Microsoft-Windows-Power-Meter-Polling
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | PowerMeterRundown | Diagnostic | N | N |
| 2 | EnergyMeterRundown | Diagnostic | N | N |
| 3 | PowerMeterData | Diagnostic | N | N |
| 4 | EnergyMeterData | Diagnostic | Y | N |
| 5 | SamplingPeriodRundown | Diagnostic | N | N |
| 6 | SamplingPeriodChange | Diagnostic | Y | N |
Event ID 1: PowerMeterRundown
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
DefaultSamplingPeriodInMs UInt64 | |
MeterNameLength UInt32 | |
MeterName UnicodeString | |
MeteredHardwareCount UInt32 | |
MeteredHardwareName UnicodeString |
Event ID 2: EnergyMeterRundown
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
DefaultSamplingPeriodInMs UInt64 | |
ChannelNameLength UInt32 | |
ChannelName UnicodeString |
Event ID 4: EnergyMeterData
#Fields #
| Name | Description |
|---|---|
MeterId Pointer | |
AbsoluteEnergy UInt64 | |
AbsoluteTime UInt64 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Power-Meter-Polling/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 4,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 1304,
"thread_id": 11940
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Power-Meter-Polling",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:03:34.434Z",
"version": 0
},
"event_data": {
"AbsoluteEnergy": 0,
"AbsoluteTime": 559421010071,
"MeterId": "0x28608702500"
},
"message": ""
}
Event ID 6: SamplingPeriodChange
#Fields #
| Name | Description |
|---|---|
MeterType UInt32 | |
PeriodInMs UInt32 |
Example Event #
{
"system": {
"channel": "Microsoft-Windows-Power-Meter-Polling/Diagnostic",
"computer": "10.2.10.21",
"correlation": {},
"event_id": 6,
"event_record_id": 0,
"event_source_name": "",
"execution": {
"process_id": 1304,
"thread_id": 11940
},
"guid": "",
"keywords": 0,
"level": 4,
"opcode": 0,
"provider": "Microsoft-Windows-Power-Meter-Polling",
"security": {
"user_id": ""
},
"task": 0,
"time_created": "2026-07-22 01:03:33.938Z",
"version": 0
},
"event_data": {
"MeterType": 0,
"PeriodInMs": 500
},
"message": ""
}
Provenance
ETW provider GUID 306c4e0b-e148-543d-315b-c618eb93157c
Defined in umpoext.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB