Microsoft-Windows-SetupCl
Event ID 1: SetupCl statistic (Name): Description = Statistic.
#Event ID 2: SourceFunction@SourceLine : Message.
#Event ID 3: SourceFunction@SourceLine : Message.
#Event ID 4: SetupCl has started processing the registry to update SIDs and file paths (as necessary).
#Event ID 5: SetupCl has finished processing the registry to update SIDs and file paths (as necessary).
#Event ID 6: SetupCl has started processing the file system to update SIDs.
#Event ID 7: SetupCl has finished processing the file system to update SIDs.
#Event ID 8: SetupCl has started updating disk signatures.
#Event ID 9: SetupCl has finished updating disk signatures.
#Event ID 10: SetupCl has started processing system registry hives.
#Event ID 11: SetupCl has finished processing system registry hives.
#Event ID 12: SetupCl has started processing system registry hive: HiveName.
#Event ID 13: SetupCl has finished processing system registry hive: HiveName.
#Event ID 14: SetupCl has started processing user profile hives.
#Event ID 15: SetupCl has finished processing user profile hives.
#Event ID 16: SetupCl will replace all instances of SID: [SID].
#Event ID 18: SetupCl will replace all instances of path: [Path].
#Event ID 19: SetupCl will rewrite the old path to: [Path].
#Event ID 20: SetupCl has started retargeting symbolic links and directory junctions.
#Event ID 21: SetupCl has finished retargeting symbolic links and directory junctions.
#Event ID 22: Error: Error (status = 0xMessage).
#Message #
Fields #
| Name | Description |
|---|---|
Message UnicodeString | |
Status HexInt32 | NTSTATUS reference |
Event ID 23: SetupCl has started extending a partition.
#Event ID 24: SetupCl has finished extending a partition.
#Event ID 25: SetupCl will extend the following partition: [Path].
#Event ID 26: SourceFunction@SourceLine : Message.
#Event ID 27: SetupCl has started executing upgrade hive updates.
#Event ID 28: SetupCl has finished executing upgrade hive updates.
#Event ID 29: SetupCl has started executing request.
#Event ID 30: SetupCl has finished executing request.
#Provenance
ETW provider GUID 75ebc33e-d017-4d0f-93ab-0b4f86579164
Defined in setupcl.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB