Microsoft-Windows-PDC

Event	Title	Channel	Sample	Rule
1	Activator Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N	N
2	Activator Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N	N
3	Notification client Client (PDC Identifier:PdcId) registered with status: …	Diagnostic	N	N
4	Notification client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N	N
5	Resiliency client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N	N
6	Resiliency client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N	N
7	Notification message ActivityType: Status/Active: Message, ActivityType: …	Diagnostic	Y	N
8	Activators received acknowledgement: Status: …	Diagnostic	N	N
9	Activator client Client received acknowledgement: Status: State.	Diagnostic	N	N
10	Notification started: Type: Notification_started_Type, …	Diagnostic	N	N
11	Control notification: Type: Control_notification_Type, Flags:Flags.	Diagnostic	N	N
12	Invalid notification: Client: Invalid_notification_Client, Expected sequence …	Diagnostic	N	N
13	Notification received: Client: Notification_received_Client, Received sequence …	Diagnostic	N	N
14	Notification received from all clients: Status:Status.	Diagnostic	N	N
15	Callback activated for type: Status.	Diagnostic	N	N
16	Notification message: Client Control, Message: Status, Control: PDC_Sequence, …	Diagnostic	N	N
17	Activator Client Client sent a request to PDC.	Diagnostic	N	N
18	Response from PDC to activator Client Client.	Diagnostic	Y	N
19	TransactionId resiliency client: client: Port, Port: ResiliencyType, …	Diagnostic	Y	N
20	Resiliency Message ClientState, TransactionId: ClientStatus, ClientState: …	Diagnostic	N	N
21	PDC recieved message from resiliency client Client.	Diagnostic	N	N
22	PDC sent message to resiliency client Client.	Diagnostic	N	N
23	PDC resiliency client Client referenced.	Diagnostic	Y	N
24	PDC resiliency client Client dereferenced.	Diagnostic	Y	N
25	PDC is entering Phase phase.	Diagnostic	N	N
26	PDC is exiting Phase phase with status: Status.	Diagnostic	N	N
27	PDC received display notification: PDC_received_display_notification.	Diagnostic	N	N
28	PDC received monitor request ON/OFF: PDC_received_monitor_request_ONOFF, …	Diagnostic	N	N
29	PDC received monitor request exit at: PDC_received_monitor_request_exit_at, …	Diagnostic	N	N
30	PDC monitor context - Session Count:ConnectedSessionCount, Console …	Diagnostic	N	N
31	PDC monitor handler activated at:PDC_monitor_handler_activated_at.	Diagnostic	N	N
32	PDC monitor control activated.	Diagnostic	N	N
33	PDC power button handler activated.	Diagnostic	N	N
34	PDC power button consumed.	Diagnostic	N	N
35	PDC Display notification handler activated.	Diagnostic	N	N
36	PDC PdcCsEnterExit handler activated at:PDC_PdcCsEnterExit_handler_activated_at.	Diagnostic	N	N
37	PDC Enable Input.	Diagnostic	N	N
38	PDC Disable Input.	Diagnostic	N	N
39	PDC Suspend/Resume handler activated.	Diagnostic	N	N
40	PDC Session handler - Session Connected, Console: SessionId, Connected: Console.	Diagnostic	N	N
41	PDC Connection Event.	Diagnostic	N	N
42	PDC Initialization - AoAc: PDC_Initialization__AoAc, Status:Status.	Diagnostic	N	N
43	Suspend/Resume client in process Process (session:Session) at Client (PDC …	Diagnostic	Y	N
44	Suspend/Resume client in process Process (session:Session) at Client (PDC …	Diagnostic	Y	N
45	Suspend/reesume Client Client sent a request to PDC.	Diagnostic	N	N
46	Response from PDC to suspend/resume client Client.	Diagnostic	N	N
47	Suspend/resume message PowerEvent: Transaction id: Message, PowerEvent: …	Diagnostic	N	N
48	Suspend Entered	Diagnostic	N	N
49	Suspend Exited	Diagnostic	N	N
50	Suspend Entered	Diagnostic	N	N
51	Suspend Exited	Diagnostic	N	N
52	Suspend Entered	Diagnostic	N	N
53	Suspend Exited	Diagnostic	N	N
54	Suspend Entered	Diagnostic	N	N
55	Suspend Exited	Diagnostic	N	N
56	Suspend/Resume callback	Diagnostic	N	N
57	Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, …	Diagnostic	N	N
58	Notification received: Client: Notification_received_Client, Received sequence …	Diagnostic	N	N
59	Invalid notification: Client: Invalid_notification_Client, Expected sequence …	Diagnostic	N	N
60	Notification received from all clients: Status:Status.	Diagnostic	N	N
61	PDC Suspend/Resume event handler activated.	Diagnostic	N	N
62	Connected standby entered	Diagnostic	N	N
63	CS entered with times: PLM: DisableInputToPLMEntry, DAM: …	Diagnostic	N	N
64	Connected standby about the exit	Diagnostic	N	N
65	CS exited with times: Low Power Epoch: ResiliencyExitToLowPowerEpochEntry, …	Diagnostic	N	N
66	Connected standby progression aborted	Diagnostic	N	N
67	Connected standby exited	Diagnostic	N	N
68	PDC state changed: new: PDC_state_changed_new, old:old.	Diagnostic	N	N
69	Console Display Off request status:Console_Display_Off_request_status.	Diagnostic	N	N
70	Console Display Off is disabled	Diagnostic	N	N
71	Activator Client (PDC Identifier:PdcId) registered with status: …	Diagnostic	N	N
72	Notification client Client (PDC Identifier:PdcId) registered with status: Type.	Diagnostic	N	N
73	Resiliency client Client (PDC Identifier:ClientReferences) registered with …	Diagnostic	N	N
74	PDC Filter Input.	Diagnostic	N	N
75	Task client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N	N
76	Task client Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N	N
77	Task message Message: Status/Active: Status/Active.	Diagnostic	N	N
78	Task Client Client sent a request to PDC.	Diagnostic	N	N
79	Response from PDC to task client Client.	Diagnostic	N	N
80	Rundown of PDC task client ReferenceCount - PDC identifier:Status, …	Diagnostic	N	N
81	PDC task client TaskClient referenced at csphase At.	Diagnostic	N	N
82	PDC task client TaskClient dereferenced at csphase At.	Diagnostic	N	N
83	DisplayOffStart	Diagnostic	N	N
84	DisplayOffEnd	Diagnostic	N	N
85	DisplayOffAbort	Diagnostic	N	N
86	EnterConnectedStandbyAbort	Diagnostic	N	N
87	ActivationStatistics	Diagnostic	N	N
88	Scenario client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N	N
89	Scenario client Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N	N
90	Task message PdcMessage: Status/Active: Client.	Diagnostic	N	N
91	Scenario Client Client sent a request to PDC.	Diagnostic	N	N
92	Response from PDC to scenario client Client.	Diagnostic	N	N
93	Rundown of PDC scenario client Active - PDC identifier:Status, Active:Name, …	Diagnostic	N	N
94	SPM scenario Scenario state changed: new NextState, old PreviousState.	Diagnostic	N	N
95	SPM scenario Scenario has ClientIdCount scenario clients of dependency type …	Diagnostic	N	N
96	SPM scenario client TestClient info - Name:ClientNameLength TestClient:ClientId.	Diagnostic	N	N
97	Rundown of SPM scenario Flags - GUID:State, Flags:Name, State:Scenario, …	Diagnostic	N	N
98	Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, …	Diagnostic	N	N
99	SPM client ID PdcId state changed: old PreviousState, new NextState.	Diagnostic	N	N
100	SPM client ClientName (ID: PdcId) has current reference count ReferenceCount.	Diagnostic	N	N
101	PhaseAccounting_V1	Diagnostic	N	N
102	ClientVerboseRundown	Diagnostic	N	N
103	ActivatorActiveTooLong	Diagnostic	N	N
104	Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, …	Diagnostic	N	N
105	SpmScenarioActivityRundown	Diagnostic	N	N
106	Ppm Profile client Client (PDC Identifier:PdcId, ProfileGuid:ProfileGuid) …	Diagnostic	N	N
107	PPM profile client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N	N
108	PDC PPM profile client Client acquired a referenced.	Diagnostic	N	N
109	PDC PPM profile client Client released a referenced.	Diagnostic	N	N
110	PDCV2 ClientRegistered - ClientId=ClientId, status=Status.	Diagnostic	N	N
111	PDCV2 ClientActivated - ClientId=ClientId(TaskName, …	Diagnostic	Y	N
112	PDCV2 ClientRenewed - ClientId=ClientId(TaskName, …	Diagnostic	N	N
113	PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, …	Diagnostic	Y	N
114	PDCV2 ClientUnregistered - ClientId=ClientId, status=Status.	Diagnostic	N	N
115	PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, …	Diagnostic	N	N
116	PDCV2 SetBrokeredPID- ClientId=ClientId(TaskName, …	Diagnostic	N	N
117	Modern Standby exit due to PDC signal client	Diagnostic	N	N
118	Modern Standby entry due to PDC signal client	Diagnostic	N	N
119	PDC phase Phase was referenced.	Diagnostic	Y	N
120	PDC phase Phase was dereferenced.	Diagnostic	Y	N
121	PDC phase PreviousTargetPhase was selected as target.	Diagnostic	N	N
122	PDC target phase Phase was reached.	Diagnostic	N	N
123	PDC phase Phase notifications state changed.	Diagnostic	N	N
124	PDC phase Phase rundown.	Diagnostic	N	N
125	PDC phase Phase accounting rundown.	Diagnostic	N	N
126	PDC phase notification callback	Diagnostic	N	N
127	PDC notified system is idle state SystemIdle.	Diagnostic	Y	N
128	A function in PDC received an invalid argument	Diagnostic	N	N
129	SpmScenarioCreate	Diagnostic	N	N
130	SpmScenarioDelete	Diagnostic	N	N
131	GroupEnable	Diagnostic	N	N
132	GroupRequest	Diagnostic	Y	N
133	ClientPolicyRundown	Diagnostic	N	N
134	ClientPolicyRuleStatusChange	Diagnostic	N	N

Event ID 1: Activator Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Task: ActivatorRegistration

Message #

Activator %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 2: Activator Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: ActivatorDeregistration

Message #

Activator %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 3: Notification client Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Task: NotificationRegistration

Message #

Notification client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 4: Notification client Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: NotificationDeregistration

Message #

Notification client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 5: Resiliency client Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Task: ResiliencyClientRegistration

Message #

Resiliency client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 6: Resiliency client Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: ResiliencyClientDeregistration

Message #

Resiliency client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 7: Notification message ActivityType: Status/Active: Message, ActivityType: StatusActive.

Channel: Diagnostic
Level: 4
Task: ActivatorMessage

Message #

Notification message %1: Status/Active: %2, ActivityType: %3

Fields #

Name	Description
`Message` Pointer
`StatusActive` UInt32
`ActivityType` UInt32	1: Status/Active.

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 7,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:21.712Z",
    "version": 0
  },
  "event_data": {
    "ActivityType": 0,
    "Message": "0xFFFFF4890CF27DB0",
    "Status/Active": 0
  },
  "message": ""
}

Example keys not documented in the fields table: Status/Active

Event ID 8: Activators received acknowledgement: Status: Activators_received_acknowledgement_Status, State: State.

Channel: Diagnostic
Task: ActivatorAcknowledgement

Message #

Activators received acknowledgement: Status: %1, State: %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`State` UInt32

Event ID 9: Activator client Client received acknowledgement: Status: State.

Channel: Diagnostic
Task: ActivatorClientAcknowledgement

Message #

Activator client %1 received acknowledgement: Status: %2

Fields #

Name	Description
`Client` Pointer
`State` UInt32

Event ID 10: Notification started: Type: Notification_started_Type, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Value:Value, WaitTime:WaitTime.

Channel: Diagnostic
Task: NotificationStarted

Message #

Notification started: Type: %1, ClientContext:%2, PDC Sequence:%3, Value:%4, WaitTime:%5

Fields #

Name	Description
`Type` UInt32
`ClientContext` Pointer
`PdcSequence` UInt32
`Value` UInt32
`WaitTime` UInt32

Event ID 11: Control notification: Type: Control_notification_Type, Flags:Flags.

Channel: Diagnostic
Task: ControlNotification

Message #

Control notification: Type: %1, Flags:%2

Fields #

Name	Description
`Type` UInt32
`Flags` UInt32

Event ID 12: Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Channel: Diagnostic
Task: InvalidNotification

Message #

Invalid notification: Client: %1, Expected sequence number:%2, Received sequence number:%3

Fields #

Name	Description
`Client` Pointer
`AssumedPdcSequence` UInt32
`ReceivedPdcSequence` UInt32

Event ID 13: Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Channel: Diagnostic
Task: NotificationReceived

Message #

Notification received: Client: %1, Received sequence number:%2

Fields #

Name	Description
`Client` Pointer
`PdcSequence` UInt32

Event ID 14: Notification received from all clients: Status:Status.

Channel: Diagnostic
Task: NotificationAllClientResponded

Message #

Notification received from all clients: Status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 15: Callback activated for type: Status.

Channel: Diagnostic
Task: NotificationCallback

Message #

Callback activated for type: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 16: Notification message: Client Control, Message: Status, Control: PDC_Sequence, Status: Client; PDC Sequence: Message.

Channel: Diagnostic
Task: NotificationMessage

Message #

Notification message: Client %1, Message: %2, Control: %3, Status: %4; PDC Sequence: %5

Fields #

Name	Description
`Client` Pointer
`Message` Pointer
`Control` UInt32	1, Message.
`Status` UInt32	NTSTATUS reference
`PdcSequence` UInt32

Event ID 17: Activator Client Client sent a request to PDC.

Channel: Diagnostic
Task: ActivatorReceive

Message #

Activator Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 18: Response from PDC to activator Client Client.

Channel: Diagnostic
Level: 4
Task: ActivatorSend

Message #

Response from PDC to activator Client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 18,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:21.713Z",
    "version": 0
  },
  "event_data": {
    "Client": "0xFFFFC807BC631B20",
    "Send/Receive": 0
  },
  "message": ""
}

Example keys not documented in the fields table: Send/Receive

Event ID 19: TransactionId resiliency client: client: Port, Port: ResiliencyType, ResiliencyType: ClientReferences, ClientReferences: Transation_Id, Transation Id: CurrentState, CurrentState: NextState, NextSta...

Channel: Diagnostic
Level: 4
Task: ResiliencyClient

Description

TransactionId resiliency client: client: Port, Port: ResiliencyType, ResiliencyType: ClientReferences, ClientReferences: Transation_Id, Transation Id: CurrentState, CurrentState: NextState, NextState: Client.

Message #

%9 resiliency client: client: %1, Port: %2, ResiliencyType: %3, ClientReferences: %4, Transation Id: %5, CurrentState: %6, NextState: %7

Fields #

Name	Description
`Client` Pointer
`Port` Pointer
`ResiliencyType` UInt32
`References` UInt64
`TransactionId` UInt32
`CurrentState` UInt32
`NextState` UInt32
`PrefixLength` UInt32
`Prefix` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 19,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:21.712Z",
    "version": 0
  },
  "event_data": {
    "Client": "0xFFFFF8016AA0F560",
    "CurrentState": 0,
    "NextState": 0,
    "Port": "0x0",
    "Prefix": "Reference",
    "PrefixLength": 9,
    "References": 2,
    "ResiliencyType": 0,
    "TransactionId": 0
  },
  "message": ""
}

Event ID 20: Resiliency Message ClientState, TransactionId: ClientStatus, ClientState: SendMessage, ClientStatus: UserModeMessage, SendMessage: Message, UserModeMessage: TransactionId.

Channel: Diagnostic
Task: ResiliencyMessage

Message #

Resiliency Message %1, TransactionId: %2, ClientState: %3, ClientStatus: %4, SendMessage: %5, UserModeMessage: %6

Fields #

Name	Description
`Message` Pointer
`TransactionId` UInt32
`ClientState` UInt32	1, TransactionId.
`ClientStatus` UInt32
`SendMessage` Boolean
`UserModeMessage` Boolean

Event ID 21: PDC recieved message from resiliency client Client.

Channel: Diagnostic
Task: ResiliencyReceive

Message #

PDC recieved message from resiliency client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 22: PDC sent message to resiliency client Client.

Channel: Diagnostic
Task: ResiliencySend

Message #

PDC sent message to resiliency client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 23: PDC resiliency client Client referenced.

Channel: Diagnostic
Level: 4
Task: ResiliencyReference

Message #

PDC resiliency client %2 referenced

Fields #

Name	Description
`ActivatorToken` Pointer
`Client` Pointer
`ReferenceDereference` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 23,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:21.712Z",
    "version": 0
  },
  "event_data": {
    "ActivatorToken": "0xFFFFC807BC631B20",
    "Client": "0xFFFFF8016AA0F560",
    "Reference/Dereference": 1
  },
  "message": ""
}

Example keys not documented in the fields table: Reference/Dereference

Event ID 24: PDC resiliency client Client dereferenced.

Channel: Diagnostic
Level: 4
Task: ResiliencyDereference

Message #

PDC resiliency client %2 dereferenced

Fields #

Name	Description
`ActivatorToken` Pointer
`Client` Pointer
`ReferenceDereference` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 24,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:22.256Z",
    "version": 0
  },
  "event_data": {
    "ActivatorToken": "0xFFFFC807BC631B20",
    "Client": "0xFFFFF8016AA0F6A0",
    "Reference/Dereference": 0
  },
  "message": ""
}

Example keys not documented in the fields table: Reference/Dereference

Event ID 25: PDC is entering Phase phase.

Channel: Diagnostic
Task: CsEnterPhase

Message #

PDC is entering %1 phase

Fields #

Name	Description
`Phase` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 26: PDC is exiting Phase phase with status: Status.

Channel: Diagnostic
Task: CsExitPhase

Message #

PDC is exiting %1 phase with status: %2

Fields #

Name	Description
`Phase` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 27: PDC received display notification: PDC_received_display_notification.

Channel: Diagnostic
Task: CsDisplayState

Message #

PDC received display notification: %1

Fields #

Name	Description
`On` UInt32

Event ID 28: PDC received monitor request ON/OFF: PDC_received_monitor_request_ONOFF, Console:Console.

Channel: Diagnostic
Task: CsMonitorRequestEnter

Message #

PDC received monitor request ON/OFF: %1, Console:%2

Fields #

Name	Description
`On` UInt32
`Console` UInt32

Event ID 29: PDC received monitor request exit at: PDC_received_monitor_request_exit_at, Status:Status.

Channel: Diagnostic
Task: CsMonitorRequestExit

Message #

PDC received monitor request exit at: %1, Status:%2

Fields #

Name	Description
`At` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 30: PDC monitor context - Session Count:ConnectedSessionCount, Console Session:ConsoleSessionId, Session: SessionId, Current On Request: OnRequestCurrent, Processed On Request: OnRequestProcessed, Curr...

Channel: Diagnostic
Task: CsMonitorContext

Description

PDC monitor context - Session Count:ConnectedSessionCount, Console Session:ConsoleSessionId, Session: SessionId, Current On Request: OnRequestCurrent, Processed On Request: OnRequestProcessed, Current Off Request: OffRequestCurrent, Processed Off Request: OffRequestProcessed.

Message #

PDC monitor context - Session Count:%1, Console Session:%2, Session: %3, Current On Request: %4, Processed On Request: %5,  Current Off Request: %6, Processed Off Request: %7

Fields #

Name	Description
`ConnectedSessionCount` UInt32
`ConsoleSessionId` UInt32
`SessionId` UInt32
`OnRequestCurrent` UInt32
`OnRequestProcessed` UInt32
`OffRequestCurrent` UInt32
`OffRequestProcessed` UInt32
`BlockingActive` Boolean
`BlockingScenarioCount` UInt32
`BlockingEscapeCount` UInt32
`BlockingPowerPressCount` UInt32

Event ID 31: PDC monitor handler activated at:PDC_monitor_handler_activated_at.

Channel: Diagnostic
Task: CsMonitorHandler

Message #

PDC monitor handler activated at:%1

Fields #

Name	Description
`At` UInt32

Event ID 32: PDC monitor control activated.

Channel: Diagnostic
Task: CsMonitorControl

Event ID 33: PDC power button handler activated.

Channel: Diagnostic
Task: CsPowerButtonHandler

Event ID 34: PDC power button consumed.

Channel: Diagnostic
Task: CsPowerButtonConsumed

Event ID 35: PDC Display notification handler activated.

Channel: Diagnostic
Task: CsDisplayNotification

Event ID 36: PDC PdcCsEnterExit handler activated at:PDC_PdcCsEnterExit_handler_activated_at.

Channel: Diagnostic
Task: CsEnterExit

Message #

PDC PdcCsEnterExit handler activated at:%1.

Fields #

Name	Description
`At` UInt32

Event ID 37: PDC Enable Input.

Channel: Diagnostic
Task: CsEnableInput

Event ID 38: PDC Disable Input.

Channel: Diagnostic
Task: CsDisableInput

Event ID 39: PDC Suspend/Resume handler activated.

Channel: Diagnostic
Task: CsSuspendResumeHandler

Description

PDC Suspend/Resume handler activated. :PDC_SuspendResume_handler_activated.

Message #

PDC Suspend/Resume handler activated. :%1.

Fields #

Name	Description
`Suspend` UInt32

Event ID 40: PDC Session handler - Session Connected, Console: SessionId, Connected: Console.

Channel: Diagnostic
Task: CsSessionConnect

Message #

PDC Session handler - Session %1, Console: %2, Connected: %3.

Fields #

Name	Description
`SessionId` UInt32
`Console` UInt32
`Connected` UInt32	1, Console.

Event ID 41: PDC Connection Event.

Channel: Diagnostic
Task: CsConnectionEvent

Event ID 42: PDC Initialization - AoAc: PDC_Initialization__AoAc, Status:Status.

Channel: Diagnostic
Task: PdcInit

Message #

PDC Initialization - AoAc: %1, Status:%2.

Fields #

Name	Description
`AoAc` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 43: Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Level: 4
Task: SuspendResumeRegistration

Message #

Suspend/Resume client in process %1 (session:%2) at %3 (PDC Identifier:%4) registered with status: %5

Fields #

Name	Description
`Process` Pointer
`Session` UInt32
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 43,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4120,
      "thread_id": 1036
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:48:28.514Z",
    "version": 0
  },
  "event_data": {
    "Client": "0xFFFFDC84CBFD3D70",
    "PdcId": 17,
    "Process": "0xFFFFC807B8B470C0",
    "Session": 0,
    "Status": 0
  },
  "message": ""
}

Event ID 44: Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Level: 4
Task: SuspendResumeDeregistration

Message #

Suspend/Resume client in process %1 (session:%2) at %3 (PDC Identifier:%4) deregistered with status: %5

Fields #

Name	Description
`Process` Pointer
`Session` UInt32
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 44,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4120,
      "thread_id": 12756
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:48:31.284Z",
    "version": 0
  },
  "event_data": {
    "Client": "0xFFFFDC84CBFD3D70",
    "PdcId": 17,
    "Process": "0xFFFFC807B8B470C0",
    "Session": 0,
    "Status": 0
  },
  "message": ""
}

Event ID 45: Suspend/reesume Client Client sent a request to PDC.

Channel: Diagnostic
Task: SuspendResumeReceive

Message #

Suspend/reesume Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 46: Response from PDC to suspend/resume client Client.

Channel: Diagnostic
Task: SuspendResumeSend

Message #

Response from PDC to suspend/resume client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 47: Suspend/resume message PowerEvent: Transaction id: Message, PowerEvent: TransactionId.

Channel: Diagnostic
Task: SuspendResumeMessage

Message #

Suspend/resume message %1: Transaction id: %2, PowerEvent: %3

Fields #

Name	Description
`Message` Pointer
`TransactionId` UInt32
`PowerEvent` UInt32	1: Transaction id.

Event ID 48: Suspend Entered

Channel: Diagnostic
Task: SuspendAppsEnter

Event ID 49: Suspend Exited

Channel: Diagnostic
Task: SuspendAppsExit

Event ID 50: Suspend Entered

Channel: Diagnostic
Task: SuspendSvcsEnter

Event ID 51: Suspend Exited

Channel: Diagnostic
Task: SuspendSvcsExit

Event ID 52: Suspend Entered

Channel: Diagnostic
Task: ResumeAppsEnter

Event ID 53: Suspend Exited

Channel: Diagnostic
Task: ResumeAppsExit

Event ID 54: Suspend Entered

Channel: Diagnostic
Task: ResumeSvcsEnter

Event ID 55: Suspend Exited

Channel: Diagnostic
Task: ResumeSvcsExit

Event ID 56: Suspend/Resume callback

Channel: Diagnostic
Task: SuspendResumeCallback

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 57: Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, IteratioType: IteratioType, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Power Event:Power_Event, WaitTime:Wai...

Channel: Diagnostic
Task: SuspendResumeStarted

Description

Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, IteratioType: IteratioType, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Power Event:Power_Event, WaitTime:WaitTime.

Message #

Suspend/resume started: Type: %1, Session: %2, IteratioType: %3, ClientContext:%4, PDC Sequence:%5, Power Event:%6, WaitTime:%7

Fields #

Name	Description
`Type` UInt32
`Session` UInt32
`Iteration` UInt32
`ClientContext` Pointer
`PdcSequence` UInt32
`Value` UInt32
`WaitTime` UInt32

Event ID 58: Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Channel: Diagnostic
Task: NotificationReceived

Message #

Notification received: Client: %1, Received sequence number:%2

Fields #

Name	Description
`Client` Pointer
`PdcSequence` UInt32

Event ID 59: Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Channel: Diagnostic
Task: InvalidNotification

Message #

Invalid notification: Client: %1, Expected sequence number:%2, Received sequence number:%3

Fields #

Name	Description
`Client` Pointer
`AssumedPdcSequence` UInt32
`ReceivedPdcSequence` UInt32

Event ID 60: Notification received from all clients: Status:Status.

Channel: Diagnostic
Task: SuspendeResumeAllClientsResponded

Message #

Notification received from all clients: Status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 61: PDC Suspend/Resume event handler activated.

Channel: Diagnostic
Task: CsSuspendResumeEvent

Description

PDC Suspend/Resume event handler activated. Session:Session, Suspend:Suspend, Apps:AppsSvcs, User:User.

Message #

PDC Suspend/Resume event handler activated. Session:%1, Suspend:%2, Apps:%3, User:%4.

Fields #

Name	Description
`Session` UInt32
`Suspend` UInt32
`AppsSvcs` UInt32
`User` UInt32

Event ID 62: Connected standby entered

Channel: Diagnostic
Task: EnterConnectedStandbyStart

Event ID 63: CS entered with times: PLM: DisableInputToPLMEntry, DAM: DisableInputToDAMEntry,Low Power Epoch: DisableInputToLowPowerEpochEntry.

Channel: Diagnostic
Task: EnterConnectedStandbyEnd

Message #

CS entered with times: PLM: %1, DAM: %2,Low Power Epoch: %3

Fields #

Name	Description
`DisableInputToPLMEntry` UInt32
`DisableInputToDAMEntry` UInt32
`DisableInputToLowPowerEpochEntry` UInt32
`PhaseTimesConnection` UInt32
`PhaseTimesPresence` UInt32
`PhaseTimesPlmAndResiliencyNotification` UInt32
`PhaseTimesMaintenance` UInt32
`PhaseTimesDamAndLowPower` UInt32

Event ID 64: Connected standby about the exit

Channel: Diagnostic
Task: ExitFromConnectedStandbyStart

Event ID 65: CS exited with times: Low Power Epoch: ResiliencyExitToLowPowerEpochEntry, DAM:ResiliencyExitToDAMEntry, PLM:ResiliencyExitToPLMEntry.

Channel: Diagnostic
Task: ExitFromConnectedStandbyEnd

Message #

CS exited with times: Low Power Epoch: %1, DAM:%2, PLM:%3

Fields #

Name	Description
`ResiliencyExitToLowPowerEpochEntry` UInt32
`ResiliencyExitToDAMEntry` UInt32
`ResiliencyExitToPLMEntry` UInt32
`PhaseTimesResiliencyAndResiliencyNotification` UInt32
`PhaseTimesLowPowerAndDam` UInt32
`PhaseTimesPlmAndPresence` UInt32
`PhaseTimesConnectionAndMaintenanceAndScreenOn` UInt32
`CsDuration` UInt32
`ScenarioInstanceId` UInt64

Event ID 66: Connected standby progression aborted

Channel: Diagnostic
Task: AbortConnectedStandbyStart

Event ID 67: Connected standby exited

Channel: Diagnostic
Task: AbortConnectedStandbyEnd

Event ID 68: PDC state changed: new: PDC_state_changed_new, old:old.

Channel: Diagnostic
Task: PdcStateChange

Message #

PDC state changed: new: %1, old:%2

Fields #

Name	Description
`NewState` UInt32
`OldState` UInt32

Event ID 69: Console Display Off request status:Console_Display_Off_request_status.

Channel: Diagnostic
Task: PdcScreenOffRequest

Message #

Console Display Off request status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 70: Console Display Off is disabled

Channel: Diagnostic
Task: PdcScreenOffDisabled

Event ID 71: Activator Client (PDC Identifier:PdcId) registered with status: ResiliencyClientCount.

Channel: Diagnostic
Task: ActivatorRegistrationRundown

Message #

Activator %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ResiliencyClientCount` UInt32
`ResiliencyContext` UInt16
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 72: Notification client Client (PDC Identifier:PdcId) registered with status: Type.

Channel: Diagnostic
Task: NotificationRegistrationRundown

Message #

Notification client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Type` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 73: Resiliency client Client (PDC Identifier:ClientReferences) registered with status: CurrentState.

Channel: Diagnostic
Task: ResiliencyClientRegistrationRundown

Message #

Resiliency client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`ClientReferences` UInt64
`CurrentState` UInt32
`Type` UInt32

Event ID 74: PDC Filter Input.

Channel: Diagnostic
Task: CsFilterInput

Event ID 75: Task client Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Task: TaskRegistration

Message #

Task client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 76: Task client Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: TaskDeregistration

Message #

Task client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 77: Task message Message: Status/Active: Status/Active.

Channel: Diagnostic
Task: TaskMessage

Message #

Task message %1: Status/Active: %2

Fields #

Name	Description
`Message` Pointer
`StatusActive` UInt32

Event ID 78: Task Client Client sent a request to PDC.

Channel: Diagnostic
Task: TaskReceive

Message #

Task Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 79: Response from PDC to task client Client.

Channel: Diagnostic
Task: TaskSend

Message #

Response from PDC to task client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 80: Rundown of PDC task client ReferenceCount - PDC identifier:Status, ReferenceCount:Name, Status:Client, Name:PdcId.

Channel: Diagnostic
Task: TaskRundown

Message #

Rundown of PDC task client %1 - PDC identifier:%2, ReferenceCount:%3, Status:%4, Name:%5

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ReferenceCount` UInt32	1 - PDC identifier.
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 81: PDC task client TaskClient referenced at csphase At.

Channel: Diagnostic
Task: TaskReference

Message #

PDC task client %1 referenced at csphase %2

Fields #

Name	Description
`TaskClient` Pointer
`At` UInt32
`ReferenceDereference` UInt32

Event ID 82: PDC task client TaskClient dereferenced at csphase At.

Channel: Diagnostic
Task: TaskDereference

Message #

PDC task client %1 dereferenced at csphase %2

Fields #

Name	Description
`TaskClient` Pointer
`At` UInt32
`ReferenceDereference` UInt32

Event ID 83: DisplayOffStart

Channel: Diagnostic
Task: DisplayOffStart

Fields #

Name	Description
`EnterReason` UInt32

Event ID 84: DisplayOffEnd

Channel: Diagnostic
Task: DisplayOffEnd

Event ID 85: DisplayOffAbort

Channel: Diagnostic
Task: DisplayOffAbort

Fields #

Name	Description
`AbortReason` UInt32

Event ID 86: EnterConnectedStandbyAbort

Channel: Diagnostic
Task: EnterConnectedStandbyAbort

Event ID 87: ActivationStatistics

Channel: Diagnostic
Task: ActivationStatistics

Fields #

Name	Description
`TimeActivated` UInt32
`ConnectedStandbyTimeAndActivationCount` UInt32
`ClientIdAndFlags` UInt32
`MaxActivationDuration` UInt32

Event ID 88: Scenario client Client (PDC Identifier:PdcId) registered with status: Status.

Channel: Diagnostic
Task: SpmClientRegistration

Message #

Scenario client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 89: Scenario client Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: SpmClientDeregistration

Message #

Scenario client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 90: Task message PdcMessage: Status/Active: Client.

Channel: Diagnostic
Task: SpmClientMessage

Message #

Task message %1: Status/Active: %2

Fields #

Name	Description
`PdcMessage` Pointer
`Client` Pointer
`PdcId` UInt32
`OperationStatus` UInt32	NTSTATUS reference
`Active` Boolean
`ReferenceCount` UInt32

Event ID 91: Scenario Client Client sent a request to PDC.

Channel: Diagnostic
Task: SpmClientReceive

Message #

Scenario Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 92: Response from PDC to scenario client Client.

Channel: Diagnostic
Task: SpmClientSend

Message #

Response from PDC to scenario client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 93: Rundown of PDC scenario client Active - PDC identifier:Status, Active:Name, Status:Client, Name:PdcId.

Channel: Diagnostic
Task: SpmClientRundown

Message #

Rundown of PDC scenario client %1 - PDC identifier:%2, Active:%3, Status:%4, Name:%5

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Active` Boolean	1 - PDC identifier.
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 94: SPM scenario Scenario state changed: new NextState, old PreviousState.

Channel: Diagnostic
Task: SpmScenarioStateChange

Message #

SPM scenario %1 state changed: new %3, old %2

Fields #

Name	Description
`Scenario` Pointer
`PreviousState` UInt8
`NextState` UInt8

Event ID 95: SPM scenario Scenario has ClientIdCount scenario clients of dependency type Type.

Channel: Diagnostic
Task: SpmScenarioDependencyRundown

Message #

SPM scenario %1 has %3 scenario clients of dependency type %2

Fields #

Name	Description
`Scenario` Pointer
`Type` UInt8
`ClientIdCount` UInt32
`ClientIdList` UInt8

Event ID 96: SPM scenario client TestClient info - Name:ClientNameLength TestClient:ClientId.

Channel: Diagnostic
Task: SpmClientInformationRundown

Message #

SPM scenario client %1 info - Name:%3 TestClient:%2

Fields #

Name	Description
`ClientId` UInt32
`TestClient` Boolean
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 97: Rundown of SPM scenario Flags - GUID:State, Flags:Name, State:Scenario, Name:ScenarioNameLength.

Channel: Diagnostic
Task: SpmScenarioRundown

Message #

Rundown of SPM scenario %1 - GUID:%2, Flags:%3, State:%4, Name:%6

Fields #

Name	Description
`Scenario` Pointer
`Guid` GUID
`Flags` UInt32	1 - GUID.
`State` UInt8
`ScenarioNameLength` UInt32
`ScenarioName` UnicodeString
`ProfileGuid` GUID

Event ID 98: Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Channel: Diagnostic
Task: SpmScenarioAccountingRundown

Message #

Rundown of SPM scenario %1 - DripsTime:%2, DripsCount:%3, PlatformIdleTranstions:%4, PlatformIdleCount:%5

Fields #

Name	Description
`Scenario` Pointer
`DripsTimeInUs` UInt64
`DripsTranstions` UInt64
`PlatformIdleTimeInUs` UInt64
`PlatformIdleTranstions` UInt64
`StateCount` UInt32
`States` Int32

Event ID 99: SPM client ID PdcId state changed: old PreviousState, new NextState.

Channel: Diagnostic
Task: SpmClientControlStateChange

Message #

SPM client ID %1 state changed: old %2, new %3

Fields #

Name	Description
`PdcId` UInt32
`PreviousState` UInt8
`NextState` UInt8

Event ID 100: SPM client ClientName (ID: PdcId) has current reference count ReferenceCount.

Channel: Diagnostic
Task: SpmClientControlStateRundown

Message #

SPM client %4 (ID: %1) has current reference count %2

Fields #

Name	Description
`PdcId` UInt32
`ReferenceCount` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 101: PhaseAccounting_V1

Channel: Diagnostic
Task: PhaseAccounting

Fields #

Name	Description
`DataCount` UInt32
`Data` Int8
`ScenarioInstanceId` UInt64

Event ID 102: ClientVerboseRundown

Channel: Diagnostic
Task: ClientVerboseRundown

Fields #

Name	Description
`ClientId` UInt32
`ClientFlags` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 103: ActivatorActiveTooLong

Channel: Diagnostic
Task: ActivatorActiveTooLong

Fields #

Name	Description
`TimeContinuouslyActive` UInt32
`ClientIdAndActivityTypeAndOnAc` UInt32
`UserClientProcess` UInt32

Event ID 104: Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Channel: Diagnostic
Task: SpmScenarioAccountingSnapshot

Message #

Rundown of SPM scenario %1 - DripsTime:%2, DripsCount:%3, PlatformIdleTranstions:%4, PlatformIdleCount:%5

Fields #

Name	Description
`Scenario` Pointer
`DripsTimeInUs` UInt64
`DripsTranstions` UInt64
`PlatformIdleTimeInUs` UInt64
`PlatformIdleTranstions` UInt64
`StateCount` UInt32
`States` Int32

Event ID 105: SpmScenarioActivityRundown

Channel: Diagnostic
Task: SpmScenarioActivityRundown

Fields #

Name	Description
`Scenario` Pointer
`ActiveCount` UInt64
`MaxActiveTime` UInt64
`MinActiveTime` UInt64
`TotalActiveTime` UInt64

Event ID 106: Ppm Profile client Client (PDC Identifier:PdcId, ProfileGuid:ProfileGuid) registered with status: Status.

Channel: Diagnostic
Task: PpmProfileClientRegistration

Message #

Ppm Profile client %1 (PDC Identifier:%2, ProfileGuid:%3) registered with status: %4

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ProfileGuid` GUID
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 107: PPM profile client Client (PDC Identifier:PdcId) deregistered with status: Status.

Channel: Diagnostic
Task: PpmProfileClientDeregistration

Message #

PPM profile client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 108: PDC PPM profile client Client acquired a referenced.

Channel: Diagnostic
Task: PpmProfileClientReference

Message #

PDC PPM profile client %1 acquired a referenced

Fields #

Name	Description
`Client` Pointer
`Acquire` Boolean

Event ID 109: PDC PPM profile client Client released a referenced.

Channel: Diagnostic
Task: PpmProfileClientDereference

Message #

PDC PPM profile client %1 released a referenced

Fields #

Name	Description
`Client` Pointer
`Acquire` Boolean

Event ID 110: PDCV2 ClientRegistered - ClientId=ClientId, status=Status.

Channel: Diagnostic
Task: PDCV2ActivationClientRegister

Message #

PDCV2 ClientRegistered - ClientId=%1, status=%2

Fields #

Name	Description
`ClientId` UInt32
`Status` UInt32	NTSTATUS reference
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 111: PDCV2 ClientActivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, maxDuration=ExpectedMaximumDurat...

Channel: Diagnostic
Level: 4
Task: PDCV2ActivationClientActivate

Description

PDCV2 ClientActivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, maxDuration=ExpectedMaximumDuration, status=Status.

Message #

PDCV2 ClientActivated - ClientId=%1(%3, %5)(activationHandle=%10) activationCount=%6, upCounter=%7, maxDuration=%8, status=%9

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ExpectedMaximumDuration` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 111,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:21.713Z",
    "version": 0
  },
  "event_data": {
    "ActivationCount": 1,
    "ActivationHandle": "0x1CE119FB7C0",
    "ActivationsUpCounter": 880,
    "ClientId": 77,
    "ExpectedMaximumDuration": 300,
    "ModuleName": "C:\\Windows\\SYSTEM32\\TelLib.dll",
    "ModuleNameLength": 30,
    "PdcVersion": 2,
    "Status": 0,
    "SubTaskLength": 21,
    "SubTaskName": "TelLib_AsimovUploader",
    "TaskName": "UTC Network Requests",
    "TaskNameLength": 20
  },
  "message": ""
}

Event ID 112: PDCV2 ClientRenewed - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) expectedMax=ExpectedMaximumDuration, activationCount=ActivationCount, upCounter=ActivationsUpCounte...

Channel: Diagnostic
Task: PDCV2ActivationClientRenewActivation

Description

PDCV2 ClientRenewed - ClientId=(, )(activationHandle=) expectedMax=, activationCount=, upCounter=, activationDuration=, renewalUpcount=, errorDetails=, status=.

Message #

PDCV2 ClientRenewed - ClientId=%1(%3, %5)(activationHandle=%13) expectedMax=%6, activationCount=%7, upCounter=%8, activationDuration=%9, renewalUpcount=%10, errorDetails=%11, status=%12

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ExpectedMaximumDuration` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`RenewalUpCounter` UInt32
`ErrorDetail` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Event ID 113: PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, Status=Status, activationDurat...

Channel: Diagnostic
Level: 4
Task: PDCV2ActivationClientDeactivate

Description

PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, Status=Status, activationDuration=ActivationDuration.

Message #

PDCV2 ClientDeactivated - ClientId=%1(%3, %5)(activationHandle=%10) activationCount=%6, upCounter=%7, Status=%9, activationDuration=%8

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 113,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4236,
      "thread_id": 7896
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 05:50:22.257Z",
    "version": 0
  },
  "event_data": {
    "ActivationCount": 0,
    "ActivationDuration": 532,
    "ActivationHandle": "0x1CE119FB7C0",
    "ActivationsUpCounter": 880,
    "BrokeredForPID": 0,
    "ClientId": 77,
    "ModuleName": "C:\\Windows\\SYSTEM32\\TelLib.dll",
    "ModuleNameLength": 30,
    "PdcVersion": 2,
    "Status": 0,
    "SubTaskLength": 21,
    "SubTaskName": "TelLib_AsimovUploader",
    "TaskName": "UTC Network Requests",
    "TaskNameLength": 20
  },
  "message": ""
}

Event ID 114: PDCV2 ClientUnregistered - ClientId=ClientId, status=Status.

Channel: Diagnostic
Task: PDCV2ActivationClientUnregister

Message #

PDCV2 ClientUnregistered - ClientId=%1, status=%2

Fields #

Name	Description
`ClientId` UInt32
`Status` UInt32	NTSTATUS reference
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 115: PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) was called with reason CallbackReason, activationCount=ActivationCount, upCounter=Activati...

Channel: Diagnostic
Task: PDCV2ActivationClientCallback

Description

PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) was called with reason CallbackReason, activationCount=ActivationCount, upCounter=ActivationsUpCounter, duration=ActivationDuration, Status=Status.

Message #

PDCV2 ActivationClientCallback ClientId=%1(%3, %5)(activationHandle=%11) was called with reason %6, activationCount=%7, upCounter=%8, duration=%9, Status=%10

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`CallbackReason` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`RenewalUpCounter` UInt32
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Event ID 116: PDCV2 SetBrokeredPID- ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) PID=BrokeredForPID, expectedMax=ExpectedMaximumDuration, activationCount=ActivationCount, upCounter...

Channel: Diagnostic
Task: PDCV2ActivationClientSetBrokeredProcessID

Description

PDCV2 SetBrokeredPID- ClientId=(, )(activationHandle=) PID=, expectedMax=, activationCount=, upCounter=, activationDuration=, renewalUpcount=, status=.

Message #

PDCV2 SetBrokeredPID- ClientId=%1(%3, %5)(activationHandle=%13) PID=%11, expectedMax=%6, activationCount=%7, upCounter=%8, activationDuration=%9, renewalUpcount=%10, status=%12

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ExpectedMaximumDuration` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`RenewalUpCounter` UInt32
`BrokeredForPID` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 117: Modern Standby exit due to PDC signal client

Channel: Diagnostic
Task: PDCSignalClassWakeDetails

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`RequestType` UInt32
`Reason` UInt32
`ClassId` GUID
`ProviderId` GUID
`DiagStringLength` UInt32
`DiagString` UnicodeString
`ScenarioInstanceIdV2` UInt64

Event ID 118: Modern Standby entry due to PDC signal client

Channel: Diagnostic
Task: PDCSignalClassMonitorOffDetails

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`RequestType` UInt32
`Reason` UInt32
`ClassId` GUID
`ProviderId` GUID
`DiagStringLength` UInt32
`DiagString` UnicodeString
`ScenarioInstanceIdV2` UInt64

Event ID 119: PDC phase Phase was referenced.

Channel: Diagnostic
Also via: realtime ETW trace
Task: PdcPhaseReferenced
Opcode: win:Info

Message #

PDC phase %1 was referenced

Fields #

Name	Description
`Phase` UInt8
`CountChange` Int32
`ReferenceCount` Int32
`WasWorkItemQueued` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PDC",
    "guid": "{A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 0,
    "task": 118,
    "opcode": 0,
    "keywords": "0x0000000000000880",
    "time_created": "2026-06-02T05:29:50.513+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20788
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CountChange": 1,
    "Phase": 0,
    "ReferenceCount": 3,
    "WasWorkItemQueued": false
  },
  "message": "PdcPhaseReferenced"
}

Event ID 120: PDC phase Phase was dereferenced.

Channel: Diagnostic
Also via: realtime ETW trace
Task: PdcPhaseDereferenced
Opcode: win:Info

Message #

PDC phase %1 was dereferenced

Fields #

Name	Description
`Phase` UInt8
`CountChange` Int32
`ReferenceCount` Int32
`WasWorkItemQueued` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PDC",
    "guid": "{A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}",
    "event_source_name": "",
    "event_id": 120,
    "version": 0,
    "level": 0,
    "task": 119,
    "opcode": 0,
    "keywords": "0x0000000000000880",
    "time_created": "2026-06-02T05:29:50.516+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20788
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CountChange": 1,
    "Phase": 0,
    "ReferenceCount": 2,
    "WasWorkItemQueued": false
  },
  "message": "PdcPhaseDereferenced"
}

Event ID 121: PDC phase PreviousTargetPhase was selected as target.

Channel: Diagnostic
Task: PdcTargetPhaseSelected

Message #

PDC phase %1 was selected as target

Fields #

Name	Description
`PreviousTargetPhase` UInt8
`NewTargetPhase` UInt8
`CurrentPhase` UInt8

Event ID 122: PDC target phase Phase was reached.

Channel: Diagnostic
Task: PdcTargetPhaseReached

Message #

PDC target phase %1 was reached

Fields #

Name	Description
`Phase` UInt8

Event ID 123: PDC phase Phase notifications state changed.

Channel: Diagnostic
Task: PdcPhaseNotificationsStateChanged

Message #

PDC phase %1 notifications state changed

Fields #

Name	Description
`Phase` UInt8
`PreviousState` UInt8
`NewState` UInt8

Event ID 124: PDC phase Phase rundown.

Channel: Diagnostic
Task: PdcPhaseRundown

Message #

PDC phase %1 rundown

Fields #

Name	Description
`Phase` UInt8
`ReferenceCount` Int32
`IsHandlerEngaged` Boolean
`NotificationsState` UInt8
`NotificationsStatus` UInt32
`PdcSequenceId` UInt32
`EntryWaitTimeInSeconds` UInt32
`EntryWatchdogTimeoutInSeconds` UInt32

Event ID 125: PDC phase Phase accounting rundown.

Channel: Diagnostic
Task: PdcPhaseAccountingRundown

Message #

PDC phase %1 accounting rundown

Fields #

Name	Description
`Phase` UInt8
`EngageCount` UInt32
`EngageHandlerTotalTime` UInt64
`EngageHandlerNotificationsTotalTime` UInt64
`DisengageCount` UInt32
`DisengageHandlerTotalTime` UInt64
`DisengageHandlerNotificationsTotalTime` UInt64
`PhaseTotalTime` UInt64

Event ID 126: PDC phase notification callback

Channel: Diagnostic
Task: PdcPhaseNotificationCallback

Fields #

Name	Description
`CurrentPhase` UInt8
`CurrentPhaseNotificationsState` UInt8
`CurrentPhaseNotificationsStatus` UInt32
`CurrentPhasePdcSequence` UInt32
`CallbackStatus` UInt32
`CallbackPdcSequence` UInt32

Event ID 127: PDC notified system is idle state SystemIdle.

Channel: Diagnostic
Level: 4
Task: PdcSIdleUpdateNotification

Message #

PDC notified system is idle state %1

Fields #

Name	Description
`SystemIdle` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 127,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 4,
      "thread_id": 12036
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:20.607Z",
    "version": 0
  },
  "event_data": {
    "SystemIdle": false
  },
  "message": ""
}

Event ID 128: A function in PDC received an invalid argument

Channel: Diagnostic
Task: PdcInvalidArgumentToFunction

Fields #

Name	Description
`FunctionNameLength` UInt32
`FunctionName` UnicodeString
`ArgumentNameLength` UInt32
`ArgumentName` UnicodeString

Event ID 129: SpmScenarioCreate

Channel: Diagnostic
Task: SpmScenarioCreate

Fields #

Name	Description
`Scenario` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 130: SpmScenarioDelete

Channel: Diagnostic
Task: SpmScenarioDelete

Fields #

Name	Description
`Scenario` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 131: GroupEnable

Channel: Diagnostic
Task: GroupEnable

Fields #

Name	Description
`GroupId` UInt32
`Enable` Boolean
`Updated` Boolean

Event ID 132: GroupRequest

Channel: Diagnostic
Level: Informational
Task: GroupRequest

Fields #

Name	Description
`GroupId` UInt32
`RequestCount` Int32
`Updated` Boolean

Example Event #

{
  "system": {
    "channel": "Microsoft-Windows-Kernel-Pdc/Diagnostic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 132,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 8992,
      "thread_id": 8508
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-PDC",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 01:47:30.337Z",
    "version": 0
  },
  "event_data": {
    "GroupId": 5,
    "RequestCount": 1,
    "Updated": true
  },
  "message": ""
}

Event ID 133: ClientPolicyRundown

Channel: Diagnostic
Task: ClientPolicyRundown

Fields #

Name	Description
`PolicyNameLength` UInt32
`PolicyName` UnicodeString
`PolicyActive` Boolean
`ClientRevocationCount` UInt32
`ClientRevocationPolicy` UInt8

Event ID 134: ClientPolicyRuleStatusChange

Channel: Diagnostic
Task: ClientPolicyRuleStatusChange

Fields #

Name	Description
`PolicyNameLength` UInt32
`PolicyName` UnicodeString
`PolicyActive` Boolean

Provenance

ETW provider GUID {A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}

Defined in Microsoft-Windows-Pdc.dll, which carries the event manifest.

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB