Microsoft-Windows-OobeLdr

Event	Title	Channel	Sample	Rule
1001	OobeLdr.	Analytic	N	N
1002	OobeLdr.	Analytic	N	N
2001	Executing unattend settings pass "Pass".	Analytic	N	N
2002	Finished executing unattend pass with status ErrorCode.	Analytic	N	N
2003	Failed to execute unattend pass with status ErrorCode.	Analytic	N	N
2004	Using unattend file "FilePath" for pass "Pass".	Analytic	N	N
3001	Launching Oobe.	Analytic	N	N
3002	Oobe exited with status ErrorCode.	Analytic	N	N

Event ID 1001: OobeLdr.

OobeLdr.exe is running with command line "CommandLine".

OobeLdr.exe is running with command line "%1".

Name	Description
`CommandLine` UnicodeString

OobeLdr.exe exiting with status ErrorCode.

OobeLdr.exe exiting with status %1.

Name	Description
`ErrorCode` UInt32

Executing unattend settings pass "%1".

Name	Description
`Pass` UnicodeString

Finished executing unattend pass with status %1.

Name	Description
`ErrorCode` UInt32

Failed to execute unattend pass with status %1.

Name	Description
`ErrorCode` UInt32

Using unattend file "%2" for pass "%1".

Name	Description
`Pass` UnicodeString
`FilePath` UnicodeString

Oobe exited with status %1.

Name	Description
`ErrorCode` UInt32

ETW provider GUID 75ebc33e-8670-4eb6-b535-3b9d6bb222fd

Defined in OobeLdr.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB