detection.wiki

Microsoft-Windows-PortableDeviceSyncProvider

EventTitleChannelSampleRule
400WPDProvider_DLLLifetimeStartAnalyticNN
401WPDProvider_DLLLifetimeStopAnalyticNN
402WPDProvider_GetIdParametersStartAnalyticNN
403WPDProvider_GetIdParametersStopAnalyticNN
404WPDProvider_InitStartAnalyticNN
405WPDProvider_InitStopAnalyticNN
406WPDProvider_GetInstanceIdStartAnalyticNN
407WPDProvider_GetInstanceIdStopAnalyticNN
408WPDProvider_BeginSessionStartAnalyticNN
409WPDProvider_BeginSessionStopAnalyticNN
410WPDProvider_GetMetadataStoreStartAnalyticNN
411WPDProvider_GetMetadataStoreStopAnalyticNN
412WPDProvider_GetMetadataSchemaStartAnalyticNN
413WPDProvider_GetMetadataSchemaStopAnalyticNN
414WPDProvider_EnumerateItemsStartAnalyticNN
415WPDProvider_EnumerateItemsStopAnalyticNN
418WPDProvider_LoadChangeDataStartAnalyticNN
419WPDProvider_LoadChangeDataStopAnalyticNN
420WPDProvider_InsertItemStartAnalyticNN
421WPDProvider_InsertItemStopAnalyticNN
422WPDProvider_UpdateItemStartAnalyticNN
423WPDProvider_UpdateItemStopAnalyticNN
424WPDProvider_DeleteItemStartAnalyticNN
425WPDProvider_DeleteItemStopAnalyticNN
426WPDProvider_EndSessionStartAnalyticNN
427WPDProvider_EndSessionStopAnalyticNN
428WPDProvider_SpecifyFilterStartAnalyticNN
429WPDProvider_SpecifyFilterStopAnalyticNN
434WPDProvider_ReductionStartAnalyticNN
435WPDProvider_ReductionStopAnalyticNN
436WPDProvider_EnumerateChangesStartAnalyticNN
437WPDProvider_EnumerateChangesStopAnalyticNN
438WPDProvider_GetEnumerationAnchorStartAnalyticNN
439WPDProvider_GetEnumerationAnchorStopAnalyticNN
440WPDProvider_OnConstraintConflictStartAnalyticNN
441WPDProvider_OnConstraintConflictStopAnalyticNN
442WPDProvider_ResolveConstraintConflictStartAnalyticNN
443WPDProvider_ResolveConstraintConflictStopAnalyticNN

Event ID 400: WPDProvider_DLLLifetimeStart

#
Channel
Analytic
Task
WPDProvider_DLLLifetime
Opcode
Start

Event ID 401: WPDProvider_DLLLifetimeStop

#
Channel
Analytic
Task
WPDProvider_DLLLifetime
Opcode
Stop

Event ID 402: WPDProvider_GetIdParametersStart

#
Channel
Analytic
Task
WPDProvider_GetIdParameters
Opcode
Start

Event ID 403: WPDProvider_GetIdParametersStop

#
Channel
Analytic
Task
WPDProvider_GetIdParameters
Opcode
Stop

Event ID 404: WPDProvider_InitStart

#
Channel
Analytic
Task
WPDProvider_Init
Opcode
Start

Event ID 405: WPDProvider_InitStop

#
Channel
Analytic
Task
WPDProvider_Init
Opcode
Stop

Event ID 406: WPDProvider_GetInstanceIdStart

#
Channel
Analytic
Task
WPDProvider_GetInstanceId
Opcode
Start

Event ID 407: WPDProvider_GetInstanceIdStop

#
Channel
Analytic
Task
WPDProvider_GetInstanceId
Opcode
Stop

Event ID 408: WPDProvider_BeginSessionStart

#
Channel
Analytic
Task
WPDProvider_BeginSession
Opcode
Start

Event ID 409: WPDProvider_BeginSessionStop

#
Channel
Analytic
Task
WPDProvider_BeginSession
Opcode
Stop

Event ID 410: WPDProvider_GetMetadataStoreStart

#
Channel
Analytic
Task
WPDProvider_GetMetadataStore
Opcode
Start

Event ID 411: WPDProvider_GetMetadataStoreStop

#
Channel
Analytic
Task
WPDProvider_GetMetadataStore
Opcode
Stop

Event ID 412: WPDProvider_GetMetadataSchemaStart

#
Channel
Analytic
Task
WPDProvider_GetMetadataSchema
Opcode
Start

Event ID 413: WPDProvider_GetMetadataSchemaStop

#
Channel
Analytic
Task
WPDProvider_GetMetadataSchema
Opcode
Stop

Event ID 414: WPDProvider_EnumerateItemsStart

#
Channel
Analytic
Task
WPDProvider_EnumerateItems
Opcode
Start

Event ID 415: WPDProvider_EnumerateItemsStop

#
Channel
Analytic
Task
WPDProvider_EnumerateItems
Opcode
Stop

Event ID 418: WPDProvider_LoadChangeDataStart

#
Channel
Analytic
Task
WPDProvider_LoadChangeData
Opcode
Start

Event ID 419: WPDProvider_LoadChangeDataStop

#
Channel
Analytic
Task
WPDProvider_LoadChangeData
Opcode
Stop

Event ID 420: WPDProvider_InsertItemStart

#
Channel
Analytic
Task
WPDProvider_InsertItem
Opcode
Start

Event ID 421: WPDProvider_InsertItemStop

#
Channel
Analytic
Task
WPDProvider_InsertItem
Opcode
Stop

Event ID 422: WPDProvider_UpdateItemStart

#
Channel
Analytic
Task
WPDProvider_UpdateItem
Opcode
Start

Event ID 423: WPDProvider_UpdateItemStop

#
Channel
Analytic
Task
WPDProvider_UpdateItem
Opcode
Stop

Event ID 424: WPDProvider_DeleteItemStart

#
Channel
Analytic
Task
WPDProvider_DeleteItem
Opcode
Start

Event ID 425: WPDProvider_DeleteItemStop

#
Channel
Analytic
Task
WPDProvider_DeleteItem
Opcode
Stop

Event ID 426: WPDProvider_EndSessionStart

#
Channel
Analytic
Task
WPDProvider_EndSession
Opcode
Start

Event ID 427: WPDProvider_EndSessionStop

#
Channel
Analytic
Task
WPDProvider_EndSession
Opcode
Stop

Event ID 428: WPDProvider_SpecifyFilterStart

#
Channel
Analytic
Task
WPDProvider_SpecifyFilter
Opcode
Start

Event ID 429: WPDProvider_SpecifyFilterStop

#
Channel
Analytic
Task
WPDProvider_SpecifyFilter
Opcode
Stop

Event ID 434: WPDProvider_ReductionStart

#
Channel
Analytic
Task
WPDProvider_Reduction
Opcode
Start

Event ID 435: WPDProvider_ReductionStop

#
Channel
Analytic
Task
WPDProvider_Reduction
Opcode
Stop

Event ID 436: WPDProvider_EnumerateChangesStart

#
Channel
Analytic
Task
WPDProvider_EnumerateChanges
Opcode
Start

Event ID 437: WPDProvider_EnumerateChangesStop

#
Channel
Analytic
Task
WPDProvider_EnumerateChanges
Opcode
Stop

Event ID 438: WPDProvider_GetEnumerationAnchorStart

#
Channel
Analytic
Task
WPDProvider_GetEnumerationAnchor
Opcode
Start

Event ID 439: WPDProvider_GetEnumerationAnchorStop

#
Channel
Analytic
Task
WPDProvider_GetEnumerationAnchor
Opcode
Stop

Event ID 440: WPDProvider_OnConstraintConflictStart

#
Channel
Analytic
Task
WPDProvider_OnConstraintConflict
Opcode
Start

Event ID 441: WPDProvider_OnConstraintConflictStop

#
Channel
Analytic
Task
WPDProvider_OnConstraintConflict
Opcode
Stop

Event ID 442: WPDProvider_ResolveConstraintConflictStart

#
Channel
Analytic
Task
WPDProvider_ResolveConstraintConflict
Opcode
Start

Event ID 443: WPDProvider_ResolveConstraintConflictStop

#
Channel
Analytic
Task
WPDProvider_ResolveConstraintConflict
Opcode
Stop

Provenance

ETW provider GUID a3e1697b-a12c-46b9-84d1-7ffe73c4b678

Defined in PortableDeviceSyncProvider.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB