Microsoft-Windows-Provisioning-Diagnostics-Provider
Event ID 10: Configuring ProvXML with category 'Message1'.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | |
Message2 UnicodeString | ProvXML data |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Provisioning-Diagnostics-Provider",
"guid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9",
"event_source_name": "",
"event_id": 10,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:52.831967+00:00",
"event_record_id": 113,
"correlation": {},
"execution": {
"process_id": 3584,
"thread_id": 3588
},
"channel": "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "PowerSettings",
"Message2": "MCSF/Power/Controls/EnergyEstimationEnabled"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 11: ProvXML category 'Message1' completed successfully.
#Description
ProvXML category 'Message1' completed successfully. Message2.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | |
Message2 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Provisioning-Diagnostics-Provider",
"guid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9",
"event_source_name": "",
"event_id": 11,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-05T22:26:45.490065+00:00",
"event_record_id": 132,
"correlation": {
"ActivityID": "F590C418-1079-0003-3DF1-90F57910DA01"
},
"execution": {
"process_id": 3584,
"thread_id": 3588
},
"channel": "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "PowerSettings",
"Message2": "Provisioning succeeded"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 12: ProvXML category 'Message1' failed with 'HRESULT' at CSP node 'Message2'.
#Event ID 13: Setting Message1 was ignored because it was not available on this OS build.
#Event ID 20: Applying package 'Message1' ID: Message2.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | |
Message2 UnicodeString | 1' ID. |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Provisioning-Diagnostics-Provider",
"guid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9",
"event_source_name": "",
"event_id": 20,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:50.949676+00:00",
"event_record_id": 111,
"correlation": {},
"execution": {
"process_id": 3584,
"thread_id": 3588
},
"channel": "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "Microsoft.Windows.Cosa.Desktop.Client.ppkg",
"Message2": "{c8a326e4-f518-4f14-b543-97a57e1a975e}"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 21: Package 'Message1' has completed.
#Event ID 22: Package 'Message1' failed with 'HRESULT'.
#Event ID 23: Skipping package 'Message1' ID: Message2.
#Event ID 40: Registry specified search path is invalid: Message1.
#Event ID 41: InitiateSystemShutdownEx succeeded.
#Event ID 42: InitiateSystemShutdownEx failed.
#Event ID 43: Start RebootSystem.
#Event ID 44: InitiateSystemShutdownEx succeeded.
#Event ID 45: InitiateSystemShutdownEx failed.
#Event ID 61: AddPackage succeeded, targetPath = Message1.
#Event ID 62: AddPackage failed.
#Event ID 63: RemovePackage initiated, package id = Message1.
#Event ID 64: RemovePackage succeeded, package id = Message1.
#Event ID 65: RemovePackage failed.
#Event ID 66: RemovePackageMetadata succeeded, package id = Message1.
#Event ID 67: RemovePackageMetadata failed.
#Event ID 68: RemoveResourceManagerPackageMetadataForCsp succeeded, package id = Message1.
#Event ID 69: RemoveResourceManagerPackageMetadataForCsp failed.
#Event ID 72: ApplyKnownPackages failed.
#Event ID 73: PublishDeviceProvisioningLogs failed
#Event ID 74: PublishDeviceProvisioningLogs succeeded
#Event ID 75: CleanupOOBEProvisioningLogs failed
#Event ID 76: CleanupOOBEProvisioningLogs succeeded
#Event ID 80: GetLastProvisioningResultsAsync succeeded, resultCount = UInt1.
#Event ID 81: GetLastProvisioningResultsAsync failed.
#Event ID 82: GetLastProvisioningCommandResultsAsync succeeded, resultCount = UInt1.
#Event ID 83: GetLastProvisioningCommandResultsAsync.
#Event ID 90: Settings detail.
#Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString | |
Message2 UnicodeString | |
Message3 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Provisioning-Diagnostics-Provider",
"guid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9",
"event_source_name": "",
"event_id": 90,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:42.966867+00:00",
"event_record_id": 89,
"correlation": {},
"execution": {
"process_id": 3584,
"thread_id": 3588
},
"channel": "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "OOBE",
"Message2": "<Not Present>",
"Message3": "<Not Present>"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 91: RegisterForCspAlerts succeeded.
#Description
RegisterForCspAlerts succeeded. EnrollmentId = Message1.
Message #
Fields #
| Name | Description |
|---|---|
Message1 UnicodeString |
Example Event #
{
"system": {
"provider": "Microsoft-Windows-Provisioning-Diagnostics-Provider",
"guid": "ED8B9BD3-F66E-4FF2-B86B-75C7925F72A9",
"event_source_name": "",
"event_id": 91,
"version": 0,
"level": 4,
"task": 0,
"opcode": 0,
"keywords": 9223372036854775808,
"time_created": "2023-11-06T06:25:52.831884+00:00",
"event_record_id": 112,
"correlation": {},
"execution": {
"process_id": 3584,
"thread_id": 3588
},
"channel": "Microsoft-Windows-Provisioning-Diagnostics-Provider/Admin",
"computer": "WinDev2310Eval",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {
"Message1": "{1e05dd5d-a022-46c5-963c-b20de341170f}"
},
"message": ""
}
References #
- Example event sourced from https://github.com/NextronSystems/evtx-baseline
Event ID 92: RegisterForCspAlerts Failed.
#Event ID 93: UpdatePendingResultInternal succeeded.
#Event ID 94: UpdatePendingResultInternal Failed.
#Event ID 100: AutoPilot policy [Message1] not found.
#Event ID 101: AutoPilotGetPolicyDwordByName succeeded: policy name = Message1; policy value = Int1.
#Event ID 102: AutoPilotGetPolicyDwordByName error: policy name = Message1; HRESULT = HRESULT.
#Event ID 103: AutoPilotGetPolicyStringByName succeeded: policy name = Message1; policy value = Message2.
#Event ID 104: AutoPilotGetPolicyStringByName error: policy name = Message1; HRESULT = HRESULT.
#Event ID 105: AutoPilotDisable succeeded.
#Event ID 108: AutoPilotIsDisabled error: HRESULT = HRESULT.
#Event ID 109: AutoPilotGetOobeSettingsOverride succeeded: OOBE setting = Message1; state = Message2.
#Event ID 110: AutoPilotGetOobeSettingsOverride error: OOBE setting = Message1; HRESULT = HRESULT.
#Event ID 111: AutoPilotRetrieveSettings succeeded.
#Event ID 112: AutoPilotRetrieveSettings error: HRESULT = HRESULT.
#Event ID 113: AutoPilot reported the DLL was unloaded while there were Int1 outstanding calls.
#Event ID 114: AutoPilotRetrieveSettings was skipped because this version of Windows does not support Azure Active Directory join.
#Event ID 115: Autopilot discovery failed to find a valid MDM.
#Event ID 150: AutoPilotManager started the MSA service for TPM attestation identity.
#Event ID 151: AutoPilotManager started the TPM task to update TPM attestation.
#Event ID 152: AutoPilotManager reported TPM task is complete.
#Event ID 153: AutoPilotManager reported the state changed from InitialState to UpdateState.
#Event ID 154: AutoPilotManager failed to start MSA service.
#Event ID 155: AutoPilotManager failed to start TPM task.
#Event ID 156: AutoPilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required.
#Description
AutoPilotManager reported that MSA TPM is not configured for hardware TPM attestation even though the profile indicates it is required. AutoPilot cannot proceed.
Message #
Event ID 157: AutoPilotManager reported that TPM attestation lasted UInt1 microseconds.
#Event ID 160: AutoPilotRetrieveSettings beginning acquisition.
#Event ID 161: AutoPilotManager retrieve settings succeeded.
#Event ID 162: AutoPilotManager determined download is not required and the device is not provisioned.
#Description
AutoPilotManager determined download is not required and the device is not provisioned. Clean or reset the device to change this.
Message #
Event ID 163: AutoPilotManager determined download is not required and the device is already provisioned.
#Description
AutoPilotManager determined download is not required and the device is already provisioned. Clean or reset the device to change this.
Message #
Event ID 164: AutoPilotManager determined Internet is available to attempt policy download.
#Event ID 165: AutoPilotManager determined Internet is not available; policy download will queue when available.
#Event ID 166: AutoPilotManager reported Internet is now available.
#Event ID 167: AutoPilotManager reported Internet is still not available.
#Event ID 168: AutoPilotManager reported MSA TPM device identity was updated.
#Event ID 169: AutoPilotManager set TPM identity confirmed.
#Event ID 170: AutoPilotManager set AutoPilot profile as available.
#Event ID 171: AutoPilotManager failed to set TPM identity confirmed.
#Event ID 172: AutoPilotManager failed to set AutoPilot profile as available.
#Event ID 173: AutoPilotManager failed to register for network availability.
#Event ID 174: AutoPilotManager failed to register for device identity availability.
#Event ID 175: AutoPilotManager failed to register for device identity task update.
#Event ID 176: MSA TPM keystate has been updated.
#Event ID 177: TPM attestation retry is being attempted.
#Event ID 178: AutoPilotManager began device enrollment with internal state Int1.
#Event ID 179: AutoPilotManager began device enrollment phase State.
#Event ID 180: AutoPilotManager failed during device enrollment phase State.
#Event ID 181: AutoPilotManager completed device enrollment phase State.
#Event ID 182: AutoPilotManager reported that the retry timer event was set to UInt1 milliseconds.
#Event ID 183: AutoPilotManager reported that the retry timer event occurred
#Event ID 184: AutoPilotManager failed to register for MSA keystate update availability.
#Event ID 300: AutoPilotManager device enrollment reported an initialization failure.
#Event ID 301: AutoPilotManager device enrollment reported a blocking failure.
#Event ID 302: AutoPilotManager device enrollment failed during stage State with error HRESULT.
#Event ID 303: AutoPilotManager device enrollment succeeded.
#Event ID 310: AutoPilot configuration file path: AutoPilot_configuration_file_path.
#Event ID 311: Failed to load AutoPilot configuration file, HRESULT = HRESULT.
#Event ID 312: Failed to parse AutoPilot configuration file, HRESULT = HRESULT.
#Event ID 1000: Management service starting.
#Event ID 1001: Management service started.
#Event ID 1002: Management service failed to start.
#Event ID 1003: Management service failed to register.
#Event ID 1004: Management service shutdown.
#Event ID 1005: Management service WIL error was reported.
#Event ID 1006: Management service call Message1 is deprecated!
#Event ID 1007: Management service cleared the local Autopilot cached state.
#Event ID 1008: Management service failed to clear the local Autopilot cached state.
#Event ID 2000: Device rename has been blocked through MDM because machine is domain joined
#Provenance
ETW provider GUID ed8b9bd3-f66e-4ff2-b86b-75c7925f72a9
Defined in provdiagnostics.dll, which carries the event manifest.
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB