detection.wiki

Microsoft-Windows-SetupQueue

EventTitleChannelSampleRule
1001Executing command queue entry "Command".AnalyticNN
1002Command queue entry exited with status ErrorCode.AnalyticNN
1003Failed to launch command queue entry with status ErrorCode.AnalyticNN

Event ID 1001: Executing command queue entry "Command".

#
Channel
Analytic
Task
Executecommandqueueentry
Opcode
Start

Message #

Executing command queue entry "%1".

Fields #

NameDescription
Command UnicodeString

Event ID 1002: Command queue entry exited with status ErrorCode.

#
Channel
Analytic
Task
Executecommandqueueentry
Opcode
Stop

Message #

Command queue entry exited with status %1.

Fields #

NameDescription
ErrorCode UInt32

Event ID 1003: Failed to launch command queue entry with status ErrorCode.

#
Channel
Analytic
Task
Executecommandqueueentry
Opcode
Stop

Message #

Failed to launch command queue entry with status %1.

Fields #

NameDescription
ErrorCode UInt32

Provenance

ETW provider GUID a615acb9-d5a4-4738-b561-1df301d207f8

Defined in setupetw.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.4202, captured 2026-06-02 — Manifest XML pack, 2.0 MB