Microsoft-Windows-Shell-AuthUI

EventTitleChannelSampleRule
5001Logon user interface creation failed.OperationalNN
5002Logon user interface RPC server startup failed.OperationalNN
5003The username/password credential provider failed to enumerate tiles.OperationalNN
5004Autologon failed.OperationalNN
5005The autologon password could not be loaded.OperationalNN
5006The autologon password could not be loaded.OperationalNN
5007The OEM background could not be loaded for resolution DWORD1 x DWORD2.OperationalNN
5008The OEM background Error was loaded but its aspect ratio does not match the …OperationalNN
5009The OEM background Error was not loaded because the file is larger than DWORD1 …OperationalNN
5010The credential provider thread creation failed.OperationalNN
5011User enumeration failed.OperationalNN
5012The first run task for package PackageFullName exceeded the maximum runtime …OperationalNN
5013The autologon setting has been removed because AutoLogonSettingRemovalReason.OperationalNN
15001Common_UserList_TileEnumerationStartDiagnosticNN
15002Common_UserList_TileEnumerationStopDiagnosticNN
15003Common_GetMachineNameStartDiagnosticNN
15004Common_GetMachineNameStopDiagnosticNN
15005Common_GetMachineDomainNameStartDiagnosticNN
15006Common_GetMachineDomainNameStopDiagnosticNN
15007Common_GetBuiltInAdministratorStartDiagnosticNN
15008Common_GetBuiltInAdministratorStopDiagnosticNN
15009Common_GetInSessionUserStartDiagnosticNN
15010Common_GetInSessionUserStopDiagnosticNN
15011Common_GetFriendlyNameStartDiagnosticNN
15012Common_GetFriendlyNameStopDiagnosticNN
15013Common_Tile_FireSubmitEventDiagnosticNN
15014Common_CreateCredentialProvidersStartDiagnosticNN
15015Common_CreateCredentialProvidersStopDiagnosticNN
15016Common_AddCredProviderDiagnosticNN
15017Common_CreateCredProviderThreadStartDiagnosticNN
15018Common_CreateCredProviderThreadStopDiagnosticNN
15019Common_CredProviderThreadProcStartDiagnosticNN
15020Common_CredProviderThreadProcStopDiagnosticNN
15021Common_CredProviderThreadDestroyStartDiagnosticNN
15022Common_CredProviderThreadDestroyStopDiagnosticNN
15023Common_SetUsageScenarioDiagnosticNN
15024Common_SetSerializationDiagnosticNN
15025Common_GetCredentialAtDiagnosticNN
15026Common_GetCredentialCountDiagnosticNN
15027Common_GetFieldDescriptorCountDiagnosticNN
15028Common_Credential_GetUserSidDiagnosticNN
15029Common_SetSelectedDiagnosticNN
15030Common_SetDeSelectedDiagnosticNN
15031Common_GetSerializationDiagnosticNN
15032Common_ReportResultDiagnosticNN
15033Common_RegisterEnumerationStartDiagnosticNN
15034Common_RegisterEnumerationStopDiagnosticNN
15035Common_CreateEnumerationSyncReplyDiagnosticNN
15036Common_StartCredProvsForUsageScenarioDiagnosticNN
25001Logon_ServerCallback_AbortStartDiagnosticNN
25002Logon_ServerCallback_AbortStopDiagnosticNN
25003Logon_ServerCallback_DisplayLockedStartDiagnosticNN
25004Logon_ServerCallback_DisplayLockedStopDiagnosticNN
25005Logon_ServerCallback_DisplayMessageStartDiagnosticNN
25006Logon_ServerCallback_DisplayMessageStopDiagnosticNN
25007Logon_ServerCallback_DisplayRequestCredentialsErrorStartDiagnosticNN
25008Logon_ServerCallback_DisplayRequestCredentialsErrorStopDiagnosticNN
25009Logon_ServerCallback_DisplaySecurityOptionsStartDiagnosticNN
25010Logon_ServerCallback_DisplaySecurityOptionsStopDiagnosticNN
25011Logon_ServerCallback_DisplayStatusStartDiagnosticNN
25012Logon_ServerCallback_DisplayStatusStopDiagnosticNN
25013Logon_ServerCallback_DisplayWelcomeStartDiagnosticNN
25014Logon_ServerCallback_DisplayWelcomeStopDiagnosticNN
25015Logon_ServerCallback_ReportResultStartDiagnosticNN
25016Logon_ServerCallback_ReportResultStopDiagnosticNN
25017Logon_ServerCallback_RequestCredentialsStartDiagnosticNN
25018Logon_ServerCallback_RequestCredentialsStopDiagnosticNN
25019Logon_ServerCallback_ShutdownStartDiagnosticNN
25020Logon_ServerCallback_ShutdownStopDiagnosticNN
25021Logon_ServerCallback_PromptForCredentialsStartDiagnosticNN
25022Logon_ServerCallback_PromptForCredentialsStopDiagnosticNN
25023Logon_LogonFrame_OnSwitchUserStartDiagnosticNN
25024Logon_LogonFrame_OnSwitchUserStopDiagnosticNN
25025Logon_LogonFrame_OnOtherTilesStartDiagnosticNN
25026Logon_LogonFrame_OnOtherTilesStopDiagnosticNN
25027Logon_LogonFrame_OnGetEnumeratedTilesReplyStartDiagnosticNN
25028Logon_LogonFrame_OnGetEnumeratedTilesReplyStopDiagnosticNN
25029Logon_LogonFrame_OnEnumerationSyncReplyStartDiagnosticNN
25030Logon_LogonFrame_OnEnumerationSyncReplyStopDiagnosticNN
25031Logon_LogonFrame_OnSelectCredentialReplyStartDiagnosticNN
25032Logon_LogonFrame_OnSelectCredentialReplyStopDiagnosticNN
25033Logon_LogonFrame_SetBackgroundGraphicsStartDiagnosticNN
25034Logon_LogonFrame_SetBackgroundGraphicsStopDiagnosticNN
25035Logon_LogonFrame_InitializeFrameStartDiagnosticNN
25036Logon_LogonFrame_InitializeFrameStopDiagnosticNN
25037Logon_LogonFrame_CreateStyleParserStartDiagnosticNN
25038Logon_LogonFrame_CreateStyleParserStopDiagnosticNN
25039Logon_LogonFrame_CreateFrameElementStartDiagnosticNN
25040Logon_LogonFrame_CreateFrameElementStopDiagnosticNN
25041Logon_LogonFrame_InitializeUserListsStartDiagnosticNN
25042Logon_LogonFrame_InitializeUserListsStopDiagnosticNN
25043Logon_LogonFrame_BrandingLoadImageStartDiagnosticNN
25044Logon_LogonFrame_BrandingLoadImageStopDiagnosticNN
25047Logon_LogonFrame_InitializeSoftKeyboardStartDiagnosticNN
25048Logon_LogonFrame_InitializeSoftKeyboardStopDiagnosticNN
25049Logon_LogonFrame_WTSRegisterSessionNotificationStartDiagnosticNN
25050Logon_LogonFrame_WTSRegisterSessionNotificationStopDiagnosticNN
25051Logon_AutoLogon_IsSingleUserNoPasswordStartDiagnosticNN
25052Logon_AutoLogon_IsSingleUserNoPasswordStopDiagnosticNN
25053Logon_AutoLogon_IsLocalNoPasswordUserStartDiagnosticNN
25054Logon_AutoLogon_IsSingleUserNoPasswordStop25054DiagnosticNN
25055Logon_ServerStartupStartDiagnosticNN
25056Logon_ServerStartupStopDiagnosticNN
25057Logon_LaunchToReadyForInputStartDiagnosticNN
25058Logon_LaunchToReadyForInputStopDiagnosticNN
25059Logon_CredentialsToExitStartDiagnosticNN
25060Logon_CredentialsToExitStopDiagnosticNN
25061Logon_RequestCredentialsToReadyForCredentialsStartDiagnosticNN
25062Logon_RequestCredentialsToReadyForCredentialsStopDiagnosticNN
25063Logon_LaunchToAnimationCompleteStartDiagnosticNN
25064Logon_LaunchToAnimationCompleteStopDiagnosticNN
25065LogonUI_PerfTrack_UserSwitchingStopDiagnosticNN
25066Logon_RequestCredentialsToCancelAfterEnumerateStopDiagnosticNN
25068Logon_LaunchToCancelAfterResumeStopDiagnosticNN
25072LogonUI_SubmitCredentialToExitStartDiagnosticNN
25073LogonUI_SubmitCredentialToExitStopDiagnosticNN
25074Logon_LogonFrame_OnGetSerializationReplyDiagnosticNN
25075Logon_LogonFrame_OnProviderCredentialsChangedDiagnosticNN
25076Logon_LogonFrame_DisplayStatusMessageDiagnosticNN
25077Logon_LogonFrame_LogonDialogCallbackDiagnosticNN
25078Logon_LogonFrame_DisplayLogonDialogDiagnosticNN
25079Logon_Background_GetBackgroundForUserDiagnosticNN
25080Logon_Background_ShowUserBackgroundDiagnosticNN
25082Logon_AccessPage_LoadBackgroundImageStartDiagnosticNN
25083Logon_AccessPage_LoadBackgroundImageStopDiagnosticNN
25084Logon_AutoLogon_QueryAutoLogon_InfoDiagnosticNN
25085Logon_AutoLogon_IgnoreAutoLogonMode_InfoDiagnosticNN
25087Logon_BSDR_InitializeStartDiagnosticNN
25088Logon_BSDR_InitializeStopDiagnosticNN
25089Logon_BSDR_ShownDiagnosticNN
25090Logon_BSDR_AddApplicationStartDiagnosticNN
25091Logon_BSDR_AddApplicationStopDiagnosticNN
25093Logon_BSDR_RemoveApplicationStartDiagnosticNN
25094Logon_BSDR_RemoveApplicationStopDiagnosticNN
25095LogonUI_SubmitCredentialToExitStop25095DiagnosticNN
25096LogonUI_PerfTrack_LockStopDiagnosticNN
25097Logon_LanguageProfile_SwitchInputMethodsStartDiagnosticNN
25098Logon_LanguageProfile_SwitchInputMethodsStopDiagnosticNN
25099Logon_AccessPage_CancelFirstRunTasksStartDiagnosticNN
25100Logon_AccessPage_CancelFirstRunTasksStopDiagnosticNN
25101Logon_AccessPage_CancelFirstRunTasksDiagnosticNN
25102Logon_AccessPage_TriggerFirstRunTasksStartDiagnosticNN
25103Logon_AccessPage_TriggerFirstRunTasksStopDiagnosticNN
25104Logon_AccessPage_WaitForFirstRunTasksStartDiagnosticNN
25105Logon_AccessPage_WaitForFirstRunTasksStopDiagnosticNN
25106Logon_BackButtonNotificationFlyoutStartDiagnosticNN
25107Logon_BackButtonNotificationFlyoutStopDiagnosticNN
25108Logon_AccessPage_UnlockStartDiagnosticNN
25109Logon_AccessPage_UnlockStopDiagnosticNN
25110Logon_AccessPage_LockStartDiagnosticNN
25111Logon_AccessPage_LockStopDiagnosticNN
25112Logon_AccessPage_LockDiagnosticNN
25113Logon_AccessPage_Camera_ControlCreationStartDiagnosticNN
25114Logon_AccessPage_Camera_ControlCreationStopDiagnosticNN
25115Logon_AccessPage_Camera_ViewfinderInitializationStartDiagnosticNN
25116Logon_AccessPage_Camera_ViewfinderInitializationStopDiagnosticNN
25117Logon_AccessPage_Camera_ActiveDurationStartDiagnosticNN
25118Logon_AccessPage_Camera_ActiveDurationStopDiagnosticNN
25119Logon_AccessPage_Camera_ShutdownDurationStartDiagnosticNN
25120Logon_AccessPage_Camera_ShutdownDurationStopDiagnosticNN
35001CredUI_Prompt_CalledDiagnosticNN
35002CredUI_Dialog_CreatedStartDiagnosticNN
35003CredUI_Dialog_CreatedStopDiagnosticNN
35004CredUI_UserList_TileEnumerationDiagnosticNN
35005CredUI_Dialog_DestroyedDiagnosticNN
35006CredUI_Dialog_DUIInitializeStartDiagnosticNN
35007CredUI_Dialog_DUIInitializeStopDiagnosticNN
35008CredUI_Dialog_LoadStyleSheetStartDiagnosticNN
35009CredUI_Dialog_LoadStyleSheetStopDiagnosticNN
35010CredUI_ModernDialog_CreatedStartDiagnosticNN
35011CredUI_ModernDialog_CreatedStopDiagnosticNN
35012CredUI_ModernDialog_DUIInitializeStartDiagnosticNN
35013CredUI_ModernDialog_DUIInitializeStopDiagnosticNN
35014CredUI_ModernDialog_LoadStyleSheetStartDiagnosticNN
35015CredUI_ModernDialog_LoadStyleSheetStopDiagnosticNN
35016CredUI_EnumerationSyncStopDiagnosticNN
45001Shutdown_ShutdownChoices_UserHasShutdownRightsStartDiagnosticNN
45002Shutdown_ShutdownChoices_UserHasShutdownRightsStopDiagnosticNN
45003Shutdown_ShutdownFlyout_CreateAndShowStartDiagnosticNN
45004Shutdown_ShutdownFlyout_CreateAndShowStopDiagnosticNN
45005Shutdown_ShutdownFlyout_PromptForReasonStartDiagnosticNN
45006Shutdown_ShutdownFlyout_PromptForReasonStopDiagnosticNN
45007Shutdown_ShutdownFlyout_PromptForConfirmationStartDiagnosticNN
45008Shutdown_ShutdownFlyout_PromptForConfirmationStopDiagnosticNN
45009Shutdown_ShutdownFlyout_InitiatePowerTransitionStartDiagnosticNN
45010Shutdown_ShutdownFlyout_InitiatePowerTransitionStopDiagnosticNN
45011Shutdown_SlideToShutDownScreen_InitializeStartDiagnosticNN
45012Shutdown_SlideToShutDownScreen_InitializeStopDiagnosticNN
45013Shutdown_SlideToShutDownScreen_ShowModalStartDiagnosticNN
45014Shutdown_SlideToShutDownScreen_ShowModalStopDiagnosticNN
45015Shutdown_SlideToShutDownScreen_SelfRevealAnimationStartDiagnosticNN
45016Shutdown_SlideToShutDownScreen_SelfRevealAnimationStopDiagnosticNN
45017Shutdown_SlideToShutDownScreen_DismissStartDiagnosticNN
45018Shutdown_SlideToShutDownScreen_DismissStopDiagnosticNN
45019Shutdown_SlideToShutDownScreen_TimeoutDiagnosticNN
55001CredentialProviderUser_EnumerateLogonUsersStartDiagnosticNN
55002CredentialProviderUser_EnumerateLogonUsersStopDiagnosticNN
55003CredentialProviderUser_EnumerateLastLoggedOnUserStartDiagnosticNN
55004CredentialProviderUser_EnumerateLastLoggedOnUserStopDiagnosticNN
55005CredentialProviderUser_EnumerateAutoLogonUserStartDiagnosticNN
55006CredentialProviderUser_EnumerateAutoLogonUserStopDiagnosticNN
55007CredentialProviderUser_EnumerateInSessionUserStartDiagnosticNN
55008CredentialProviderUser_EnumerateInSessionUserStopDiagnosticNN
55009CredentialProviderUser_EnumerateLocalAdminsStartDiagnosticNN
55010CredentialProviderUser_EnumerateLocalAdminsStopDiagnosticNN
55011CredentialProviderUser_Init_CredentialProviderUserArrayStartDiagnosticNN
55012CredentialProviderUser_Init_CredentialProviderUserArrayStopDiagnosticNN
55013CredentialProviderUser_CloneUserArrayDiagnosticNN
55014CredentialProviderUser_SetProviderFilterDiagnosticNN
55015CredentialProviderUser_GetAccountOptionsDiagnosticNN
61001PicturePassword_LaunchEnrollmentUXDiagnosticNN
61002PicturePassword_EnrollmentUXTeachingShownDiagnosticNN
61003PicturePassword_EnrollmentUXImageConfirmationShownDiagnosticNN
61004PicturePassword_EnrollmentUXRelearnShownDiagnosticNN
61005PicturePassword_EnrollmentUXGestureEntryShownDiagnosticNN
61006PicturePassword_EnrollmentUXGestureConfirmationShownDiagnosticNN
61007PicturePassword_EnrollmentUXEnrollmentConfirmationShownDiagnosticNN
61008PicturePassword_EnrollmentUXErrorShownDiagnosticNN
61009PicturePassword_RenderFeedbackStartDiagnosticNN
61010PicturePassword_RenderFeedbackStopDiagnosticNN
61011PicturePassword_FeedbackVisibleStartDiagnosticNN
61012PicturePassword_FeedbackVisibleStopDiagnosticNN
61013PicturePassword_SubmitEnrollmentToSystemStartDiagnosticNN
61014PicturePassword_SubmitEnrollmentToSystemStopDiagnosticNN
61015PicturePassword_SanitizeImageStartDiagnosticNN
61016PicturePassword_SanitizeImageStopDiagnosticNN
61017PicturePassword_EnrollmentHandlerCreateDiagnosticNN
61018PicturePassword_EnrollmentHandlerGetEnrollmentStatusStartDiagnosticNN
61019PicturePassword_EnrollmentHandlerGetEnrollmentStatusStopDiagnosticNN
61020PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStartDiagnosticNN
61021PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStopDiagnosticNN
61022PicturePassword_EnrollmentHandlerSetEnrollmentStartDiagnosticNN
61023PicturePassword_EnrollmentHandlerSetEnrollmentStopDiagnosticNN
61024PicturePassword_EnrollmentHandlerClearEnrollmentStartDiagnosticNN
61025PicturePassword_EnrollmentHandlerClearEnrollmentStopDiagnosticNN
61026PicturePassword_CredentialCreateDiagnosticNN
61027PicturePassword_CredentialSelectedDiagnosticNN
61028PicturePassword_CredentialDeselectedDiagnosticNN
61029PicturePassword_CredentialSetSubmitDataDiagnosticNN
61030PicturePassword_CredentialGetSerializationStartDiagnosticNN
61031PicturePassword_CredentialGetSerializationStopDiagnosticNN
61032PicturePassword_SyncedImageLoadingStartDiagnosticNN
61033PicturePassword_SyncedImageLoadingStopDiagnosticNN
61034PicturePassword_EnrollmentImageSavingForRoamingStartDiagnosticNN
61035PicturePassword_EnrollmentImageSavingForRoamingStopDiagnosticNN
61036PicturePassword_SyncedImageSelectedDiagnosticNN
61037PicturePassword_CheckRoamingImageAvailableDiagnosticNN
64001LockScreenCall_AcceptCallStartDiagnosticNN
64002LockScreenCall_AcceptCallStopDiagnosticNN
64003LockScreenCall_QueueCallStartDiagnosticNN
64004LockScreenCall_QueueCallStopDiagnosticNN
64005LockScreenCall_StartCallStartDiagnosticNN
64006LockScreenCall_StartCallStopDiagnosticNN
64007LockScreenCall_EndCallStartDiagnosticNN
64008LockScreenCall_EndCallStopDiagnosticNN
64009LockScreenCall_EvictCallStartDiagnosticNN
64010LockScreenCall_EvictCallStopDiagnosticNN
64501LockScreenCallBroker_StartCallStartDiagnosticNN
64502LockScreenCallBroker_StartCallStopDiagnosticNN
64503LockScreenCallBroker_EndCallStartDiagnosticNN
64504LockScreenCallBroker_EndCallStopDiagnosticNN
64505LockScreenCallBroker_OnUnlockingStartDiagnosticNN
64506LockScreenCallBroker_OnUnlockingStopDiagnosticNN
64507LockScreenCallBroker_EventSignaledDiagnosticNN
64508LockScreenCallBroker_HostExitedDiagnosticNN
64509LockScreenCallBroker_AccessibleNameChangedDiagnosticNN
64510LockScreenCallBroker_AppExitedDiagnosticNN
65001Booting_Animation_DoPearlSyncStartDiagnosticNN
65002Booting_Animation_DoPearlSyncStopDiagnosticNN
65003Booting_Animation_InitStartDiagnosticNN
65004Booting_Animation_InitStopDiagnosticNN
65005Booting_Animation_TimerProcStartDiagnosticNN
65006Booting_Animation_TimerProcStopDiagnosticNN
65007Booting_Animation_LoadImgStartDiagnosticNN
65008Booting_Animation_LoadImgStopDiagnosticNN
65009Booting_Animation_AnimationCompleteProcStartDiagnosticNN
65010Booting_Animation_AnimationCompleteProcStopDiagnosticNN
65011Booting_Animation_AnimCallbackObjLifetimeStartDiagnosticNN
65012Booting_Animation_AnimCallbackObjLifetimeStopDiagnosticNN
65013Booting_Animation_PlaySoundThreadStartDiagnosticNN
65014Booting_Animation_PlaySoundThreadStopDiagnosticNN
65015Booting_Animation_InitAudioThreadStartDiagnosticNN
65016Booting_Animation_InitAudioThreadStopDiagnosticNN
65017Booting_Animation_AttachToMMCSSStartDiagnosticNN
65018Booting_Animation_AttachToMMCSSStopDiagnosticNN
65019Logon_LogonFrame_InitializeInputIndicatorStartDiagnosticNN
65020Logon_LogonFrame_InitializeInputIndicatorStopDiagnosticNN
65030LockscreenNotifications_NotificationUpdatedStartDiagnosticNN
65031LockscreenNotifications_NotificationUpdatedStopDiagnosticNN
65032LockscreenNotifications_NotificationArrivedStartDiagnosticNN
65033LockscreenNotifications_NotificationArrivedStopDiagnosticNN

Event ID 5001: Logon user interface creation failed.

#
Channel
Operational
Opcode
Info

Description

Logon user interface creation failed. Details: Error.

Message #

Logon user interface creation failed.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5002: Logon user interface RPC server startup failed.

#
Channel
Operational
Opcode
Info

Description

Logon user interface RPC server startup failed. Details: Error.

Message #

Logon user interface RPC server startup failed.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5003: The username/password credential provider failed to enumerate tiles.

#
Channel
Operational
Opcode
Info

Event ID 5004: Autologon failed.

#
Channel
Operational
Opcode
Info

Description

Autologon failed. Details: Error.

Message #

Autologon failed.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5005: The autologon password could not be loaded.

#
Channel
Operational
Opcode
Info

Event ID 5006: The autologon password could not be loaded.

#
Channel
Operational
Opcode
Info

Description

The autologon password could not be loaded. Details: Error.

Message #

The autologon password could not be loaded.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5007: The OEM background could not be loaded for resolution DWORD1 x DWORD2.

#
Channel
Operational
Opcode
Info

Description

The OEM background could not be loaded for resolution DWORD1 x DWORD2. Details: Error.

Message #

The OEM background could not be loaded for resolution %2 x %3.  Details: %1

Fields #

NameDescription
Error UnicodeString
DWORD1 UInt32
DWORD2 UInt32

Event ID 5008: The OEM background Error was loaded but its aspect ratio does not match the primary display resolution DWORD1 x DWORD2.

#
Channel
Operational
Opcode
Info

Message #

The OEM background %1 was loaded but its aspect ratio does not match the primary display resolution %2 x %3.

Fields #

NameDescription
Error UnicodeString
DWORD1 UInt32
DWORD2 UInt32

Event ID 5009: The OEM background Error was not loaded because the file is larger than DWORD1 bytes.

#
Channel
Operational
Opcode
Info

Message #

The OEM background %1 was not loaded because the file is larger than %2 bytes.

Fields #

NameDescription
Error UnicodeString
DWORD1 UInt32

Event ID 5010: The credential provider thread creation failed.

#
Channel
Operational
Opcode
Info

Description

The credential provider thread creation failed. Details: Error.

Message #

The credential provider thread creation failed.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5011: User enumeration failed.

#
Channel
Operational
Opcode
Info

Description

User enumeration failed. Details: Error.

Message #

User enumeration failed.  Details: %1

Fields #

NameDescription
Error UnicodeString

Event ID 5012: The first run task for package PackageFullName exceeded the maximum runtime alotted and has been cancelled.

#
Channel
Operational
Opcode
Info

Message #

The first run task for package %1 exceeded the maximum runtime alotted and has been cancelled.

Fields #

NameDescription
PackageFullName UnicodeString

Event ID 5013: The autologon setting has been removed because AutoLogonSettingRemovalReason.

#
Channel
Operational
Opcode
Info

Message #

The autologon setting has been removed because %1.

Fields #

NameDescription
AutoLogonSettingRemovalReason UInt32

Event ID 15001: Common_UserList_TileEnumerationStart

#
Channel
Diagnostic
Task
Common_UserList_TileEnumeration
Opcode
Start

Event ID 15002: Common_UserList_TileEnumerationStop

#
Channel
Diagnostic
Task
Common_UserList_TileEnumeration
Opcode
Stop

Event ID 15003: Common_GetMachineNameStart

#
Channel
Diagnostic
Task
Common_GetMachineName
Opcode
Start

Event ID 15004: Common_GetMachineNameStop

#
Channel
Diagnostic
Task
Common_GetMachineName
Opcode
Stop

Event ID 15005: Common_GetMachineDomainNameStart

#
Channel
Diagnostic
Task
Common_GetMachineDomainName
Opcode
Start

Event ID 15006: Common_GetMachineDomainNameStop

#
Channel
Diagnostic
Task
Common_GetMachineDomainName
Opcode
Stop

Event ID 15007: Common_GetBuiltInAdministratorStart

#
Channel
Diagnostic
Task
Common_GetBuiltInAdministrator
Opcode
Start

Event ID 15008: Common_GetBuiltInAdministratorStop

#
Channel
Diagnostic
Task
Common_GetBuiltInAdministrator
Opcode
Stop

Event ID 15009: Common_GetInSessionUserStart

#
Channel
Diagnostic
Task
Common_GetInSessionUser
Opcode
Start

Event ID 15010: Common_GetInSessionUserStop

#
Channel
Diagnostic
Task
Common_GetInSessionUser
Opcode
Stop

Event ID 15011: Common_GetFriendlyNameStart

#
Channel
Diagnostic
Task
Common_GetFriendlyName
Opcode
Start

Event ID 15012: Common_GetFriendlyNameStop

#
Channel
Diagnostic
Task
Common_GetFriendlyName
Opcode
Stop

Event ID 15013: Common_Tile_FireSubmitEvent

#
Channel
Diagnostic
Task
Common_Tile_FireSubmitEvent

Event ID 15014: Common_CreateCredentialProvidersStart

#
Channel
Diagnostic
Task
Common_CreateCredentialProviders
Opcode
Start

Event ID 15015: Common_CreateCredentialProvidersStop

#
Channel
Diagnostic
Task
Common_CreateCredentialProviders
Opcode
Stop

Event ID 15016: Common_AddCredProvider

#
Channel
Diagnostic
Task
Common_AddCredProvider

Fields #

NameDescription
message1 UnicodeString

Event ID 15017: Common_CreateCredProviderThreadStart

#
Channel
Diagnostic
Task
Common_CreateCredProviderThread
Opcode
Start

Event ID 15018: Common_CreateCredProviderThreadStop

#
Channel
Diagnostic
Task
Common_CreateCredProviderThread
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 15019: Common_CredProviderThreadProcStart

#
Channel
Diagnostic
Task
Common_CredProviderThreadProc
Opcode
Start

Event ID 15020: Common_CredProviderThreadProcStop

#
Channel
Diagnostic
Task
Common_CredProviderThreadProc
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 15021: Common_CredProviderThreadDestroyStart

#
Channel
Diagnostic
Task
Common_CredProviderThreadDestroy
Opcode
Start

Event ID 15022: Common_CredProviderThreadDestroyStop

#
Channel
Diagnostic
Task
Common_CredProviderThreadDestroy
Opcode
Stop

Event ID 15023: Common_SetUsageScenario

#
Channel
Diagnostic
Task
Common_SetUsageScenario

Fields #

NameDescription
message1 UnicodeString
DWORD1 UInt32

Event ID 15024: Common_SetSerialization

#
Channel
Diagnostic
Task
Common_SetSerialization

Fields #

NameDescription
message1 UnicodeString
message2 UnicodeString

Event ID 15025: Common_GetCredentialAt

#
Channel
Diagnostic
Task
Common_GetCredentialAt

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32

Event ID 15026: Common_GetCredentialCount

#
Channel
Diagnostic
Task
Common_GetCredentialCount

Fields #

NameDescription
message1 UnicodeString
DWORD1 UInt32
DWORD2 UInt32
Boolean1 Boolean

Event ID 15027: Common_GetFieldDescriptorCount

#
Channel
Diagnostic
Task
Common_GetFieldDescriptorCount

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32

Event ID 15028: Common_Credential_GetUserSid

#
Channel
Diagnostic
Task
Common_Credential_GetUserSid

Fields #

NameDescription
DWORD1 UInt32
message1 UnicodeString
message2 UnicodeString

Event ID 15029: Common_SetSelected

#
Channel
Diagnostic
Task
Common_SetSelected

Fields #

NameDescription
DWORD1 UInt32

Event ID 15030: Common_SetDeSelected

#
Channel
Diagnostic
Task
Common_SetDeSelected

Fields #

NameDescription
DWORD1 UInt32

Event ID 15031: Common_GetSerialization

#
Channel
Diagnostic
Task
Common_GetSerialization

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32

Event ID 15032: Common_ReportResult

#
Channel
Diagnostic
Task
Common_ReportResult

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32
DWORD3 UInt32

Event ID 15033: Common_RegisterEnumerationStart

#
Channel
Diagnostic
Task
Common_RegisterEnumeration
Opcode
Start

Event ID 15034: Common_RegisterEnumerationStop

#
Channel
Diagnostic
Task
Common_RegisterEnumeration
Opcode
Stop

Event ID 15035: Common_CreateEnumerationSyncReply

#
Channel
Diagnostic
Task
Common_CreateEnumerationSyncReply

Event ID 15036: Common_StartCredProvsForUsageScenario

#
Channel
Diagnostic
Task
Common_StartCredProvsForUsageScenario

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32

Event ID 25001: Logon_ServerCallback_AbortStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_Abort
Opcode
Start

Event ID 25002: Logon_ServerCallback_AbortStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_Abort
Opcode
Stop

Event ID 25003: Logon_ServerCallback_DisplayLockedStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayLocked
Opcode
Start

Event ID 25004: Logon_ServerCallback_DisplayLockedStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayLocked
Opcode
Stop

Event ID 25005: Logon_ServerCallback_DisplayMessageStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayMessage
Opcode
Start

Event ID 25006: Logon_ServerCallback_DisplayMessageStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayMessage
Opcode
Stop

Event ID 25007: Logon_ServerCallback_DisplayRequestCredentialsErrorStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayRequestCredentialsError
Opcode
Start

Event ID 25008: Logon_ServerCallback_DisplayRequestCredentialsErrorStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayRequestCredentialsError
Opcode
Stop

Event ID 25009: Logon_ServerCallback_DisplaySecurityOptionsStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplaySecurityOptions
Opcode
Start

Event ID 25010: Logon_ServerCallback_DisplaySecurityOptionsStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplaySecurityOptions
Opcode
Stop

Event ID 25011: Logon_ServerCallback_DisplayStatusStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayStatus
Opcode
Start

Event ID 25012: Logon_ServerCallback_DisplayStatusStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayStatus
Opcode
Stop

Event ID 25013: Logon_ServerCallback_DisplayWelcomeStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayWelcome
Opcode
Start

Event ID 25014: Logon_ServerCallback_DisplayWelcomeStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_DisplayWelcome
Opcode
Stop

Event ID 25015: Logon_ServerCallback_ReportResultStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_ReportResult
Opcode
Start

Event ID 25016: Logon_ServerCallback_ReportResultStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_ReportResult
Opcode
Stop

Event ID 25017: Logon_ServerCallback_RequestCredentialsStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_RequestCredentials
Opcode
Start

Event ID 25018: Logon_ServerCallback_RequestCredentialsStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_RequestCredentials
Opcode
Stop

Event ID 25019: Logon_ServerCallback_ShutdownStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_Shutdown
Opcode
Start

Event ID 25020: Logon_ServerCallback_ShutdownStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_Shutdown
Opcode
Stop

Event ID 25021: Logon_ServerCallback_PromptForCredentialsStart

#
Channel
Diagnostic
Task
Logon_ServerCallback_PromptForCredentials
Opcode
Start

Event ID 25022: Logon_ServerCallback_PromptForCredentialsStop

#
Channel
Diagnostic
Task
Logon_ServerCallback_PromptForCredentials
Opcode
Stop

Event ID 25023: Logon_LogonFrame_OnSwitchUserStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnSwitchUser
Opcode
Start

Event ID 25024: Logon_LogonFrame_OnSwitchUserStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnSwitchUser
Opcode
Stop

Event ID 25025: Logon_LogonFrame_OnOtherTilesStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnOtherTiles
Opcode
Start

Event ID 25026: Logon_LogonFrame_OnOtherTilesStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnOtherTiles
Opcode
Stop

Event ID 25027: Logon_LogonFrame_OnGetEnumeratedTilesReplyStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode
Start

Event ID 25028: Logon_LogonFrame_OnGetEnumeratedTilesReplyStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnGetEnumeratedTilesReply
Opcode
Stop

Event ID 25029: Logon_LogonFrame_OnEnumerationSyncReplyStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnEnumerationSyncReply
Opcode
Start

Event ID 25030: Logon_LogonFrame_OnEnumerationSyncReplyStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnEnumerationSyncReply
Opcode
Stop

Event ID 25031: Logon_LogonFrame_OnSelectCredentialReplyStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnSelectCredentialReply
Opcode
Start

Event ID 25032: Logon_LogonFrame_OnSelectCredentialReplyStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnSelectCredentialReply
Opcode
Stop

Event ID 25033: Logon_LogonFrame_SetBackgroundGraphicsStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_SetBackgroundGraphics
Opcode
Start

Event ID 25034: Logon_LogonFrame_SetBackgroundGraphicsStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_SetBackgroundGraphics
Opcode
Stop

Event ID 25035: Logon_LogonFrame_InitializeFrameStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeFrame
Opcode
Start

Event ID 25036: Logon_LogonFrame_InitializeFrameStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeFrame
Opcode
Stop

Event ID 25037: Logon_LogonFrame_CreateStyleParserStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_CreateStyleParser
Opcode
Start

Event ID 25038: Logon_LogonFrame_CreateStyleParserStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_CreateStyleParser
Opcode
Stop

Event ID 25039: Logon_LogonFrame_CreateFrameElementStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_CreateFrameElement
Opcode
Start

Event ID 25040: Logon_LogonFrame_CreateFrameElementStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_CreateFrameElement
Opcode
Stop

Event ID 25041: Logon_LogonFrame_InitializeUserListsStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeUserLists
Opcode
Start

Event ID 25042: Logon_LogonFrame_InitializeUserListsStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeUserLists
Opcode
Stop

Event ID 25043: Logon_LogonFrame_BrandingLoadImageStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_BrandingLoadImage
Opcode
Start

Event ID 25044: Logon_LogonFrame_BrandingLoadImageStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_BrandingLoadImage
Opcode
Stop

Event ID 25047: Logon_LogonFrame_InitializeSoftKeyboardStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeSoftKeyboard
Opcode
Start

Event ID 25048: Logon_LogonFrame_InitializeSoftKeyboardStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeSoftKeyboard
Opcode
Stop

Event ID 25049: Logon_LogonFrame_WTSRegisterSessionNotificationStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_WTSRegisterSessionNotification
Opcode
Start

Event ID 25050: Logon_LogonFrame_WTSRegisterSessionNotificationStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_WTSRegisterSessionNotification
Opcode
Stop

Event ID 25051: Logon_AutoLogon_IsSingleUserNoPasswordStart

#
Channel
Diagnostic
Task
Logon_AutoLogon_IsSingleUserNoPassword
Opcode
Start

Event ID 25052: Logon_AutoLogon_IsSingleUserNoPasswordStop

#
Channel
Diagnostic
Task
Logon_AutoLogon_IsSingleUserNoPassword
Opcode
Stop

Fields #

NameDescription
Boolean1 Boolean

Event ID 25053: Logon_AutoLogon_IsLocalNoPasswordUserStart

#
Channel
Diagnostic
Task
Logon_AutoLogon_IsLocalNoPasswordUser
Opcode
Start

Event ID 25054: Logon_AutoLogon_IsSingleUserNoPasswordStop25054

#
Channel
Diagnostic
Task
Logon_AutoLogon_IsSingleUserNoPassword
Opcode
Stop

Event ID 25055: Logon_ServerStartupStart

#
Channel
Diagnostic
Task
Logon_ServerStartup
Opcode
Start

Event ID 25056: Logon_ServerStartupStop

#
Channel
Diagnostic
Task
Logon_ServerStartup
Opcode
Stop

Event ID 25057: Logon_LaunchToReadyForInputStart

#
Channel
Diagnostic
Task
Logon_LaunchToReadyForInput
Opcode
Start

Event ID 25058: Logon_LaunchToReadyForInputStop

#
Channel
Diagnostic
Task
Logon_LaunchToReadyForInput
Opcode
Stop

Fields #

NameDescription
ReadyForInputScenario UInt32

Event ID 25059: Logon_CredentialsToExitStart

#
Channel
Diagnostic
Task
Logon_CredentialsToExit
Opcode
Start

Event ID 25060: Logon_CredentialsToExitStop

#
Channel
Diagnostic
Task
Logon_CredentialsToExit
Opcode
Stop

Event ID 25061: Logon_RequestCredentialsToReadyForCredentialsStart

#
Channel
Diagnostic
Task
Logon_RequestCredentialsToReadyForCredentials
Opcode
Start

Event ID 25062: Logon_RequestCredentialsToReadyForCredentialsStop

#
Channel
Diagnostic
Task
Logon_RequestCredentialsToReadyForCredentials
Opcode
Stop

Fields #

NameDescription
CredProvUsageScenario UInt32

Event ID 25063: Logon_LaunchToAnimationCompleteStart

#
Channel
Diagnostic
Task
Logon_LaunchToAnimationComplete
Opcode
Start

Event ID 25064: Logon_LaunchToAnimationCompleteStop

#
Channel
Diagnostic
Task
Logon_LaunchToAnimationComplete
Opcode
Stop

Event ID 25065: LogonUI_PerfTrack_UserSwitchingStop

#
Channel
Diagnostic
Task
LogonUI_PerfTrack_UserSwitching
Opcode
Stop

Event ID 25066: Logon_RequestCredentialsToCancelAfterEnumerateStop

#
Channel
Diagnostic
Task
Logon_RequestCredentialsToCancelAfterEnumerate
Opcode
Stop

Fields #

NameDescription
CredProvUsageScenario UInt32

Event ID 25068: Logon_LaunchToCancelAfterResumeStop

#
Channel
Diagnostic
Task
Logon_LaunchToCancelAfterResume
Opcode
Stop

Fields #

NameDescription
ReadyForInputScenario UInt32

Event ID 25072: LogonUI_SubmitCredentialToExitStart

#
Channel
Diagnostic
Task
LogonUI_SubmitCredentialToExit
Opcode
Start

Event ID 25073: LogonUI_SubmitCredentialToExitStop

#
Channel
Diagnostic
Task
LogonUI_SubmitCredentialToExit
Opcode
Stop

Fields #

NameDescription
UserType UInt32
CredProvCount UInt32
IsLogonScenario UInt32
IsFirstLogon UInt32

Event ID 25074: Logon_LogonFrame_OnGetSerializationReply

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnGetSerializationReply

Fields #

NameDescription
DWORD1 UInt32

Event ID 25075: Logon_LogonFrame_OnProviderCredentialsChanged

#
Channel
Diagnostic
Task
Logon_LogonFrame_OnProviderCredentialsChanged

Fields #

NameDescription
Boolean1 Boolean

Event ID 25076: Logon_LogonFrame_DisplayStatusMessage

#
Channel
Diagnostic
Task
Logon_LogonFrame_DisplayStatusMessage

Fields #

NameDescription
message1 UnicodeString

Event ID 25077: Logon_LogonFrame_LogonDialogCallback

#
Channel
Diagnostic
Task
Logon_LogonFrame_LogonDialogCallback

Fields #

NameDescription
DWORD1 UInt32

Event ID 25078: Logon_LogonFrame_DisplayLogonDialog

#
Channel
Diagnostic
Task
Logon_LogonFrame_DisplayLogonDialog

Fields #

NameDescription
DWORD1 UInt32

Event ID 25079: Logon_Background_GetBackgroundForUser

#
Channel
Diagnostic
Task
Logon_Background_GetBackgroundForUser

Fields #

NameDescription
DWORD1 UInt32

Event ID 25080: Logon_Background_ShowUserBackground

#
Channel
Diagnostic
Task
Logon_Background_ShowUserBackground

Fields #

NameDescription
DWORD1 UInt32

Event ID 25082: Logon_AccessPage_LoadBackgroundImageStart

#
Channel
Diagnostic
Task
Logon_AccessPage_LoadBackgroundImage
Opcode
Start

Event ID 25083: Logon_AccessPage_LoadBackgroundImageStop

#
Channel
Diagnostic
Task
Logon_AccessPage_LoadBackgroundImage
Opcode
Stop

Event ID 25084: Logon_AutoLogon_QueryAutoLogon_Info

#
Channel
Diagnostic
Task
Logon_AutoLogon_QueryAutoLogon_Info

Fields #

NameDescription
DWORD1 UInt32
DWORD2 UInt32
DWORD3 UInt32
DWORD4 UInt32
DWORD5 UInt32

