-7032d508bf64

Defined in msoobedui.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-OOBE-Machine-DUI

Event ID 5100: OOBE_DisplayUIStart

Event ID 5105: OOBE_DisplayUIStop

Event ID 5106: WizardPage_OnSetActive

Fields #

Event ID 5107: WizardPage_OnKillActive

Fields #

Event ID 5108: WizardPage_OnNext

Fields #

Event ID 5112: WirelessPageVisibilityResult

Fields #

Event ID 5113: CComputerNameWizardPage_AccentColorSelection

Fields #

Event ID 5114: CLocalizationWizardPage_LanguageSelection

Fields #

Event ID 5115: CConnectedUserWizardPage_InternetInitialize

Event ID 5116: CConnectedUserWizardPage_InternetInitialize5116

Fields #

Event ID 5117: WebWizardHost_PopupCommandPressed

Fields #

Event ID 5118: WebWizardHost_FinalBack

Event ID 5119: WebWizardHost_FinalNext

Event ID 5120: SettingWizardPage_UpdatesOptionSelected

Fields #

Event ID 5121: SettingWizardPage_BooleanSettingOptionSelected

Fields #

Event ID 5122: WirelessWizardPage_SectionReady

Fields #

Event ID 5123: WizardPage_OnPageShown

Fields #

Event ID 5124: WizardPage_OnBack

Fields #

Event ID 5125: WizardPage_OnSkip

Fields #

Event ID 5126: EULAWizardPage_LoadEulas

Event ID 5127: EULAWizardPage_LoadEulas5127

Event ID 5128: RtfReader_LoadFile

Fields #

Event ID 5129: RtfReader_LoadFile5129

Fields #

Event ID 5130: RtfReader_ChangeColor

Event ID 5131: RtfReader_ChangeColor5131

Event ID 5132: TimezoneModule_PopulateTimezonesStart

Event ID 5133: TimezoneModule_PopulateTimezonesStop

Event ID 5134: RegionModule_ActivateStart

Event ID 5135: RegionModule_ActivateStop

Event ID 5136: CLocalizationWizardPage_LanguageSelectionStart

References #

Event ID 5137: CLocalizationWizardPage_LanguageSelectionStop

References #

Event ID 5138: RtfReader_SetFontSizeStart

References #

Event ID 5139: RtfReader_SetFontSizeStop

References #

Event ID 5500: EULAWizardPage_OEMEulaShown

Provenance

Downloads