Microsoft-Windows-PDC

134 events across 1 channel

Event	Title	Channel	Sample
1	Activator Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N
2	Activator Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N
3	Notification client Client (PDC Identifier:PdcId) registered with status: …	Diagnostic	N
4	Notification client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N
5	Resiliency client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N
6	Resiliency client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N
7	Notification message ActivityType: Status/Active: Message, ActivityType: …	Diagnostic	N
8	Activators received acknowledgement: Status: …	Diagnostic	N
9	Activator client Client received acknowledgement: Status: State.	Diagnostic	N
10	Notification started: Type: Notification_started_Type, …	Diagnostic	N
11	Control notification: Type: Control_notification_Type, Flags:Flags.	Diagnostic	N
12	Invalid notification: Client: Invalid_notification_Client, Expected sequence …	Diagnostic	N
13	Notification received: Client: Notification_received_Client, Received sequence …	Diagnostic	N
14	Notification received from all clients: Status:Status.	Diagnostic	N
15	Callback activated for type: Status.	Diagnostic	N
16	Notification message: Client Control, Message: Status, Control: PDC_Sequence, …	Diagnostic	N
17	Activator Client Client sent a request to PDC.	Diagnostic	N
18	Response from PDC to activator Client Client.	Diagnostic	N
19	TransactionId resiliency client: client: Port, Port: ResiliencyType, …	Diagnostic	N
20	Resiliency Message ClientState, TransactionId: ClientStatus, ClientState: …	Diagnostic	N
21	PDC recieved message from resiliency client Client.	Diagnostic	N
22	PDC sent message to resiliency client Client.	Diagnostic	N
23	PDC resiliency client Client referenced.	Diagnostic	N
24	PDC resiliency client Client dereferenced.	Diagnostic	N
25	PDC is entering Phase phase.	Diagnostic	N
26	PDC is exiting Phase phase with status: Status.	Diagnostic	N
27	PDC received display notification: PDC_received_display_notification.	Diagnostic	N
28	PDC received monitor request ON/OFF: PDC_received_monitor_request_ONOFF, …	Diagnostic	N
29	PDC received monitor request exit at: PDC_received_monitor_request_exit_at, …	Diagnostic	N
30	PDC monitor context - Session Count:ConnectedSessionCount, Console …	Diagnostic	N
31	PDC monitor handler activated at:PDC_monitor_handler_activated_at.	Diagnostic	N
32	PDC monitor control activated.	Diagnostic	N
33	PDC power button handler activated.	Diagnostic	N
34	PDC power button consumed.	Diagnostic	N
35	PDC Display notification handler activated.	Diagnostic	N
36	PDC PdcCsEnterExit handler activated at:PDC_PdcCsEnterExit_handler_activated_at.	Diagnostic	N
37	PDC Enable Input.	Diagnostic	N
38	PDC Disable Input.	Diagnostic	N
39	PDC Suspend/Resume handler activated.	Diagnostic	N
40	PDC Session handler - Session Connected, Console: SessionId, Connected: Console.	Diagnostic	N
41	PDC Connection Event.	Diagnostic	N
42	PDC Initialization - AoAc: PDC_Initialization__AoAc, Status:Status.	Diagnostic	N
43	Suspend/Resume client in process Process (session:Session) at Client (PDC …	Diagnostic	N
44	Suspend/Resume client in process Process (session:Session) at Client (PDC …	Diagnostic	N
45	Suspend/reesume Client Client sent a request to PDC.	Diagnostic	N
46	Response from PDC to suspend/resume client Client.	Diagnostic	N
47	Suspend/resume message PowerEvent: Transaction id: Message, PowerEvent: …	Diagnostic	N
48	Suspend Entered	Diagnostic	N
49	Suspend Exited	Diagnostic	N
50	Suspend Entered	Diagnostic	N
51	Suspend Exited	Diagnostic	N
52	Suspend Entered	Diagnostic	N
53	Suspend Exited	Diagnostic	N
54	Suspend Entered	Diagnostic	N
55	Suspend Exited	Diagnostic	N
56	Suspend/Resume callback	Diagnostic	N
57	Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, …	Diagnostic	N
58	Notification received: Client: Notification_received_Client, Received sequence …	Diagnostic	N
59	Invalid notification: Client: Invalid_notification_Client, Expected sequence …	Diagnostic	N
60	Notification received from all clients: Status:Status.	Diagnostic	N
61	PDC Suspend/Resume event handler activated.	Diagnostic	N
62	Connected standby entered	Diagnostic	N
63	CS entered with times: PLM: DisableInputToPLMEntry, DAM: …	Diagnostic	N
64	Connected standby about the exit	Diagnostic	N
65	CS exited with times: Low Power Epoch: ResiliencyExitToLowPowerEpochEntry, …	Diagnostic	N
66	Connected standby progression aborted	Diagnostic	N
67	Connected standby exited	Diagnostic	N
68	PDC state changed: new: PDC_state_changed_new, old:old.	Diagnostic	N
69	Console Display Off request status:Console_Display_Off_request_status.	Diagnostic	N
70	Console Display Off is disabled	Diagnostic	N
71	Activator Client (PDC Identifier:PdcId) registered with status: …	Diagnostic	N
72	Notification client Client (PDC Identifier:PdcId) registered with status: Type.	Diagnostic	N
73	Resiliency client Client (PDC Identifier:ClientReferences) registered with …	Diagnostic	N
74	PDC Filter Input.	Diagnostic	N
75	Task client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N
76	Task client Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N
77	Task message Message: Status/Active: Status/Active.	Diagnostic	N
78	Task Client Client sent a request to PDC.	Diagnostic	N
79	Response from PDC to task client Client.	Diagnostic	N
80	Rundown of PDC task client ReferenceCount - PDC identifier:Status, …	Diagnostic	N
81	PDC task client TaskClient referenced at csphase At.	Diagnostic	N
82	PDC task client TaskClient dereferenced at csphase At.	Diagnostic	N
83	DisplayOffStart	Diagnostic	N
84	DisplayOffEnd	Diagnostic	N
85	DisplayOffAbort	Diagnostic	N
86	EnterConnectedStandbyAbort	Diagnostic	N
87	ActivationStatistics	Diagnostic	N
88	Scenario client Client (PDC Identifier:PdcId) registered with status: Status.	Diagnostic	N
89	Scenario client Client (PDC Identifier:PdcId) deregistered with status: Status.	Diagnostic	N
90	Task message PdcMessage: Status/Active: Client.	Diagnostic	N
91	Scenario Client Client sent a request to PDC.	Diagnostic	N
92	Response from PDC to scenario client Client.	Diagnostic	N
93	Rundown of PDC scenario client Active - PDC identifier:Status, Active:Name, …	Diagnostic	N
94	SPM scenario Scenario state changed: new NextState, old PreviousState.	Diagnostic	N
95	SPM scenario Scenario has ClientIdCount scenario clients of dependency type …	Diagnostic	N
96	SPM scenario client TestClient info - Name:ClientNameLength TestClient:ClientId.	Diagnostic	N
97	Rundown of SPM scenario Flags - GUID:State, Flags:Name, State:Scenario, …	Diagnostic	N
98	Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, …	Diagnostic	N
99	SPM client ID PdcId state changed: old PreviousState, new NextState.	Diagnostic	N
100	SPM client ClientName (ID: PdcId) has current reference count ReferenceCount.	Diagnostic	N
101	PhaseAccounting_V1	Diagnostic	N
102	ClientVerboseRundown	Diagnostic	N
103	ActivatorActiveTooLong	Diagnostic	N
104	Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, …	Diagnostic	N
105	SpmScenarioActivityRundown	Diagnostic	N
106	Ppm Profile client Client (PDC Identifier:PdcId, ProfileGuid:ProfileGuid) …	Diagnostic	N
107	PPM profile client Client (PDC Identifier:PdcId) deregistered with status: …	Diagnostic	N
108	PDC PPM profile client Client acquired a referenced.	Diagnostic	N
109	PDC PPM profile client Client released a referenced.	Diagnostic	N
110	PDCV2 ClientRegistered - ClientId=ClientId, status=Status.	Diagnostic	N
111	PDCV2 ClientActivated - ClientId=ClientId(TaskName, …	Diagnostic	N
112	PDCV2 ClientRenewed - ClientId=ClientId(TaskName, …	Diagnostic	N
113	PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, …	Diagnostic	N
114	PDCV2 ClientUnregistered - ClientId=ClientId, status=Status.	Diagnostic	N
115	PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, …	Diagnostic	N
116	PDCV2 SetBrokeredPID- ClientId=ClientId(TaskName, …	Diagnostic	N
117	Modern Standby exit due to PDC signal client	Diagnostic	N
118	Modern Standby entry due to PDC signal client	Diagnostic	N
119	PDC phase Phase was referenced.	Diagnostic	Y
120	PDC phase Phase was dereferenced.	Diagnostic	Y
121	PDC phase PreviousTargetPhase was selected as target.	Diagnostic	N
122	PDC target phase Phase was reached.	Diagnostic	N
123	PDC phase Phase notifications state changed.	Diagnostic	N
124	PDC phase Phase rundown.	Diagnostic	N
125	PDC phase Phase accounting rundown.	Diagnostic	N
126	PDC phase notification callback	Diagnostic	N
127	PDC notified system is idle state SystemIdle.	Diagnostic	N
128	A function in PDC received an invalid argument	Diagnostic	N
129	SpmScenarioCreate	Diagnostic	N
130	SpmScenarioDelete	Diagnostic	N
131	GroupEnable	Diagnostic	N
132	GroupRequest	Diagnostic	N
133	ClientPolicyRundown	Diagnostic	N
134	ClientPolicyRuleStatusChange	Diagnostic	N

Event ID 1: Activator Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorRegistration

Description

Activator Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Activator %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 2: Activator Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorDeregistration

Description

Activator Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Activator %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 3: Notification client Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationRegistration

Description

Notification client Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Notification client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 4: Notification client Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationDeregistration

Description

Notification client Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Notification client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 5: Resiliency client Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyClientRegistration

Description

Resiliency client Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Resiliency client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 6: Resiliency client Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyClientDeregistration

Description

Resiliency client Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Resiliency client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 7: Notification message ActivityType: Status/Active: Message, ActivityType: StatusActive.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorMessage

Description

Notification message ActivityType: Status/Active: Message, ActivityType: StatusActive.

Message #

Notification message %1: Status/Active: %2, ActivityType: %3

Fields #

Name	Description
`Message` Pointer
`StatusActive` UInt32
`ActivityType` UInt32	1: Status/Active.

Event ID 8: Activators received acknowledgement: Status: Activators_received_acknowledgement_Status, State: State.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorAcknowledgement

Description

Activators received acknowledgement: Status: Activators_received_acknowledgement_Status, State: State.

Message #

Activators received acknowledgement: Status: %1, State: %2

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`State` UInt32

Event ID 9: Activator client Client received acknowledgement: Status: State.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorClientAcknowledgement

Description

Activator client Client received acknowledgement: Status: State.

Message #

Activator client %1 received acknowledgement: Status: %2

Fields #

Name	Description
`Client` Pointer
`State` UInt32

Event ID 10: Notification started: Type: Notification_started_Type, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Value:Value, WaitTime:WaitTime.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationStarted

Description

Notification started: Type: Notification_started_Type, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Value:Value, WaitTime:WaitTime.

Message #

Notification started: Type: %1, ClientContext:%2, PDC Sequence:%3, Value:%4, WaitTime:%5

Fields #

Name	Description
`Type` UInt32
`ClientContext` Pointer
`PdcSequence` UInt32
`Value` UInt32
`WaitTime` UInt32

Event ID 11: Control notification: Type: Control_notification_Type, Flags:Flags.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ControlNotification

Description

Control notification: Type: Control_notification_Type, Flags:Flags.

Message #

Control notification: Type: %1, Flags:%2

Fields #

Name	Description
`Type` UInt32
`Flags` UInt32

Event ID 12: Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: InvalidNotification

Description

Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Message #

Invalid notification: Client: %1, Expected sequence number:%2, Received sequence number:%3

Fields #

Name	Description
`Client` Pointer
`AssumedPdcSequence` UInt32
`ReceivedPdcSequence` UInt32

Event ID 13: Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationReceived

Description

Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Message #

Notification received: Client: %1, Received sequence number:%2

Fields #

Name	Description
`Client` Pointer
`PdcSequence` UInt32

Event ID 14: Notification received from all clients: Status:Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationAllClientResponded

Description

Notification received from all clients: Status:Status.

Message #

Notification received from all clients: Status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 15: Callback activated for type: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationCallback

Description

Callback activated for type: Status.

Message #

Callback activated for type: %1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 16: Notification message: Client Control, Message: Status, Control: PDC_Sequence, Status: Client; PDC Sequence: Message.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationMessage

Description

Notification message: Client Control, Message: Status, Control: PDC_Sequence, Status: Client; PDC Sequence: Message.

Message #

Notification message: Client %1, Message: %2, Control: %3, Status: %4; PDC Sequence: %5

Fields #

Name	Description
`Client` Pointer
`Message` Pointer
`Control` UInt32	1, Message.
`Status` UInt32	NTSTATUS reference
`PdcSequence` UInt32

Event ID 17: Activator Client Client sent a request to PDC.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorReceive

Description

Activator Client Client sent a request to PDC.

Message #

Activator Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 18: Response from PDC to activator Client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorSend

Description

Response from PDC to activator Client Client.

Message #

Response from PDC to activator Client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 19: TransactionId resiliency client: client: Port, Port: ResiliencyType, ResiliencyType: ClientReferences, ClientReferences: Transation_Id, Transation Id: CurrentState, CurrentState: NextState, NextSta...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyClient

Description

TransactionId resiliency client: client: Port, Port: ResiliencyType, ResiliencyType: ClientReferences, ClientReferences: Transation_Id, Transation Id: CurrentState, CurrentState: NextState, NextState: Client.

Message #

%9 resiliency client: client: %1, Port: %2, ResiliencyType: %3, ClientReferences: %4, Transation Id: %5, CurrentState: %6, NextState: %7

Fields #

Name	Description
`Client` Pointer
`Port` Pointer
`ResiliencyType` UInt32
`References` UInt64
`TransactionId` UInt32
`CurrentState` UInt32
`NextState` UInt32
`PrefixLength` UInt32
`Prefix` UnicodeString

Event ID 20: Resiliency Message ClientState, TransactionId: ClientStatus, ClientState: SendMessage, ClientStatus: UserModeMessage, SendMessage: Message, UserModeMessage: TransactionId.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyMessage

Description

Resiliency Message ClientState, TransactionId: ClientStatus, ClientState: SendMessage, ClientStatus: UserModeMessage, SendMessage: Message, UserModeMessage: TransactionId.

Message #

Resiliency Message %1, TransactionId: %2, ClientState: %3, ClientStatus: %4, SendMessage: %5, UserModeMessage: %6

Fields #

Name	Description
`Message` Pointer
`TransactionId` UInt32
`ClientState` UInt32	1, TransactionId.
`ClientStatus` UInt32
`SendMessage` Boolean
`UserModeMessage` Boolean

Event ID 21: PDC recieved message from resiliency client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyReceive

Description

PDC recieved message from resiliency client Client.

Message #

PDC recieved message from resiliency client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 22: PDC sent message to resiliency client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencySend

Description

PDC sent message to resiliency client Client.

Message #

PDC sent message to resiliency client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 23: PDC resiliency client Client referenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyReference

Description

PDC resiliency client Client referenced.

Message #

PDC resiliency client %2 referenced

Fields #

Name	Description
`ActivatorToken` Pointer
`Client` Pointer
`ReferenceDereference` UInt32

Event ID 24: PDC resiliency client Client dereferenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyDereference

Description

PDC resiliency client Client dereferenced.

Message #

PDC resiliency client %2 dereferenced

Fields #

Name	Description
`ActivatorToken` Pointer
`Client` Pointer
`ReferenceDereference` UInt32

Event ID 25: PDC is entering Phase phase.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsEnterPhase

Description

PDC is entering Phase phase.

Message #

PDC is entering %1 phase

Fields #

Name	Description
`Phase` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 26: PDC is exiting Phase phase with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsExitPhase

Description

PDC is exiting Phase phase with status: Status.

Message #

PDC is exiting %1 phase with status: %2

Fields #

Name	Description
`Phase` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 27: PDC received display notification: PDC_received_display_notification.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsDisplayState

Description

PDC received display notification: PDC_received_display_notification.

Message #

PDC received display notification: %1

Fields #

Name	Description
`On` UInt32

Event ID 28: PDC received monitor request ON/OFF: PDC_received_monitor_request_ONOFF, Console:Console.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsMonitorRequestEnter

Description

PDC received monitor request ON/OFF: PDC_received_monitor_request_ONOFF, Console:Console.

Message #

PDC received monitor request ON/OFF: %1, Console:%2

Fields #

Name	Description
`On` UInt32
`Console` UInt32

Event ID 29: PDC received monitor request exit at: PDC_received_monitor_request_exit_at, Status:Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsMonitorRequestExit

Description

PDC received monitor request exit at: PDC_received_monitor_request_exit_at, Status:Status.

Message #

PDC received monitor request exit at: %1, Status:%2

Fields #

Name	Description
`At` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 30: PDC monitor context - Session Count:ConnectedSessionCount, Console Session:ConsoleSessionId, Session: SessionId, Current On Request: OnRequestCurrent, Processed On Request: OnRequestProcessed, Curr...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsMonitorContext

Description

PDC monitor context - Session Count:ConnectedSessionCount, Console Session:ConsoleSessionId, Session: SessionId, Current On Request: OnRequestCurrent, Processed On Request: OnRequestProcessed, Current Off Request: OffRequestCurrent, Processed Off Request: OffRequestProcessed.

Message #

PDC monitor context - Session Count:%1, Console Session:%2, Session: %3, Current On Request: %4, Processed On Request: %5,  Current Off Request: %6, Processed Off Request: %7

Fields #

Name	Description
`ConnectedSessionCount` UInt32
`ConsoleSessionId` UInt32
`SessionId` UInt32
`OnRequestCurrent` UInt32
`OnRequestProcessed` UInt32
`OffRequestCurrent` UInt32
`OffRequestProcessed` UInt32
`BlockingActive` Boolean
`BlockingScenarioCount` UInt32
`BlockingEscapeCount` UInt32
`BlockingPowerPressCount` UInt32

Event ID 31: PDC monitor handler activated at:PDC_monitor_handler_activated_at.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsMonitorHandler

Description

PDC monitor handler activated at:PDC_monitor_handler_activated_at.

Message #

PDC monitor handler activated at:%1

Fields #

Name	Description
`At` UInt32

Event ID 32: PDC monitor control activated.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsMonitorControl

Description

PDC monitor control activated.

Message #

PDC monitor control activated.

Event ID 33: PDC power button handler activated.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsPowerButtonHandler

Description

PDC power button handler activated.

Message #

PDC power button handler activated.

Event ID 34: PDC power button consumed.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsPowerButtonConsumed

Description

PDC power button consumed.

Message #

PDC power button consumed.

Event ID 35: PDC Display notification handler activated.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsDisplayNotification

Description

PDC Display notification handler activated.

Message #

PDC Display notification handler activated.

Event ID 36: PDC PdcCsEnterExit handler activated at:PDC_PdcCsEnterExit_handler_activated_at.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsEnterExit

Description

PDC PdcCsEnterExit handler activated at:PDC_PdcCsEnterExit_handler_activated_at.

Message #

PDC PdcCsEnterExit handler activated at:%1.

Fields #

Name	Description
`At` UInt32

Event ID 37: PDC Enable Input.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsEnableInput

Description

PDC Enable Input.

Message #

PDC Enable Input.

Event ID 38: PDC Disable Input.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsDisableInput

Description

PDC Disable Input.

Message #

PDC Disable Input.

Event ID 39: PDC Suspend/Resume handler activated.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsSuspendResumeHandler

Description

PDC Suspend/Resume handler activated. :PDC_SuspendResume_handler_activated.

Message #

PDC Suspend/Resume handler activated. :%1.

Fields #

Name	Description
`Suspend` UInt32

Event ID 40: PDC Session handler - Session Connected, Console: SessionId, Connected: Console.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsSessionConnect

Description

PDC Session handler - Session Connected, Console: SessionId, Connected: Console.

Message #

PDC Session handler - Session %1, Console: %2, Connected: %3.

Fields #

Name	Description
`SessionId` UInt32
`Console` UInt32
`Connected` UInt32	1, Console.

Event ID 41: PDC Connection Event.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsConnectionEvent

Description

PDC Connection Event.

Message #

PDC Connection Event.

Event ID 42: PDC Initialization - AoAc: PDC_Initialization__AoAc, Status:Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcInit

Description

PDC Initialization - AoAc: PDC_Initialization__AoAc, Status:Status.

Message #

PDC Initialization - AoAc: %1, Status:%2.

Fields #

Name	Description
`AoAc` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 43: Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeRegistration

Description

Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Suspend/Resume client in process %1 (session:%2) at %3 (PDC Identifier:%4) registered with status: %5

Fields #

Name	Description
`Process` Pointer
`Session` UInt32
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 44: Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeDeregistration

Description

Suspend/Resume client in process Process (session:Session) at Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Suspend/Resume client in process %1 (session:%2) at %3 (PDC Identifier:%4) deregistered with status: %5

Fields #

Name	Description
`Process` Pointer
`Session` UInt32
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 45: Suspend/reesume Client Client sent a request to PDC.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeReceive

Description

Suspend/reesume Client Client sent a request to PDC.

Message #

Suspend/reesume Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 46: Response from PDC to suspend/resume client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeSend

Description

Response from PDC to suspend/resume client Client.

Message #

Response from PDC to suspend/resume client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 47: Suspend/resume message PowerEvent: Transaction id: Message, PowerEvent: TransactionId.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeMessage

Description

Suspend/resume message PowerEvent: Transaction id: Message, PowerEvent: TransactionId.

Message #

Suspend/resume message %1: Transaction id: %2, PowerEvent: %3

Fields #

Name	Description
`Message` Pointer
`TransactionId` UInt32
`PowerEvent` UInt32	1: Transaction id.

Event ID 48: Suspend Entered

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendAppsEnter

Description

Suspend Entered.

Message #

Suspend Entered

Event ID 49: Suspend Exited

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendAppsExit

Description

Suspend Exited.

Message #

Suspend Exited

Event ID 50: Suspend Entered

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendSvcsEnter

Description

Suspend Entered.

Message #

Suspend Entered

Event ID 51: Suspend Exited

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendSvcsExit

Description

Suspend Exited.

Message #

Suspend Exited

Event ID 52: Suspend Entered

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResumeAppsEnter

Description

Suspend Entered.

Message #

Suspend Entered

Event ID 53: Suspend Exited

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResumeAppsExit

Description

Suspend Exited.

Message #

Suspend Exited

Event ID 54: Suspend Entered

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResumeSvcsEnter

Description

Suspend Entered.

Message #

Suspend Entered

Event ID 55: Suspend Exited

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResumeSvcsExit

Description

Suspend Exited.

Message #

Suspend Exited

Event ID 56: Suspend/Resume callback

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeCallback

Description

Suspend/Resume callback.

Message #

Suspend/Resume callback

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 57: Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, IteratioType: IteratioType, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Power Event:Power_Event, WaitTime:Wai...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendResumeStarted

Description

Suspend/resume started: Type: Suspendresume_started_Type, Session: Session, IteratioType: IteratioType, ClientContext:ClientContext, PDC Sequence:PDC_Sequence, Power Event:Power_Event, WaitTime:WaitTime.

Message #

Suspend/resume started: Type: %1, Session: %2, IteratioType: %3, ClientContext:%4, PDC Sequence:%5, Power Event:%6, WaitTime:%7

Fields #

Name	Description
`Type` UInt32
`Session` UInt32
`Iteration` UInt32
`ClientContext` Pointer
`PdcSequence` UInt32
`Value` UInt32
`WaitTime` UInt32

Event ID 58: Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationReceived

Description

Notification received: Client: Notification_received_Client, Received sequence number:Received_sequence_number.

Message #

Notification received: Client: %1, Received sequence number:%2

Fields #

Name	Description
`Client` Pointer
`PdcSequence` UInt32

Event ID 59: Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: InvalidNotification

Description

Invalid notification: Client: Invalid_notification_Client, Expected sequence number:Expected_sequence_number, Received sequence number:Received_sequence_number.

Message #

Invalid notification: Client: %1, Expected sequence number:%2, Received sequence number:%3

Fields #

Name	Description
`Client` Pointer
`AssumedPdcSequence` UInt32
`ReceivedPdcSequence` UInt32

Event ID 60: Notification received from all clients: Status:Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SuspendeResumeAllClientsResponded

Description

Notification received from all clients: Status:Status.

Message #

Notification received from all clients: Status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 61: PDC Suspend/Resume event handler activated.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsSuspendResumeEvent

Description

PDC Suspend/Resume event handler activated. Session:Session, Suspend:Suspend, Apps:AppsSvcs, User:User.

Message #

PDC Suspend/Resume event handler activated. Session:%1, Suspend:%2, Apps:%3, User:%4.

Fields #

Name	Description
`Session` UInt32
`Suspend` UInt32
`AppsSvcs` UInt32
`User` UInt32

Event ID 62: Connected standby entered

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: EnterConnectedStandbyStart

Description

Connected standby entered.

Message #

Connected standby entered

Event ID 63: CS entered with times: PLM: DisableInputToPLMEntry, DAM: DisableInputToDAMEntry,Low Power Epoch: DisableInputToLowPowerEpochEntry.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: EnterConnectedStandbyEnd

Description

CS entered with times: PLM: DisableInputToPLMEntry, DAM: DisableInputToDAMEntry,Low Power Epoch: DisableInputToLowPowerEpochEntry.

Message #

CS entered with times: PLM: %1, DAM: %2,Low Power Epoch: %3

Fields #

Name	Description
`DisableInputToPLMEntry` UInt32
`DisableInputToDAMEntry` UInt32
`DisableInputToLowPowerEpochEntry` UInt32
`PhaseTimesConnection` UInt32
`PhaseTimesPresence` UInt32
`PhaseTimesPlmAndResiliencyNotification` UInt32
`PhaseTimesMaintenance` UInt32
`PhaseTimesDamAndLowPower` UInt32

Event ID 64: Connected standby about the exit

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ExitFromConnectedStandbyStart

Description

Connected standby about the exit.

Message #

Connected standby about the exit

Event ID 65: CS exited with times: Low Power Epoch: ResiliencyExitToLowPowerEpochEntry, DAM:ResiliencyExitToDAMEntry, PLM:ResiliencyExitToPLMEntry.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ExitFromConnectedStandbyEnd

Description

CS exited with times: Low Power Epoch: ResiliencyExitToLowPowerEpochEntry, DAM:ResiliencyExitToDAMEntry, PLM:ResiliencyExitToPLMEntry.

Message #

CS exited with times: Low Power Epoch: %1, DAM:%2, PLM:%3

Fields #

Name	Description
`ResiliencyExitToLowPowerEpochEntry` UInt32
`ResiliencyExitToDAMEntry` UInt32
`ResiliencyExitToPLMEntry` UInt32
`PhaseTimesResiliencyAndResiliencyNotification` UInt32
`PhaseTimesLowPowerAndDam` UInt32
`PhaseTimesPlmAndPresence` UInt32
`PhaseTimesConnectionAndMaintenanceAndScreenOn` UInt32
`CsDuration` UInt32
`ScenarioInstanceId` UInt64

Event ID 66: Connected standby progression aborted

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: AbortConnectedStandbyStart

Description

Connected standby progression aborted.

Message #

Connected standby progression aborted

Event ID 67: Connected standby exited

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: AbortConnectedStandbyEnd

Description

Connected standby exited.

Message #

Connected standby exited

Event ID 68: PDC state changed: new: PDC_state_changed_new, old:old.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcStateChange

Description

PDC state changed: new: PDC_state_changed_new, old:old.

Message #

PDC state changed: new: %1, old:%2

Fields #

Name	Description
`NewState` UInt32
`OldState` UInt32

Event ID 69: Console Display Off request status:Console_Display_Off_request_status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcScreenOffRequest

Description

Console Display Off request status:Console_Display_Off_request_status.

Message #

Console Display Off request status:%1

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference

Event ID 70: Console Display Off is disabled

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcScreenOffDisabled

Description

Console Display Off is disabled.

Message #

Console Display Off is disabled

Event ID 71: Activator Client (PDC Identifier:PdcId) registered with status: ResiliencyClientCount.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorRegistrationRundown

Description

Activator Client (PDC Identifier:PdcId) registered with status: ResiliencyClientCount.

Message #

Activator %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ResiliencyClientCount` UInt32
`ResiliencyContext` UInt16
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 72: Notification client Client (PDC Identifier:PdcId) registered with status: Type.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: NotificationRegistrationRundown

Description

Notification client Client (PDC Identifier:PdcId) registered with status: Type.

Message #

Notification client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Type` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 73: Resiliency client Client (PDC Identifier:ClientReferences) registered with status: CurrentState.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ResiliencyClientRegistrationRundown

Description

Resiliency client Client (PDC Identifier:ClientReferences) registered with status: CurrentState.

Message #

Resiliency client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`ClientReferences` UInt64
`CurrentState` UInt32
`Type` UInt32

Event ID 74: PDC Filter Input.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: CsFilterInput

Description

PDC Filter Input.

Message #

PDC Filter Input.

Event ID 75: Task client Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskRegistration

Description

Task client Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Task client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 76: Task client Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskDeregistration

Description

Task client Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Task client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 77: Task message Message: Status/Active: Status/Active.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskMessage

Description

Task message Message: Status/Active: Status/Active.

Message #

Task message %1: Status/Active: %2

Fields #

Name	Description
`Message` Pointer
`StatusActive` UInt32

Event ID 78: Task Client Client sent a request to PDC.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskReceive

Description

Task Client Client sent a request to PDC.

Message #

Task Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 79: Response from PDC to task client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskSend

Description

Response from PDC to task client Client.

Message #

Response from PDC to task client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 80: Rundown of PDC task client ReferenceCount - PDC identifier:Status, ReferenceCount:Name, Status:Client, Name:PdcId.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskRundown

Description

Rundown of PDC task client ReferenceCount - PDC identifier:Status, ReferenceCount:Name, Status:Client, Name:PdcId.

Message #

Rundown of PDC task client %1 - PDC identifier:%2, ReferenceCount:%3, Status:%4, Name:%5

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ReferenceCount` UInt32	1 - PDC identifier.
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 81: PDC task client TaskClient referenced at csphase At.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskReference

Description

PDC task client TaskClient referenced at csphase At.

Message #

PDC task client %1 referenced at csphase %2

Fields #

Name	Description
`TaskClient` Pointer
`At` UInt32
`ReferenceDereference` UInt32

Event ID 82: PDC task client TaskClient dereferenced at csphase At.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: TaskDereference

Description

PDC task client TaskClient dereferenced at csphase At.

Message #

PDC task client %1 dereferenced at csphase %2

Fields #

Name	Description
`TaskClient` Pointer
`At` UInt32
`ReferenceDereference` UInt32

Event ID 83: DisplayOffStart

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: DisplayOffStart

Fields #

Name	Description
`EnterReason` UInt32

Event ID 84: DisplayOffEnd

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: DisplayOffEnd

Event ID 85: DisplayOffAbort

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: DisplayOffAbort

Fields #

Name	Description
`AbortReason` UInt32

Event ID 86: EnterConnectedStandbyAbort

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: EnterConnectedStandbyAbort

Event ID 87: ActivationStatistics

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivationStatistics

Fields #

Name	Description
`TimeActivated` UInt32
`ConnectedStandbyTimeAndActivationCount` UInt32
`ClientIdAndFlags` UInt32
`MaxActivationDuration` UInt32

Event ID 88: Scenario client Client (PDC Identifier:PdcId) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientRegistration

Description

Scenario client Client (PDC Identifier:PdcId) registered with status: Status.

Message #

Scenario client %1 (PDC Identifier:%2) registered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 89: Scenario client Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientDeregistration

Description

Scenario client Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

Scenario client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 90: Task message PdcMessage: Status/Active: Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientMessage

Description

Task message PdcMessage: Status/Active: Client.

Message #

Task message %1: Status/Active: %2

Fields #

Name	Description
`PdcMessage` Pointer
`Client` Pointer
`PdcId` UInt32
`OperationStatus` UInt32	NTSTATUS reference
`Active` Boolean
`ReferenceCount` UInt32

Event ID 91: Scenario Client Client sent a request to PDC.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientReceive

Description

Scenario Client Client sent a request to PDC.

Message #

Scenario Client %1 sent a request to PDC

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 92: Response from PDC to scenario client Client.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientSend

Description

Response from PDC to scenario client Client.

Message #

Response from PDC to scenario client %1

Fields #

Name	Description
`Client` Pointer
`SendReceive` UInt32

Event ID 93: Rundown of PDC scenario client Active - PDC identifier:Status, Active:Name, Status:Client, Name:PdcId.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientRundown

Description

Rundown of PDC scenario client Active - PDC identifier:Status, Active:Name, Status:Client, Name:PdcId.

Message #

Rundown of PDC scenario client %1 - PDC identifier:%2, Active:%3, Status:%4, Name:%5

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Active` Boolean	1 - PDC identifier.
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 94: SPM scenario Scenario state changed: new NextState, old PreviousState.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioStateChange

Description

SPM scenario Scenario state changed: new NextState, old PreviousState.

Message #

SPM scenario %1 state changed: new %3, old %2

Fields #

Name	Description
`Scenario` Pointer
`PreviousState` UInt8
`NextState` UInt8

Event ID 95: SPM scenario Scenario has ClientIdCount scenario clients of dependency type Type.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioDependencyRundown

Description

SPM scenario Scenario has ClientIdCount scenario clients of dependency type Type.

Message #

SPM scenario %1 has %3 scenario clients of dependency type %2

Fields #

Name	Description
`Scenario` Pointer
`Type` UInt8
`ClientIdCount` UInt32
`ClientIdList` UInt8

Event ID 96: SPM scenario client TestClient info - Name:ClientNameLength TestClient:ClientId.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientInformationRundown

Description

SPM scenario client TestClient info - Name:ClientNameLength TestClient:ClientId.

Message #

SPM scenario client %1 info - Name:%3 TestClient:%2

Fields #

Name	Description
`ClientId` UInt32
`TestClient` Boolean
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 97: Rundown of SPM scenario Flags - GUID:State, Flags:Name, State:Scenario, Name:ScenarioNameLength.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioRundown

Description

Rundown of SPM scenario Flags - GUID:State, Flags:Name, State:Scenario, Name:ScenarioNameLength.

Message #

Rundown of SPM scenario %1 - GUID:%2, Flags:%3, State:%4, Name:%6

Fields #

Name	Description
`Scenario` Pointer
`Guid` GUID
`Flags` UInt32	1 - GUID.
`State` UInt8
`ScenarioNameLength` UInt32
`ScenarioName` UnicodeString
`ProfileGuid` GUID

Event ID 98: Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioAccountingRundown

Description

Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Message #

Rundown of SPM scenario %1 - DripsTime:%2, DripsCount:%3, PlatformIdleTranstions:%4, PlatformIdleCount:%5

Fields #

Name	Description
`Scenario` Pointer
`DripsTimeInUs` UInt64
`DripsTranstions` UInt64
`PlatformIdleTimeInUs` UInt64
`PlatformIdleTranstions` UInt64
`StateCount` UInt32
`States` Int32

Event ID 99: SPM client ID PdcId state changed: old PreviousState, new NextState.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientControlStateChange

Description

SPM client ID PdcId state changed: old PreviousState, new NextState.

Message #

SPM client ID %1 state changed: old %2, new %3

Fields #

Name	Description
`PdcId` UInt32
`PreviousState` UInt8
`NextState` UInt8

Event ID 100: SPM client ClientName (ID: PdcId) has current reference count ReferenceCount.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmClientControlStateRundown

Description

SPM client ClientName (ID: PdcId) has current reference count ReferenceCount.

Message #

SPM client %4 (ID: %1) has current reference count %2

Fields #

Name	Description
`PdcId` UInt32
`ReferenceCount` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 101: PhaseAccounting_V1

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PhaseAccounting

Fields #

Name	Description
`DataCount` UInt32
`Data` Int8
`ScenarioInstanceId` UInt64

Event ID 102: ClientVerboseRundown

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ClientVerboseRundown

Fields #

Name	Description
`ClientId` UInt32
`ClientFlags` UInt32
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 103: ActivatorActiveTooLong

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ActivatorActiveTooLong

Fields #

Name	Description
`TimeContinuouslyActive` UInt32
`ClientIdAndActivityTypeAndOnAc` UInt32
`UserClientProcess` UInt32

Event ID 104: Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioAccountingSnapshot

Description

Rundown of SPM scenario DripsCount - DripsTime:PlatformIdleTranstions, DripsCount:PlatformIdleCount, PlatformIdleTranstions:Scenario, PlatformIdleCount:DripsTimeInUs.

Message #

Rundown of SPM scenario %1 - DripsTime:%2, DripsCount:%3, PlatformIdleTranstions:%4, PlatformIdleCount:%5

Fields #

Name	Description
`Scenario` Pointer
`DripsTimeInUs` UInt64
`DripsTranstions` UInt64
`PlatformIdleTimeInUs` UInt64
`PlatformIdleTranstions` UInt64
`StateCount` UInt32
`States` Int32

Event ID 105: SpmScenarioActivityRundown

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioActivityRundown

Fields #

Name	Description
`Scenario` Pointer
`ActiveCount` UInt64
`MaxActiveTime` UInt64
`MinActiveTime` UInt64
`TotalActiveTime` UInt64

Event ID 106: Ppm Profile client Client (PDC Identifier:PdcId, ProfileGuid:ProfileGuid) registered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PpmProfileClientRegistration

Description

Ppm Profile client Client (PDC Identifier:PdcId, ProfileGuid:ProfileGuid) registered with status: Status.

Message #

Ppm Profile client %1 (PDC Identifier:%2, ProfileGuid:%3) registered with status: %4

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`ProfileGuid` GUID
`Status` UInt32	NTSTATUS reference
`ClientNameLength` UInt32
`ClientName` UnicodeString

Event ID 107: PPM profile client Client (PDC Identifier:PdcId) deregistered with status: Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PpmProfileClientDeregistration

Description

PPM profile client Client (PDC Identifier:PdcId) deregistered with status: Status.

Message #

PPM profile client %1 (PDC Identifier:%2) deregistered with status: %3

Fields #

Name	Description
`Client` Pointer
`PdcId` UInt32
`Status` UInt32	NTSTATUS reference

Event ID 108: PDC PPM profile client Client acquired a referenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PpmProfileClientReference

Description

PDC PPM profile client Client acquired a referenced.

Message #

PDC PPM profile client %1 acquired a referenced

Fields #

Name	Description
`Client` Pointer
`Acquire` Boolean

Event ID 109: PDC PPM profile client Client released a referenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PpmProfileClientDereference

Description

PDC PPM profile client Client released a referenced.

Message #

PDC PPM profile client %1 released a referenced

Fields #

Name	Description
`Client` Pointer
`Acquire` Boolean

Event ID 110: PDCV2 ClientRegistered - ClientId=ClientId, status=Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientRegister

Description

PDCV2 ClientRegistered - ClientId=ClientId, status=Status.

Message #

PDCV2 ClientRegistered - ClientId=%1, status=%2

Fields #

Name	Description
`ClientId` UInt32
`Status` UInt32	NTSTATUS reference
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 111: PDCV2 ClientActivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, maxDuration=ExpectedMaximumDurat...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientActivate

Description

PDCV2 ClientActivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, maxDuration=ExpectedMaximumDuration, status=Status.

Message #

PDCV2 ClientActivated - ClientId=%1(%3, %5)(activationHandle=%10) activationCount=%6, upCounter=%7, maxDuration=%8, status=%9

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ExpectedMaximumDuration` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 112: PDCV2 ClientRenewed - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) expectedMax=ExpectedMaximumDuration, activationCount=ActivationCount, upCounter=ActivationsUpCounte...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientRenewActivation

Description

PDCV2 ClientRenewed - ClientId=(, )(activationHandle=) expectedMax=, activationCount=, upCounter=, activationDuration=, renewalUpcount=, errorDetails=, status=.

Message #

PDCV2 ClientRenewed - ClientId=%1(%3, %5)(activationHandle=%13) expectedMax=%6, activationCount=%7, upCounter=%8, activationDuration=%9, renewalUpcount=%10, errorDetails=%11, status=%12

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ExpectedMaximumDuration` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`RenewalUpCounter` UInt32
`ErrorDetail` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Event ID 113: PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, Status=Status, activationDurat...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientDeactivate

Description

PDCV2 ClientDeactivated - ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) activationCount=ActivationCount, upCounter=ActivationsUpCounter, Status=Status, activationDuration=ActivationDuration.

Message #

PDCV2 ClientDeactivated - ClientId=%1(%3, %5)(activationHandle=%10) activationCount=%6, upCounter=%7, Status=%9, activationDuration=%8

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Event ID 114: PDCV2 ClientUnregistered - ClientId=ClientId, status=Status.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientUnregister

Description

PDCV2 ClientUnregistered - ClientId=ClientId, status=Status.

Message #

PDCV2 ClientUnregistered - ClientId=%1, status=%2

Fields #

Name	Description
`ClientId` UInt32
`Status` UInt32	NTSTATUS reference
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 115: PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) was called with reason CallbackReason, activationCount=ActivationCount, upCounter=Activati...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientCallback

Description

PDCV2 ActivationClientCallback ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) was called with reason CallbackReason, activationCount=ActivationCount, upCounter=ActivationsUpCounter, duration=ActivationDuration, Status=Status.

Message #

PDCV2 ActivationClientCallback ClientId=%1(%3, %5)(activationHandle=%11) was called with reason %6, activationCount=%7, upCounter=%8, duration=%9, Status=%10

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`CallbackReason` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`RenewalUpCounter` UInt32
`PdcVersion` UInt32
`ModuleNameLength` UInt32
`ModuleName` UnicodeString
`BrokeredForPID` UInt32

Event ID 116: PDCV2 SetBrokeredPID- ClientId=ClientId(TaskName, SubTaskName)(activationHandle=ActivationHandle) PID=BrokeredForPID, expectedMax=ExpectedMaximumDuration, activationCount=ActivationCount, upCounter...

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCV2ActivationClientSetBrokeredProcessID

Description

PDCV2 SetBrokeredPID- ClientId=(, )(activationHandle=) PID=, expectedMax=, activationCount=, upCounter=, activationDuration=, renewalUpcount=, status=.

Message #

PDCV2 SetBrokeredPID- ClientId=%1(%3, %5)(activationHandle=%13) PID=%11, expectedMax=%6, activationCount=%7, upCounter=%8, activationDuration=%9, renewalUpcount=%10, status=%12

Fields #

Name	Description
`ClientId` UInt32
`TaskNameLength` UInt32
`TaskName` UnicodeString
`SubTaskLength` UInt32
`SubTaskName` UnicodeString
`ExpectedMaximumDuration` UInt32
`ActivationCount` UInt32
`ActivationsUpCounter` UInt32
`ActivationDuration` UInt64
`RenewalUpCounter` UInt32
`BrokeredForPID` UInt32
`Status` UInt32	NTSTATUS reference
`ActivationHandle` Pointer
`ModuleNameLength` UInt32
`ModuleName` UnicodeString

Event ID 117: Modern Standby exit due to PDC signal client

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCSignalClassWakeDetails

Description

Modern Standby exit due to PDC signal client.

Message #

Modern Standby exit due to PDC signal client

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`RequestType` UInt32
`Reason` UInt32
`ClassId` GUID
`ProviderId` GUID
`DiagStringLength` UInt32
`DiagString` UnicodeString
`ScenarioInstanceIdV2` UInt64

Event ID 118: Modern Standby entry due to PDC signal client

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PDCSignalClassMonitorOffDetails

Description

Modern Standby entry due to PDC signal client.

Message #

Modern Standby entry due to PDC signal client

Fields #

Name	Description
`ScenarioInstanceId` UInt8
`RequestType` UInt32
`Reason` UInt32
`ClassId` GUID
`ProviderId` GUID
`DiagStringLength` UInt32
`DiagString` UnicodeString
`ScenarioInstanceIdV2` UInt64

Event ID 119: PDC phase Phase was referenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Also via: realtime ETW trace
Task: PdcPhaseReferenced
Opcode: win:Info

Description

PDC phase Phase was referenced.

Message #

PDC phase %1 was referenced

Fields #

Name	Description
`Phase` UInt8
`CountChange` Int32
`ReferenceCount` Int32
`WasWorkItemQueued` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PDC",
    "guid": "{A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}",
    "event_source_name": "",
    "event_id": 119,
    "version": 0,
    "level": 0,
    "task": 118,
    "opcode": 0,
    "keywords": "0x0000000000000880",
    "time_created": "2026-06-02T05:29:50.513+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20788
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CountChange": 1,
    "Phase": 0,
    "ReferenceCount": 3,
    "WasWorkItemQueued": false
  },
  "message": "PdcPhaseReferenced"
}

Event ID 120: PDC phase Phase was dereferenced.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Also via: realtime ETW trace
Task: PdcPhaseDereferenced
Opcode: win:Info

Description

PDC phase Phase was dereferenced.

Message #

PDC phase %1 was dereferenced

Fields #

Name	Description
`Phase` UInt8
`CountChange` Int32
`ReferenceCount` Int32
`WasWorkItemQueued` Boolean

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PDC",
    "guid": "{A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}",
    "event_source_name": "",
    "event_id": 120,
    "version": 0,
    "level": 0,
    "task": 119,
    "opcode": 0,
    "keywords": "0x0000000000000880",
    "time_created": "2026-06-02T05:29:50.516+00:00",
    "event_record_id": 0,
    "correlation": {},
    "execution": {
      "process_id": 4,
      "thread_id": 20788
    },
    "channel": "ETW Trace",
    "computer": "JD-DC01-2022",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "CountChange": 1,
    "Phase": 0,
    "ReferenceCount": 2,
    "WasWorkItemQueued": false
  },
  "message": "PdcPhaseDereferenced"
}

Event ID 121: PDC phase PreviousTargetPhase was selected as target.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcTargetPhaseSelected

Description

PDC phase PreviousTargetPhase was selected as target.

Message #

PDC phase %1 was selected as target

Fields #

Name	Description
`PreviousTargetPhase` UInt8
`NewTargetPhase` UInt8
`CurrentPhase` UInt8

Event ID 122: PDC target phase Phase was reached.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcTargetPhaseReached

Description

PDC target phase Phase was reached.

Message #

PDC target phase %1 was reached

Fields #

Name	Description
`Phase` UInt8

Event ID 123: PDC phase Phase notifications state changed.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcPhaseNotificationsStateChanged

Description

PDC phase Phase notifications state changed.

Message #

PDC phase %1 notifications state changed

Fields #

Name	Description
`Phase` UInt8
`PreviousState` UInt8
`NewState` UInt8

Event ID 124: PDC phase Phase rundown.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcPhaseRundown

Description

PDC phase Phase rundown.

Message #

PDC phase %1 rundown

Fields #

Name	Description
`Phase` UInt8
`ReferenceCount` Int32
`IsHandlerEngaged` Boolean
`NotificationsState` UInt8
`NotificationsStatus` UInt32
`PdcSequenceId` UInt32
`EntryWaitTimeInSeconds` UInt32
`EntryWatchdogTimeoutInSeconds` UInt32

Event ID 125: PDC phase Phase accounting rundown.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcPhaseAccountingRundown

Description

PDC phase Phase accounting rundown.

Message #

PDC phase %1 accounting rundown

Fields #

Name	Description
`Phase` UInt8
`EngageCount` UInt32
`EngageHandlerTotalTime` UInt64
`EngageHandlerNotificationsTotalTime` UInt64
`DisengageCount` UInt32
`DisengageHandlerTotalTime` UInt64
`DisengageHandlerNotificationsTotalTime` UInt64
`PhaseTotalTime` UInt64

Event ID 126: PDC phase notification callback

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcPhaseNotificationCallback

Description

PDC phase notification callback.

Message #

PDC phase notification callback

Fields #

Name	Description
`CurrentPhase` UInt8
`CurrentPhaseNotificationsState` UInt8
`CurrentPhaseNotificationsStatus` UInt32
`CurrentPhasePdcSequence` UInt32
`CallbackStatus` UInt32
`CallbackPdcSequence` UInt32

Event ID 127: PDC notified system is idle state SystemIdle.

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcSIdleUpdateNotification

Description

PDC notified system is idle state SystemIdle.

Message #

PDC notified system is idle state %1

Fields #

Name	Description
`SystemIdle` Boolean

Event ID 128: A function in PDC received an invalid argument

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: PdcInvalidArgumentToFunction

Description

A function in PDC received an invalid argument.

Message #

A function in PDC received an invalid argument

Fields #

Name	Description
`FunctionNameLength` UInt32
`FunctionName` UnicodeString
`ArgumentNameLength` UInt32
`ArgumentName` UnicodeString

Event ID 129: SpmScenarioCreate

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioCreate

Fields #

Name	Description
`Scenario` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 130: SpmScenarioDelete

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: SpmScenarioDelete

Fields #

Name	Description
`Scenario` Pointer
`Status` UInt32	NTSTATUS reference

Event ID 131: GroupEnable

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: GroupEnable

Fields #

Name	Description
`GroupId` UInt32
`Enable` Boolean
`Updated` Boolean

Event ID 132: GroupRequest

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: GroupRequest

Fields #

Name	Description
`GroupId` UInt32
`RequestCount` Int32
`Updated` Boolean

Event ID 133: ClientPolicyRundown

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ClientPolicyRundown

Fields #

Name	Description
`PolicyNameLength` UInt32
`PolicyName` UnicodeString
`PolicyActive` Boolean
`ClientRevocationCount` UInt32
`ClientRevocationPolicy` UInt8

Event ID 134: ClientPolicyRuleStatusChange

Provider: Microsoft-Windows-PDC
Channel: Diagnostic
Task: ClientPolicyRuleStatusChange

Fields #

Name	Description
`PolicyNameLength` UInt32
`PolicyName` UnicodeString
`PolicyActive` Boolean

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID {A6BF0DEB-3659-40AD-9F81-E25AF62CE3C7}

Defined in Microsoft-Windows-Pdc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, sample captured from a live trace, binary version 10.0.20348.1, captured 2026-06-02
WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)