Event ID 25085: Logon_AutoLogon_IgnoreAutoLogonMode_Info

#
Channel
Diagnostic
Task
Logon_AutoLogon_IgnoreAutoLogonMode_Info

Event ID 25087: Logon_BSDR_InitializeStart

#
Channel
Diagnostic
Task
Logon_BSDR_Initialize
Opcode
Start

Event ID 25088: Logon_BSDR_InitializeStop

#
Channel
Diagnostic
Task
Logon_BSDR_Initialize
Opcode
Stop

Event ID 25089: Logon_BSDR_Shown

#
Channel
Diagnostic
Task
Logon_BSDR_Shown

Event ID 25090: Logon_BSDR_AddApplicationStart

#
Channel
Diagnostic
Task
Logon_BSDR_AddApplication
Opcode
Start

Fields #

NameDescription
message1 UnicodeString
DWORD1 UInt32

Event ID 25091: Logon_BSDR_AddApplicationStop

#
Channel
Diagnostic
Task
Logon_BSDR_AddApplication
Opcode
Stop

Event ID 25093: Logon_BSDR_RemoveApplicationStart

#
Channel
Diagnostic
Task
Logon_BSDR_RemoveApplication
Opcode
Start

Fields #

NameDescription
DWORD1 UInt32

Event ID 25094: Logon_BSDR_RemoveApplicationStop

#
Channel
Diagnostic
Task
Logon_BSDR_RemoveApplication
Opcode
Stop

Event ID 25095: LogonUI_SubmitCredentialToExitStop25095

#
Channel
Diagnostic
Task
LogonUI_SubmitCredentialToExit
Opcode
Stop

Event ID 25096: LogonUI_PerfTrack_LockStop

#
Channel
Diagnostic
Task
LogonUI_PerfTrack_Lock
Opcode
Stop

Event ID 25097: Logon_LanguageProfile_SwitchInputMethodsStart

#
Channel
Diagnostic
Task
Logon_LanguageProfile_SwitchInputMethods
Opcode
Start

Event ID 25098: Logon_LanguageProfile_SwitchInputMethodsStop

#
Channel
Diagnostic
Task
Logon_LanguageProfile_SwitchInputMethods
Opcode
Stop

Event ID 25099: Logon_AccessPage_CancelFirstRunTasksStart

#
Channel
Diagnostic
Task
Logon_AccessPage_CancelFirstRunTasks
Opcode
Start

Event ID 25100: Logon_AccessPage_CancelFirstRunTasksStop

#
Channel
Diagnostic
Task
Logon_AccessPage_CancelFirstRunTasks
Opcode
Stop

Fields #

NameDescription
OutstandingTasks UInt32
TasksCancelled UInt32

Event ID 25101: Logon_AccessPage_CancelFirstRunTasks

#
Channel
Diagnostic
Task
Logon_AccessPage_CancelFirstRunTasks

Fields #

NameDescription
PackageFullName UnicodeString

Event ID 25102: Logon_AccessPage_TriggerFirstRunTasksStart

#
Channel
Diagnostic
Task
Logon_AccessPage_TriggerFirstRunTasks
Opcode
Start

Event ID 25103: Logon_AccessPage_TriggerFirstRunTasksStop

#
Channel
Diagnostic
Task
Logon_AccessPage_TriggerFirstRunTasks
Opcode
Stop

Event ID 25104: Logon_AccessPage_WaitForFirstRunTasksStart

#
Channel
Diagnostic
Task
Logon_AccessPage_WaitForFirstRunTasks
Opcode
Start

Event ID 25105: Logon_AccessPage_WaitForFirstRunTasksStop

#
Channel
Diagnostic
Task
Logon_AccessPage_WaitForFirstRunTasks
Opcode
Stop

Event ID 25106: Logon_BackButtonNotificationFlyoutStart

#
Channel
Diagnostic
Task
Logon_BackButtonNotificationFlyout
Opcode
Start

Event ID 25107: Logon_BackButtonNotificationFlyoutStop

#
Channel
Diagnostic
Task
Logon_BackButtonNotificationFlyout
Opcode
Stop

Event ID 25108: Logon_AccessPage_UnlockStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Unlock
Opcode
Start

Event ID 25109: Logon_AccessPage_UnlockStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Unlock
Opcode
Stop

Event ID 25110: Logon_AccessPage_LockStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Lock
Opcode
Start

Event ID 25111: Logon_AccessPage_LockStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Lock
Opcode
Stop

Event ID 25112: Logon_AccessPage_Lock

#
Channel
Diagnostic
Task
Logon_AccessPage_Lock

Event ID 25113: Logon_AccessPage_Camera_ControlCreationStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ControlCreation
Opcode
Start

Fields #

NameDescription
InvokeObject UInt32

Event ID 25114: Logon_AccessPage_Camera_ControlCreationStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ControlCreation
Opcode
Stop

Fields #

NameDescription
Result UInt32

Event ID 25115: Logon_AccessPage_Camera_ViewfinderInitializationStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ViewfinderInitialization
Opcode
Start

Event ID 25116: Logon_AccessPage_Camera_ViewfinderInitializationStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ViewfinderInitialization
Opcode
Stop

Fields #

NameDescription
Result UInt32

Event ID 25117: Logon_AccessPage_Camera_ActiveDurationStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ActiveDuration
Opcode
Start

Event ID 25118: Logon_AccessPage_Camera_ActiveDurationStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ActiveDuration
Opcode
Stop

Event ID 25119: Logon_AccessPage_Camera_ShutdownDurationStart

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ShutdownDuration
Opcode
Start

Event ID 25120: Logon_AccessPage_Camera_ShutdownDurationStop

#
Channel
Diagnostic
Task
Logon_AccessPage_Camera_ShutdownDuration
Opcode
Stop

Event ID 35001: CredUI_Prompt_Called

#
Channel
Diagnostic
Task
CredUI_Prompt_Called

Event ID 35002: CredUI_Dialog_CreatedStart

#
Channel
Diagnostic
Task
CredUI_Dialog_Created
Opcode
Start

Event ID 35003: CredUI_Dialog_CreatedStop

#
Channel
Diagnostic
Task
CredUI_Dialog_Created
Opcode
Stop

Event ID 35004: CredUI_UserList_TileEnumeration

#
Channel
Diagnostic
Task
CredUI_UserList_TileEnumeration

Event ID 35005: CredUI_Dialog_Destroyed

#
Channel
Diagnostic
Task
CredUI_Dialog_Destroyed

Event ID 35006: CredUI_Dialog_DUIInitializeStart

#
Channel
Diagnostic
Task
CredUI_Dialog_DUIInitialize
Opcode
Start

Event ID 35007: CredUI_Dialog_DUIInitializeStop

#
Channel
Diagnostic
Task
CredUI_Dialog_DUIInitialize
Opcode
Stop

Event ID 35008: CredUI_Dialog_LoadStyleSheetStart

#
Channel
Diagnostic
Task
CredUI_Dialog_LoadStyleSheet
Opcode
Start

Event ID 35009: CredUI_Dialog_LoadStyleSheetStop

#
Channel
Diagnostic
Task
CredUI_Dialog_LoadStyleSheet
Opcode
Stop

Event ID 35010: CredUI_ModernDialog_CreatedStart

#
Channel
Diagnostic
Task
CredUI_ModernDialog_Created
Opcode
Start

Event ID 35011: CredUI_ModernDialog_CreatedStop

#
Channel
Diagnostic
Task
CredUI_ModernDialog_Created
Opcode
Stop

Event ID 35012: CredUI_ModernDialog_DUIInitializeStart

#
Channel
Diagnostic
Task
CredUI_ModernDialog_DUIInitialize
Opcode
Start

Event ID 35013: CredUI_ModernDialog_DUIInitializeStop

#
Channel
Diagnostic
Task
CredUI_ModernDialog_DUIInitialize
Opcode
Stop

Event ID 35014: CredUI_ModernDialog_LoadStyleSheetStart

#
Channel
Diagnostic
Task
CredUI_ModernDialog_LoadStyleSheet
Opcode
Start

Event ID 35015: CredUI_ModernDialog_LoadStyleSheetStop

#
Channel
Diagnostic
Task
CredUI_ModernDialog_LoadStyleSheet
Opcode
Stop

Event ID 35016: CredUI_EnumerationSyncStop

#
Channel
Diagnostic
Task
CredUI_EnumerationSync
Opcode
Stop

Event ID 45001: Shutdown_ShutdownChoices_UserHasShutdownRightsStart

#
Channel
Diagnostic
Task
Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode
Start

Event ID 45002: Shutdown_ShutdownChoices_UserHasShutdownRightsStop

#
Channel
Diagnostic
Task
Shutdown_ShutdownChoices_UserHasShutdownRights
Opcode
Stop

Event ID 45003: Shutdown_ShutdownFlyout_CreateAndShowStart

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_CreateAndShow
Opcode
Start

Event ID 45004: Shutdown_ShutdownFlyout_CreateAndShowStop

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_CreateAndShow
Opcode
Stop

Event ID 45005: Shutdown_ShutdownFlyout_PromptForReasonStart

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_PromptForReason
Opcode
Start

Event ID 45006: Shutdown_ShutdownFlyout_PromptForReasonStop

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_PromptForReason
Opcode
Stop

Event ID 45007: Shutdown_ShutdownFlyout_PromptForConfirmationStart

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode
Start

Event ID 45008: Shutdown_ShutdownFlyout_PromptForConfirmationStop

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_PromptForConfirmation
Opcode
Stop

Event ID 45009: Shutdown_ShutdownFlyout_InitiatePowerTransitionStart

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode
Start

Event ID 45010: Shutdown_ShutdownFlyout_InitiatePowerTransitionStop

#
Channel
Diagnostic
Task
Shutdown_ShutdownFlyout_InitiatePowerTransition
Opcode
Stop

Event ID 45011: Shutdown_SlideToShutDownScreen_InitializeStart

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_Initialize
Opcode
Start

Event ID 45012: Shutdown_SlideToShutDownScreen_InitializeStop

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_Initialize
Opcode
Stop

Event ID 45013: Shutdown_SlideToShutDownScreen_ShowModalStart

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_ShowModal
Opcode
Start

Fields #

NameDescription
Boolean1 Boolean

Event ID 45014: Shutdown_SlideToShutDownScreen_ShowModalStop

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_ShowModal
Opcode
Stop

Event ID 45015: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStart

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode
Start

Event ID 45016: Shutdown_SlideToShutDownScreen_SelfRevealAnimationStop

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_SelfRevealAnimation
Opcode
Stop

Event ID 45017: Shutdown_SlideToShutDownScreen_DismissStart

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_Dismiss
Opcode
Start

Event ID 45018: Shutdown_SlideToShutDownScreen_DismissStop

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_Dismiss
Opcode
Stop

Event ID 45019: Shutdown_SlideToShutDownScreen_Timeout

#
Channel
Diagnostic
Task
Shutdown_SlideToShutDownScreen_Timeout

Event ID 55001: CredentialProviderUser_EnumerateLogonUsersStart

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLogonUsers
Opcode
Start

Event ID 55002: CredentialProviderUser_EnumerateLogonUsersStop

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLogonUsers
Opcode
Stop

Event ID 55003: CredentialProviderUser_EnumerateLastLoggedOnUserStart

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode
Start

Event ID 55004: CredentialProviderUser_EnumerateLastLoggedOnUserStop

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLastLoggedOnUser
Opcode
Stop

Event ID 55005: CredentialProviderUser_EnumerateAutoLogonUserStart

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateAutoLogonUser
Opcode
Start

Event ID 55006: CredentialProviderUser_EnumerateAutoLogonUserStop

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateAutoLogonUser
Opcode
Stop

Event ID 55007: CredentialProviderUser_EnumerateInSessionUserStart

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateInSessionUser
Opcode
Start

Event ID 55008: CredentialProviderUser_EnumerateInSessionUserStop

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateInSessionUser
Opcode
Stop

Event ID 55009: CredentialProviderUser_EnumerateLocalAdminsStart

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLocalAdmins
Opcode
Start

Event ID 55010: CredentialProviderUser_EnumerateLocalAdminsStop

#
Channel
Diagnostic
Task
CredentialProviderUser_EnumerateLocalAdmins
Opcode
Stop

Event ID 55011: CredentialProviderUser_Init_CredentialProviderUserArrayStart

#
Channel
Diagnostic
Task
CredentialProviderUser_Init_CredentialProviderUserArray
Opcode
Start

Event ID 55012: CredentialProviderUser_Init_CredentialProviderUserArrayStop

#
Channel
Diagnostic
Task
CredentialProviderUser_Init_CredentialProviderUserArray
Opcode
Stop

Event ID 55013: CredentialProviderUser_CloneUserArray

#
Channel
Diagnostic
Task
CredentialProviderUser_CloneUserArray

Fields #

NameDescription
Error UnicodeString
DWORD1 UInt32

Event ID 55014: CredentialProviderUser_SetProviderFilter

#
Channel
Diagnostic
Task
CredentialProviderUser_SetProviderFilter

Fields #

NameDescription
Error UnicodeString
DWORD1 UInt32

Event ID 55015: CredentialProviderUser_GetAccountOptions

#
Channel
Diagnostic
Task
CredentialProviderUser_GetAccountOptions

Fields #

NameDescription
DWORD1 UInt32

Event ID 61001: PicturePassword_LaunchEnrollmentUX

#
Channel
Diagnostic
Task
PicturePassword_LaunchEnrollmentUX

Fields #

NameDescription
DWORD1 UInt32

Event ID 61002: PicturePassword_EnrollmentUXTeachingShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXTeachingShown

Event ID 61003: PicturePassword_EnrollmentUXImageConfirmationShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXImageConfirmationShown

Event ID 61004: PicturePassword_EnrollmentUXRelearnShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXRelearnShown

Event ID 61005: PicturePassword_EnrollmentUXGestureEntryShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXGestureEntryShown

Event ID 61006: PicturePassword_EnrollmentUXGestureConfirmationShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXGestureConfirmationShown

Event ID 61007: PicturePassword_EnrollmentUXEnrollmentConfirmationShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXEnrollmentConfirmationShown

Event ID 61008: PicturePassword_EnrollmentUXErrorShown

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentUXErrorShown

Event ID 61009: PicturePassword_RenderFeedbackStart

#
Channel
Diagnostic
Task
PicturePassword_RenderFeedback
Opcode
Start

Event ID 61010: PicturePassword_RenderFeedbackStop

#
Channel
Diagnostic
Task
PicturePassword_RenderFeedback
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61011: PicturePassword_FeedbackVisibleStart

#
Channel
Diagnostic
Task
PicturePassword_FeedbackVisible
Opcode
Start

Event ID 61012: PicturePassword_FeedbackVisibleStop

#
Channel
Diagnostic
Task
PicturePassword_FeedbackVisible
Opcode
Stop

Event ID 61013: PicturePassword_SubmitEnrollmentToSystemStart

#
Channel
Diagnostic
Task
PicturePassword_SubmitEnrollmentToSystem
Opcode
Start

Event ID 61014: PicturePassword_SubmitEnrollmentToSystemStop

#
Channel
Diagnostic
Task
PicturePassword_SubmitEnrollmentToSystem
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61015: PicturePassword_SanitizeImageStart

#
Channel
Diagnostic
Task
PicturePassword_SanitizeImage
Opcode
Start

Event ID 61016: PicturePassword_SanitizeImageStop

#
Channel
Diagnostic
Task
PicturePassword_SanitizeImage
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61017: PicturePassword_EnrollmentHandlerCreate

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerCreate

Fields #

NameDescription
DWORD1 UInt32

Event ID 61018: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStart

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode
Start

Event ID 61019: PicturePassword_EnrollmentHandlerGetEnrollmentStatusStop

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerGetEnrollmentStatus
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61020: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStart

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode
Start

Event ID 61021: PicturePassword_EnrollmentHandlerGetEnrollmentGesturesStop

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerGetEnrollmentGestures
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61022: PicturePassword_EnrollmentHandlerSetEnrollmentStart

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerSetEnrollment
Opcode
Start

Event ID 61023: PicturePassword_EnrollmentHandlerSetEnrollmentStop

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerSetEnrollment
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61024: PicturePassword_EnrollmentHandlerClearEnrollmentStart

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerClearEnrollment
Opcode
Start

Event ID 61025: PicturePassword_EnrollmentHandlerClearEnrollmentStop

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentHandlerClearEnrollment
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61026: PicturePassword_CredentialCreate

#
Channel
Diagnostic
Task
PicturePassword_CredentialCreate

Fields #

NameDescription
DWORD1 UInt32

Event ID 61027: PicturePassword_CredentialSelected

#
Channel
Diagnostic
Task
PicturePassword_CredentialSelected

Event ID 61028: PicturePassword_CredentialDeselected

#
Channel
Diagnostic
Task
PicturePassword_CredentialDeselected

Event ID 61029: PicturePassword_CredentialSetSubmitData

#
Channel
Diagnostic
Task
PicturePassword_CredentialSetSubmitData

Event ID 61030: PicturePassword_CredentialGetSerializationStart

#
Channel
Diagnostic
Task
PicturePassword_CredentialGetSerialization
Opcode
Start

Event ID 61031: PicturePassword_CredentialGetSerializationStop

#
Channel
Diagnostic
Task
PicturePassword_CredentialGetSerialization
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61032: PicturePassword_SyncedImageLoadingStart

#
Channel
Diagnostic
Task
PicturePassword_SyncedImageLoading
Opcode
Start

Event ID 61033: PicturePassword_SyncedImageLoadingStop

#
Channel
Diagnostic
Task
PicturePassword_SyncedImageLoading
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61034: PicturePassword_EnrollmentImageSavingForRoamingStart

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentImageSavingForRoaming
Opcode
Start

Event ID 61035: PicturePassword_EnrollmentImageSavingForRoamingStop

#
Channel
Diagnostic
Task
PicturePassword_EnrollmentImageSavingForRoaming
Opcode
Stop

Fields #

NameDescription
DWORD1 UInt32

Event ID 61036: PicturePassword_SyncedImageSelected

#
Channel
Diagnostic
Task
PicturePassword_SyncedImageSelected

Event ID 61037: PicturePassword_CheckRoamingImageAvailable

#
Channel
Diagnostic
Task
PicturePassword_CheckRoamingImageAvailable

Fields #

NameDescription
DWORD1 UInt32

Event ID 64001: LockScreenCall_AcceptCallStart

#
Channel
Diagnostic
Task
LockScreenCall_AcceptCall
Opcode
Start

Fields #

NameDescription
message1 UnicodeString
message2 UnicodeString

Event ID 64002: LockScreenCall_AcceptCallStop

#
Channel
Diagnostic
Task
LockScreenCall_AcceptCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64003: LockScreenCall_QueueCallStart

#
Channel
Diagnostic
Task
LockScreenCall_QueueCall
Opcode
Start

Fields #

NameDescription
message1 UnicodeString
message2 UnicodeString

Event ID 64004: LockScreenCall_QueueCallStop

#
Channel
Diagnostic
Task
LockScreenCall_QueueCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64005: LockScreenCall_StartCallStart

#
Channel
Diagnostic
Task
LockScreenCall_StartCall
Opcode
Start

Fields #

NameDescription
guid GUID
message1 UnicodeString
message2 UnicodeString

Event ID 64006: LockScreenCall_StartCallStop

#
Channel
Diagnostic
Task
LockScreenCall_StartCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64007: LockScreenCall_EndCallStart

#
Channel
Diagnostic
Task
LockScreenCall_EndCall
Opcode
Start

Fields #

NameDescription
guid GUID

Event ID 64008: LockScreenCall_EndCallStop

#
Channel
Diagnostic
Task
LockScreenCall_EndCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64009: LockScreenCall_EvictCallStart

#
Channel
Diagnostic
Task
LockScreenCall_EvictCall
Opcode
Start

Fields #

NameDescription
guid GUID

Event ID 64010: LockScreenCall_EvictCallStop

#
Channel
Diagnostic
Task
LockScreenCall_EvictCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64501: LockScreenCallBroker_StartCallStart

#
Channel
Diagnostic
Task
LockScreenCallBroker_StartCall
Opcode
Start

Fields #

NameDescription
guid GUID
message1 UnicodeString
message2 UnicodeString

Event ID 64502: LockScreenCallBroker_StartCallStop

#
Channel
Diagnostic
Task
LockScreenCallBroker_StartCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64503: LockScreenCallBroker_EndCallStart

#
Channel
Diagnostic
Task
LockScreenCallBroker_EndCall
Opcode
Start

Fields #

NameDescription
guid GUID

Event ID 64504: LockScreenCallBroker_EndCallStop

#
Channel
Diagnostic
Task
LockScreenCallBroker_EndCall
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64505: LockScreenCallBroker_OnUnlockingStart

#
Channel
Diagnostic
Task
LockScreenCallBroker_OnUnlocking
Opcode
Start

Fields #

NameDescription
message1 UnicodeString
message2 UnicodeString

Event ID 64506: LockScreenCallBroker_OnUnlockingStop

#
Channel
Diagnostic
Task
LockScreenCallBroker_OnUnlocking
Opcode
Stop

Fields #

NameDescription
HRESULT UInt32

Event ID 64507: LockScreenCallBroker_EventSignaled

#
Channel
Diagnostic
Task
LockScreenCallBroker_EventSignaled

Fields #

NameDescription
guid GUID

Event ID 64508: LockScreenCallBroker_HostExited

#
Channel
Diagnostic
Task
LockScreenCallBroker_HostExited

Fields #

NameDescription
guid GUID

Event ID 64509: LockScreenCallBroker_AccessibleNameChanged

#
Channel
Diagnostic
Task
LockScreenCallBroker_AccessibleNameChanged

Fields #

NameDescription
guid GUID
message UnicodeString

Event ID 64510: LockScreenCallBroker_AppExited

#
Channel
Diagnostic
Task
LockScreenCallBroker_AppExited

Fields #

NameDescription
guid GUID

Event ID 65001: Booting_Animation_DoPearlSyncStart

#
Channel
Diagnostic
Task
Booting_Animation_DoPearlSync
Opcode
Start

Event ID 65002: Booting_Animation_DoPearlSyncStop

#
Channel
Diagnostic
Task
Booting_Animation_DoPearlSync
Opcode
Stop

Event ID 65003: Booting_Animation_InitStart

#
Channel
Diagnostic
Task
Booting_Animation_Init
Opcode
Start

Event ID 65004: Booting_Animation_InitStop

#
Channel
Diagnostic
Task
Booting_Animation_Init
Opcode
Stop

Event ID 65005: Booting_Animation_TimerProcStart

#
Channel
Diagnostic
Task
Booting_Animation_TimerProc
Opcode
Start

Event ID 65006: Booting_Animation_TimerProcStop

#
Channel
Diagnostic
Task
Booting_Animation_TimerProc
Opcode
Stop

Event ID 65007: Booting_Animation_LoadImgStart

#
Channel
Diagnostic
Task
Booting_Animation_LoadImg
Opcode
Start

Event ID 65008: Booting_Animation_LoadImgStop

#
Channel
Diagnostic
Task
Booting_Animation_LoadImg
Opcode
Stop

Event ID 65009: Booting_Animation_AnimationCompleteProcStart

#
Channel
Diagnostic
Task
Booting_Animation_AnimationCompleteProc
Opcode
Start

Event ID 65010: Booting_Animation_AnimationCompleteProcStop

#
Channel
Diagnostic
Task
Booting_Animation_AnimationCompleteProc
Opcode
Stop

Event ID 65011: Booting_Animation_AnimCallbackObjLifetimeStart

#
Channel
Diagnostic
Task
Booting_Animation_AnimCallbackObjLifetime
Opcode
Start

Event ID 65012: Booting_Animation_AnimCallbackObjLifetimeStop

#
Channel
Diagnostic
Task
Booting_Animation_AnimCallbackObjLifetime
Opcode
Stop

Event ID 65013: Booting_Animation_PlaySoundThreadStart

#
Channel
Diagnostic
Task
Booting_Animation_PlaySoundThread
Opcode
Start

Event ID 65014: Booting_Animation_PlaySoundThreadStop

#
Channel
Diagnostic
Task
Booting_Animation_PlaySoundThread
Opcode
Stop

Event ID 65015: Booting_Animation_InitAudioThreadStart

#
Channel
Diagnostic
Task
Booting_Animation_InitAudioThread
Opcode
Start

Event ID 65016: Booting_Animation_InitAudioThreadStop

#
Channel
Diagnostic
Task
Booting_Animation_InitAudioThread
Opcode
Stop

Event ID 65017: Booting_Animation_AttachToMMCSSStart

#
Channel
Diagnostic
Task
Booting_Animation_AttachToMMCSS
Opcode
Start

Event ID 65018: Booting_Animation_AttachToMMCSSStop

#
Channel
Diagnostic
Task
Booting_Animation_AttachToMMCSS
Opcode
Stop

Event ID 65019: Logon_LogonFrame_InitializeInputIndicatorStart

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeInputIndicator
Opcode
Start

Event ID 65020: Logon_LogonFrame_InitializeInputIndicatorStop

#
Channel
Diagnostic
Task
Logon_LogonFrame_InitializeInputIndicator
Opcode
Stop

Event ID 65030: LockscreenNotifications_NotificationUpdatedStart

#
Channel
Diagnostic
Task
LockscreenNotifications_NotificationUpdated
Opcode
Start

Fields #

NameDescription
NotificationType UInt32
Operation UInt32
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
AppId UnicodeString

Event ID 65031: LockscreenNotifications_NotificationUpdatedStop

#
Channel
Diagnostic
Task
LockscreenNotifications_NotificationUpdated
Opcode
Stop

Event ID 65032: LockscreenNotifications_NotificationArrivedStart

#
Channel
Diagnostic
Task
LockscreenNotifications_NotificationArrived
Opcode
Start

Fields #

NameDescription
NotificationType UInt32
Operation UInt32
Known values
%%2456
Open key file.
%%2457
Delete key file.
%%2458
Read persisted key from file.
%%2459
Write persisted key to file.
%%2464
Export of persistent cryptographic key.
%%2465
Import of persistent cryptographic key.
%%2480
Open Key.
%%2481
Create Key.
%%2482
Delete Key.
%%2483
Encrypt.
%%2484
Decrypt.
%%2485
Sign hash.
%%2486
Secret agreement.
%%2487
Domain settings.
%%2488
Local settings.
%%2489
Add provider.
%%2490
Remove provider.
%%2491
Add context.
%%2492
Remove context.
%%2493
Add function.
%%2494
Remove function.
%%2495
Add function provider.
%%2496
Remove function provider.
%%2497
Add function property.
%%2498
Remove function property.
%%2499
Machine key.
%%2500
User key.
%%2501
Key Derivation.
%%2502
Claim Creation.
%%2503
Claim Verification.
AppId UnicodeString

Event ID 65033: LockscreenNotifications_NotificationArrivedStop

#
Channel
Diagnostic
Task
LockscreenNotifications_NotificationArrived
Opcode
Stop

Provenance

ETW provider GUID 63d2bb1d-e39a-41b8-9a3d-52dd06677588

Defined in credprovhost.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB