Microsoft-Windows-osk
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | LaunchAppStart | Diagnostic | N | N |
| 2 | LaunchAppStop | Diagnostic | N | N |
| 3 | LaunchOptionsDlgStart | Diagnostic | N | N |
| 4 | LaunchOptionsDlgStop | Diagnostic | N | N |
| 5 | SwitchModeStart | Diagnostic | N | N |
| 6 | SwitchModeStop | Diagnostic | N | N |
| 7 | ShowPredictionsStart | Diagnostic | N | N |
| 8 | ShowPredictionsStop | Diagnostic | N | N |
| 9 | ScanStateTransitionStart | Diagnostic | N | N |
| 10 | ScanStateTransitionStop | Diagnostic | N | N |
| 11 | ScanTargetTransition | Diagnostic | N | N |
| 13 | KeyActivation | Diagnostic | N | N |
| 15 | SetNumpadVisibility | Diagnostic | N | N |
| 17 | SetDockedState | Diagnostic | N | N |
| 19 | SetOSKFadeState | Diagnostic | N | N |
Event ID 1: LaunchAppStart
#Event ID 2: LaunchAppStop
#Event ID 3: LaunchOptionsDlgStart
#Event ID 4: LaunchOptionsDlgStop
#Event ID 5: SwitchModeStart
#Event ID 6: SwitchModeStop
#Event ID 7: ShowPredictionsStart
#Event ID 8: ShowPredictionsStop
#Event ID 10: ScanStateTransitionStop
#Event ID 11: ScanTargetTransition
#Provenance
ETW provider GUID 4f768be8-9c69-4bbc-87fc-95291d3f9d0c
Defined in osk.exe, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB