Microsoft-Windows-ProcessStateManager
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1 | Application ApplicationId state changed from SessionId to PsmKey. | Diagnostic | N | N |
| 2 | PolicySuspend | Operational | N | N |
| 3 | PolicyResume | Operational | N | N |
| 4 | PriorityChange | Diagnostic | N | N |
| 100 | StateChangeDCStop | Operational | N | N |
| 101 | PriorityChangeDCStop | Diagnostic | N | N |
| 102 | RundownDCStop | Operational | N | N |
| 103 | ProcessRegisterDCStop | Operational | N | N |
Event ID 1: Application ApplicationId state changed from SessionId to PsmKey.
#Description
Application ApplicationId state changed from SessionId to PsmKey. MixedWorkItems: OldState, PureWorkItems: NewState, SystemWorkItems: MixedWorkItems.
Message #
Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
OldState UInt32 | |
NewState UInt32 | |
MixedWorkItems UInt32 | |
PureWorkItems UInt32 | |
SystemWorkItems UInt32 | |
Flags UInt32 | |
CycleTime UInt64 | |
NetworkTokens UInt64 |
Event ID 2: PolicySuspend
#Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
Flags UInt32 | |
CycleTime UInt64 | |
NetworkTokens UInt64 |
Event ID 3: PolicyResume
#Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
Flags UInt32 | |
CycleTime UInt64 | |
NetworkTokens UInt64 |
Event ID 4: PriorityChange
#Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
PlmRequestedPriority UInt32 | |
EffectivePriority UInt32 |
Event ID 100: StateChangeDCStop
#Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
OldState UInt32 | |
NewState UInt32 | |
MixedWorkItems UInt32 | |
PureWorkItems UInt32 | |
SystemWorkItems UInt32 | |
Flags UInt32 | |
CycleTime UInt64 | |
NetworkTokens UInt64 |
Event ID 101: PriorityChangeDCStop
#Fields #
| Name | Description |
|---|---|
ApplicationId UInt64 | |
SessionId UInt32 | |
PsmKey UnicodeString | |
PlmRequestedPriority UInt32 | |
EffectivePriority UInt32 |
Provenance
ETW provider GUID d49918cf-9489-4bf1-9d7b-014d864cf71f
Defined in psmsrv.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB