Microsoft-Windows-ParentalControls

Event	Title	Channel	Sample	Rule
1	A Setting changed inside of the parental controls settings	Operational	N	N
2	Generated when a game is run	Operational	N	N
3	Generated when a URL is visited	Operational	N	N
4	Generated with an Email is Received	Operational	N	N
5	Generated with an Email is Sent	Operational	N	N
6	Generated when some media is played	Operational	N	N
7	Generated when an IM Invitiation is sent	Operational	N	N
8	Generated when a user Joins an IM conversation	Operational	N	N
9	Generated when a user leaves an IM conversation	Operational	N	N
10	Generated when a user downloads a file	Operational	N	N
11	Generated when one of the IM features is used, like web chat, audio	Operational	N	N
13	Generated by external apps that want to log parental control information	Operational	N	N
14	Generated when an email contact is changed	Operational	N	N
15	Generated when an IM contact is changed	Operational	N	N
16	Generated when an application is blocked from running	Operational	N	N
17	Generated when an application override is requested	Operational	N	N
18	Generated when a url override is requested	Operational	N	N
19	Generated when a website is visited	Operational	N	N
20	Generated when an application is started, stopped or blocked	Operational	N	N
21	Generated when the computer is used	Operational	N	N
22	Generated when content is used or blocked	Operational	N	N

Event ID 1: A Setting changed inside of the parental controls settings

Channel: Operational
Task: SettingChange
Opcode: Modify

Fields #

Name	Description
`Class` UnicodeString
`Setting` UInt32
`AccountOwner` UnicodeString
`OldValue` UnicodeString
`NewValue` UnicodeString
`Reason` UInt32
`Optional` UnicodeString

Event ID 2: Generated when a game is run

Channel: Operational
Task: GameStart
Opcode: Launch

Fields #

Name	Description
`AppID` GUID
`InstanceID` GUID
`Version` UnicodeString
`Path` UnicodeString
`Rating` UnicodeString
`RatingsSystem` GUID
`Reason` UInt32
`DescriptorCount` UInt32
`Descriptor` UnicodeString
`PID` UInt32

Event ID 3: Generated when a URL is visited

Channel: Operational
Task: UrlVisit
Opcode: Web

Fields #

Name	Description
`URL` UnicodeString
`Application` UnicodeString
`Version` UnicodeString
`Reason` UInt32
`RatingSystemID` GUID
`CategoryCount` UInt32
`Category` UnicodeString

Event ID 4: Generated with an Email is Received

Channel: Operational
Task: EmailReceived
Opcode: Launch

Fields #

Name	Description
`Sender` UnicodeString
`Application` UnicodeString
`Version` UnicodeString
`Subject` UnicodeString
`Reason` UInt32
`RecipientCount` UInt32
`Recipient` UnicodeString
`AttachmentCount` UInt32
`AttachmentName` UnicodeString
`ReceivedTime` SYSTEMTIME
`EmailAccount` UnicodeString

Event ID 5: Generated with an Email is Sent

Channel: Operational
Task: EmailSent
Opcode: Launch

Fields #

Name	Description
`Sender` UnicodeString
`Application` UnicodeString
`Version` UnicodeString
`Subject` UnicodeString
`Reason` UInt32
`RecipientCount` UInt32
`Recipient` UnicodeString
`AttachmentCount` UInt32
`AttachmentName` UnicodeString
`EmailAccount` UnicodeString

Event ID 6: Generated when some media is played

Channel: Operational
Task: MediaPlayback
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`MediaType` UInt32
`Path` UnicodeString
`Title` UnicodeString
`PML` UInt32
`Album` UnicodeString
`ExplicitContent` UInt32
`Reason` UInt32

Event ID 7: Generated when an IM Invitiation is sent

Channel: Operational
Task: IMInvitation
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`AccountName` UnicodeString
`ConversationID` UnicodeString
`RequestingIP` UnicodeString
`Sender` UnicodeString
`Reason` UInt32
`RecipientCount` UInt32
`Recipient` UnicodeString

Event ID 8: Generated when a user Joins an IM conversation

Channel: Operational
Task: IMJoin
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`AccountName` UnicodeString
`ConversationID` UnicodeString
`JoiningIP` UnicodeString
`JoiningUser` UnicodeString
`Reason` UInt32
`MemberCount` UInt32
`Member` UnicodeString
`Sender` UnicodeString

Event ID 9: Generated when a user leaves an IM conversation

Channel: Operational
Task: IMLeave
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`AccountName` UnicodeString
`ConversationID` UnicodeString
`LeavingIP` UnicodeString
`LeavingUser` UnicodeString
`Reason` UInt32
`MemberCount` UInt32
`Member` UnicodeString
`Flags` UInt32

Event ID 10: Generated when a user downloads a file

Channel: Operational
Task: FileDownload
Opcode: Web

Fields #

Name	Description
`URL` UnicodeString
`Application` UnicodeString
`Version` UnicodeString
`Reason` UInt32
`Path` UnicodeString

Event ID 11: Generated when one of the IM features is used, like web chat, audio

Channel: Operational
Task: IMFeature
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`AccountName` UnicodeString
`ConversationID` UnicodeString
`MediaType` UInt32
`Reason` UInt32
`RecipientCount` UInt32
`Recipient` UnicodeString
`Sender` UnicodeString
`SenderIP` UnicodeString
`Data` UnicodeString

Event ID 13: Generated by external apps that want to log parental control information

Channel: Operational
Task: Custom
Opcode: System

Fields #

Name	Description
`Publisher` UnicodeString
`Application` UnicodeString
`Version` UnicodeString
`Event` UnicodeString
`Value1` UnicodeString
`Value2` UnicodeString
`Value3` UnicodeString
`Blocked` UInt32
`Reason` UnicodeString

Event ID 14: Generated when an email contact is changed

Channel: Operational
Task: EmailContact
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`OldName` UnicodeString
`OldAddress` UnicodeString
`NewName` UnicodeString
`NewAddress` UnicodeString
`Reason` UInt32
`EmailAccount` UnicodeString

Event ID 15: Generated when an IM contact is changed

Channel: Operational
Task: IMContact
Opcode: Launch

Fields #

Name	Description
`Application` UnicodeString
`Version` UnicodeString
`AccountName` UnicodeString
`OldName` UnicodeString
`OldID` UnicodeString
`NewName` UnicodeString
`NewID` UnicodeString
`Reason` UInt32

Event ID 16: Generated when an application is blocked from running

Channel: Operational
Task: ApplicationBlocked
Opcode: Launch

Fields #

Name	Description
`Timestamp` SYSTEMTIME
`UserID` UnicodeString
`Path` UnicodeString
`RuleID` UnicodeString

Event ID 17: Generated when an application override is requested

Channel: Operational
Task: ApplicationOverride
Opcode: Launch

Fields #

Name	Description
`UserID` UnicodeString
`Path` UnicodeString
`Reason` UInt32

Event ID 18: Generated when a url override is requested

Channel: Operational
Task: WebOverride
Opcode: Launch

Fields #

Name	Description
`UserID` UnicodeString
`URL` UnicodeString
`Reason` UInt32

Event ID 19: Generated when a website is visited

Channel: Operational
Task: WebsiteVisit
Opcode: Web

Fields #

Name	Description
`Url` UnicodeString
`Decision` UInt32
`Categories` UnicodeString
`BlockedCategories` UnicodeString
`SerializedApplication` UnicodeString
`Title` UnicodeString
`ContentType` UnicodeString
`Referrer` UnicodeString
`Telemetry` UnicodeString

Event ID 20: Generated when an application is started, stopped or blocked

Channel: Operational
Task: Application
Opcode: Launch

Fields #

Name	Description
`SerializedApplication` UnicodeString
`State` UInt32
`ProcessId` UInt32
`CreationTime` FILETIME
`TimeUsed` UInt64

Event ID 21: Generated when the computer is used

Channel: Operational
Task: ComputerUsage
Opcode: System

Fields #

Name	Description
`Id` UInt64
`TimeUsed` UInt64

Event ID 22: Generated when content is used or blocked

Channel: Operational
Task: ContentUsage
Opcode: System

Fields #

Name	Description
`ContentProviderId` UnicodeString
`ContentProviderTitle` UnicodeString
`Id` UnicodeString
`Title` UnicodeString
`Category` UInt32
`Ratings` UnicodeString
`Decision` UInt32

Provenance

ETW provider GUID 01090065-b467-4503-9b28-533766761087

Defined in wpc.dll, which carries the event manifest.

Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB