detection.wiki

Microsoft-Windows-Privacy-Auditing-Activity-History-Privacy-Settings

EventTitleChannelSampleRule
0Cloud sync allowed value changed, setting SettingName, from OldConsentValue to …OperationalNN
1Cloud sync allowed value change, setting SettingName, failed.OperationalNN
2History collection allowed value changed, setting SettingName, from …OperationalNN
3History collection allowed value change, setting SettingName, failed.OperationalNN
4Clear activity history, setting SettingName, sucess.OperationalNN
5Clear activity history, setting SettingName, failed.OperationalNN
6Account filter value changed, setting SettingName, from OldConsentValue to …OperationalNN
7Account filter value changed, setting SettingName, failed.OperationalNN

Event ID 0: Cloud sync allowed value changed, setting SettingName, from OldConsentValue to NewConsentValue.

#
Channel
Operational
Task
ValueChanged

Message #

Cloud sync allowed value changed, setting %12, from %4 to %5

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UInt16
NewConsentValue UInt16
SetByHigherAuthority Boolean
EffectiveConsentValue UInt16
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 1: Cloud sync allowed value change, setting SettingName, failed.

#
Channel
Operational
Task
ValueChanged

Message #

Cloud sync allowed value change, setting %12, failed

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UInt16
NewConsentValue UInt16
SetByHigherAuthority Boolean
EffectiveConsentValue UInt16
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 2: History collection allowed value changed, setting SettingName, from OldConsentValue to NewConsentValue.

#
Channel
Operational
Task
ValueChanged

Message #

History collection allowed value changed, setting %12, from %4 to %5

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UInt16
NewConsentValue UInt16
SetByHigherAuthority Boolean
EffectiveConsentValue UInt16
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 3: History collection allowed value change, setting SettingName, failed.

#
Channel
Operational
Task
ValueChanged

Message #

History collection allowed value change, setting %12, failed

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UInt16
NewConsentValue UInt16
SetByHigherAuthority Boolean
EffectiveConsentValue UInt16
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 4: Clear activity history, setting SettingName, sucess.

#
Channel
Operational
Task
ClearActivityHistory

Message #

Clear activity history, setting %12, sucess

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UnicodeString
NewConsentValue UnicodeString
SetByHigherAuthority Boolean
EffectiveConsentValue UnicodeString
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 5: Clear activity history, setting SettingName, failed.

#
Channel
Operational
Task
ClearActivityHistory

Message #

Clear activity history, setting %12, failed

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue UnicodeString
NewConsentValue UnicodeString
SetByHigherAuthority Boolean
EffectiveConsentValue UnicodeString
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 6: Account filter value changed, setting SettingName, from OldConsentValue to NewConsentValue.

#
Channel
Operational
Task
FilterAccount

Message #

Account filter value changed, setting %12, from %4 to %5

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue Boolean
NewConsentValue Boolean
SetByHigherAuthority Boolean
EffectiveConsentValue Boolean
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Event ID 7: Account filter value changed, setting SettingName, failed.

#
Channel
Operational
Task
FilterAccount

Message #

Account filter value changed, setting %12, failed

Fields #

NameDescription
CallerUserSid UnicodeString
CallerProcessName UnicodeString
CallerAppPackageFamilyName UnicodeString
OldConsentValue Boolean
NewConsentValue Boolean
SetByHigherAuthority Boolean
EffectiveConsentValue Boolean
TargetUserSid UnicodeStringSID of the target account.
ConsentID UnicodeString
AppPackageFamilyName UnicodeString
HResult HexInt32
SettingName UnicodeString

Provenance

ETW provider GUID 63dd5dfb-2488-5e1f-7895-d49ff5bc7125

Defined in Windows.Data.Activities.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB