detection.wiki

Microsoft-Windows-RetailDemo

EventTitleChannelSampleRule
100Retail Demo service has started.AdminNN
101Retail Demo service has stopped.AdminNN
200Retail Demo service has caught an exception ErrorPhase (State: Phase Phase: …OperationalNN

Event ID 100: Retail Demo service has started.

#
Channel
Admin
Task
RetailDemo_Service_Lifetime
Opcode
Start

Event ID 101: Retail Demo service has stopped.

#
Channel
Admin
Task
RetailDemo_Service_Lifetime
Opcode
Stop

Event ID 200: Retail Demo service has caught an exception ErrorPhase (State: Phase Phase: ErrorState).

#
Channel
Operational
Task
RetailDemo_Service_Error

Message #

Retail Demo service has caught an exception %3 (State: %1 Phase: %2)

Fields #

NameDescription
ErrorState AnsiString
ErrorPhase AnsiString
HRESULT UInt32

Provenance

ETW provider GUID d3f29eda-805d-428a-9902-b259b937f84b

Defined in RDXService.dll, which carries the event manifest.

  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB