Microsoft-Windows-ResourcePublication

10 events across 2 channels

Event	Title	Channel	Sample
100	Successfully published element Argument.	Tracing	N
101	Successfully removed element Argument from publication.	Tracing	N
102	The service temporarily stopped publishing because of a power event.	Tracing	N
103	The service stopped publishing because the default computer information has been …	Tracing	N
104	The service is publishing to the network.	Tracing	N
1000	Element Argument could not be published because the maximum number of 20 …	System	N
1001	The metadata of element Argument would cause the total published metadata to be …	System	N
1002	Element Argument failed to publish.	System	N
1003	Error calling function Function.	Tracing	N
1004	The metadata of element Argument is too large.	System	N

Event ID 100: Successfully published element Argument.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

Successfully published element Argument.

Message #

Successfully published element %1.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 101: Successfully removed element Argument from publication.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

Successfully removed element Argument from publication.

Message #

Successfully removed element %1 from publication.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 102: The service temporarily stopped publishing because of a power event.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

The service temporarily stopped publishing because of a power event.

Message #

The service temporarily stopped publishing because of a power event.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 103: The service stopped publishing because the default computer information has been removed.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

The service stopped publishing because the default computer information has been removed. The user has elected to opt out of publishing on this computer.

Message #

The service stopped publishing because the default computer information has been removed.  The user has elected to opt out of publishing on this computer.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 104: The service is publishing to the network.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

The service is publishing to the network.

Message #

The service is publishing to the network.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 1000: Element Argument could not be published because the maximum number of 20 published elements has been reached.

Provider: Microsoft-Windows-ResourcePublication
Channel: System
Opcode: Info

Description

Element Argument could not be published because the maximum number of 20 published elements has been reached. Reduce the number of published elements or remove Argument from publication.

Message #

Element %1 could not be published because the maximum number of 20 published elements has been reached. Reduce the number of published elements or remove %1 from publication.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 1001: The metadata of element Argument would cause the total published metadata to be more than 32k, which is the maximum allowable size for all published elem...

Provider: Microsoft-Windows-ResourcePublication
Channel: System
Opcode: Info

Description

The metadata of element Argument would cause the total published metadata to be more than 32k, which is the maximum allowable size for all published elements. Reduce the number of published elements, remove Argument from publication, or reduce the size of the metadata of element Argument.

Message #

The metadata of element %1 would cause the total published metadata to be more than 32k, which is the maximum allowable size for all published elements. Reduce the number of published elements, remove %1 from publication, or reduce the size of the metadata of element %1.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 1002: Element Argument failed to publish.

Provider: Microsoft-Windows-ResourcePublication
Channel: System
Opcode: Info

Description

Element Argument failed to publish. Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.

Message #

Element %1 failed to publish.  Ensure that both PKEY_PUBSVCS_METADATA and PKEY_PUBSVCS_TYPE are set properly on the function instance and there were no errors adding the function instance.

Fields #

Name	Description
`Argument` UnicodeString

Event ID 1003: Error calling function Function.

Provider: Microsoft-Windows-ResourcePublication
Channel: Tracing
Opcode: Info

Description

Error calling function Function. The return value was HRESULT.

Message #

Error calling function %1.  The return value was %2.

Fields #

Name	Description
`Function` UnicodeString
`HRESULT` UInt32
`Line` UInt32
`Filename` AnsiString

Event ID 1004: The metadata of element Argument is too large.

Provider: Microsoft-Windows-ResourcePublication
Channel: System
Opcode: Info

Description

The metadata of element Argument is too large. The maximum allowed size is 2048 bytes. Reduce the size of the metadata of element Argument.

Message #

The metadata of element %1 is too large.  The maximum allowed size is 2048 bytes.  Reduce the size of the metadata of element %1.

Fields #

Name	Description
`Argument` UnicodeString

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 74c2135f-cc76-45c3-879a-ef3bb1eeaf86

Defined in fdrespub.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Microsoft-Windows-ResourcePublication

Event ID 100: Successfully published element Argument.

Description

Message #

Fields #

Event ID 101: Successfully removed element Argument from publication.

Description

Message #

Fields #

Event ID 102: The service temporarily stopped publishing because of a power event.

Description

Message #

Fields #

Event ID 103: The service stopped publishing because the default computer information has been removed.

Description

Message #

Fields #

Event ID 104: The service is publishing to the network.

Description

Message #

Fields #

Event ID 1000: Element Argument could not be published because the maximum number of 20 published elements has been reached.

Description

Message #

Fields #

Event ID 1001: The metadata of element Argument would cause the total published metadata to be more than 32k, which is the maximum allowable size for all published elem...

Description

Message #

Fields #

Event ID 1002: Element Argument failed to publish.

Description

Message #

Fields #

Event ID 1003: Error calling function Function.

Description

Message #

Fields #

Event ID 1004: The metadata of element Argument is too large.

Description

Message #

Fields #

Provenance

Downloads