detection.wiki

Microsoft-Windows-Shell-LockScreenContent

EventTitleChannelSampleRule
1LockScreenContent_SetupStartDiagnosticNN
2LockScreenContent_SetupStopDiagnosticNN
10LockScreenContent_Repository_InitializeStartDiagnosticNN
11LockScreenContent_Repository_InitializeStopDiagnosticNN
12LockScreenContent_Repository_GetImageStartDiagnosticNN
13LockScreenContent_Repository_GetImageStopDiagnosticNN
20LockScreenContent_Manager_InitializeStartDiagnosticNN
21LockScreenContent_Manager_InitializeStopDiagnosticNN
22LockScreenContent_Manager_PrepareForTransitionStartDiagnosticNN
23LockScreenContent_Manager_PrepareForTransitionStopDiagnosticNN
24LockScreenContent_Manager_StartSlideShowDiagnosticNN
25LockScreenContent_Manager_StopSlideShowDiagnosticNN
26LockScreenContent_Slideshow_SlideshowManager_DestroyedDiagnosticNN
30LockScreenContent_DoLayoutStartDiagnosticNN
31LockScreenContent_DoLayoutStopDiagnosticNN
32LockScreenContent_TimerTickDiagnosticNN
34LockScreenContent_SlideTransitionStartDiagnosticNN
35LockScreenContent_SlideTransitionStopDiagnosticNN
36LockScreenContent_RandomLayoutGeneratedDiagnosticNN
37LockScreenContent_ScheduleAnimation_TransitionStartDiagnosticNN
38LockScreenContent_ScheduleAnimation_TransitionStopDiagnosticNN
39LockScreenContent_ScheduleAnimation_AmbientStartDiagnosticNN
40LockScreenContent_ScheduleAnimation_AmbientStopDiagnosticNN
42LockScreenContent_SlideshowSlideCache_InitializeStartDiagnosticNN
43LockScreenContent_SlideshowSlideCache_InitializeStopDiagnosticNN
44LockScreenContent_SlideshowSlideCache_SetupStartDiagnosticNN
45LockScreenContent_SlideshowSlideCache_SetupStopDiagnosticNN
46LockScreenContent_Repository_DisableConstraintsDiagnosticNN
47LockScreenContent_Bucket_IngestImageItemDiagnosticNN
48LockScreenContent_Bucket_RefreshDiagnosticNN
49LockScreenContent_Repository_InitializeBuckets_RecalculatingBucketsDiagnosticNN
50LockScreenContent_ThumbnailFetchStartDiagnosticNN
51LockScreenContent_ThumbnailFetchStopDiagnosticNN
52LockScreenContent_Bucket_InitializeStartDiagnosticNN
53LockScreenContent_Bucket_InitializeStopDiagnosticNN
54LockScreenContent_Bucket_CreateIItemCollectionStartDiagnosticNN
55LockScreenContent_Bucket_CreateIItemCollectionStopDiagnosticNN
56LockScreenContent_Slide_InitializeStartDiagnosticNN
57LockScreenContent_Slide_InitializeStopDiagnosticNN
58LockScreenContent_Bucket_GenerateAvailableItemsStartDiagnosticNN
59LockScreenContent_Bucket_GenerateAvailableItemsStopDiagnosticNN
60LockScreenContent_Cache_AddSlideToMonitorCacheStartDiagnosticNN
61LockScreenContent_Cache_AddSlideToMonitorCacheStopDiagnosticNN
62LockScreenContent_Repository_InitializeBucketsStartDiagnosticNN
63LockScreenContent_Repository_InitializeBucketsStopDiagnosticNN
64LockScreenContent_Bucket_ImageVerificationDiagnosticNN

Event ID 1: LockScreenContent_SetupStart

#
Channel
Diagnostic
Task
LockScreenContent_Setup
Opcode
Start

Event ID 2: LockScreenContent_SetupStop

#
Channel
Diagnostic
Task
LockScreenContent_Setup
Opcode
Stop

Event ID 10: LockScreenContent_Repository_InitializeStart

#
Channel
Diagnostic
Task
LockScreenContent_Repository_Initialize
Opcode
Start

Event ID 11: LockScreenContent_Repository_InitializeStop

#
Channel
Diagnostic
Task
LockScreenContent_Repository_Initialize
Opcode
Stop

Fields #

NameDescription
ImageCount UInt32
Result UInt32

Event ID 12: LockScreenContent_Repository_GetImageStart

#
Channel
Diagnostic
Task
LockScreenContent_Repository_GetImage
Opcode
Start

Event ID 13: LockScreenContent_Repository_GetImageStop

#
Channel
Diagnostic
Task
LockScreenContent_Repository_GetImage
Opcode
Stop

Fields #

NameDescription
ImagePath UnicodeString
Result UInt32

Event ID 20: LockScreenContent_Manager_InitializeStart

#
Channel
Diagnostic
Task
LockScreenContent_Manager_Initialize
Opcode
Start

Event ID 21: LockScreenContent_Manager_InitializeStop

#
Channel
Diagnostic
Task
LockScreenContent_Manager_Initialize
Opcode
Stop

Event ID 22: LockScreenContent_Manager_PrepareForTransitionStart

#
Channel
Diagnostic
Task
LockScreenContent_Manager_PrepareForTransition
Opcode
Start

Fields #

NameDescription
OnPrimaryMonitor Boolean
Initialized Boolean

Event ID 23: LockScreenContent_Manager_PrepareForTransitionStop

#
Channel
Diagnostic
Task
LockScreenContent_Manager_PrepareForTransition
Opcode
Stop

Fields #

NameDescription
OnPrimaryMonitor Boolean
Layout UInt32
Result UInt32

Event ID 24: LockScreenContent_Manager_StartSlideShow

#
Channel
Diagnostic
Task
LockScreenContent_Manager_StartSlideShow

Event ID 25: LockScreenContent_Manager_StopSlideShow

#
Channel
Diagnostic
Task
LockScreenContent_Manager_StopSlideShow

Event ID 26: LockScreenContent_Slideshow_SlideshowManager_Destroyed

#
Channel
Diagnostic
Task
LockScreenContent_Slideshow_SlideshowManager_Destroyed

Event ID 30: LockScreenContent_DoLayoutStart

#
Channel
Diagnostic
Task
LockScreenContent_DoLayout
Opcode
Start

Fields #

NameDescription
OnPrimaryMonitor Boolean
LayoutChosen UInt32

Event ID 31: LockScreenContent_DoLayoutStop

#
Channel
Diagnostic
Task
LockScreenContent_DoLayout
Opcode
Stop

Fields #

NameDescription
OnPrimaryMonitor Boolean
LayoutChosen UInt32

Event ID 32: LockScreenContent_TimerTick

#
Channel
Diagnostic
Task
LockScreenContent_TimerTick

Fields #

NameDescription
OnPrimaryMonitor Boolean

Event ID 34: LockScreenContent_SlideTransitionStart

#
Channel
Diagnostic
Task
LockScreenContent_SlideTransition
Opcode
Start

Event ID 35: LockScreenContent_SlideTransitionStop

#
Channel
Diagnostic
Task
LockScreenContent_SlideTransition
Opcode
Stop

Event ID 36: LockScreenContent_RandomLayoutGenerated

#
Channel
Diagnostic
Task
LockScreenContent_RandomLayoutGenerated

Fields #

NameDescription
Layout UInt32

Event ID 37: LockScreenContent_ScheduleAnimation_TransitionStart

#
Channel
Diagnostic
Task
LockScreenContent_ScheduleAnimation_Transition
Opcode
Start

Fields #

NameDescription
EnterLayout UInt32
ExitLayout UInt32
Cookie UInt32

Event ID 38: LockScreenContent_ScheduleAnimation_TransitionStop

#
Channel
Diagnostic
Task
LockScreenContent_ScheduleAnimation_Transition
Opcode
Stop

Fields #

NameDescription
EnterLayout UInt32
ExitLayout UInt32
Cookie UInt32

Event ID 39: LockScreenContent_ScheduleAnimation_AmbientStart

#
Channel
Diagnostic
Task
LockScreenContent_ScheduleAnimation_Ambient
Opcode
Start

Fields #

NameDescription
AmbientLayout UInt32
Cookie UInt32

Event ID 40: LockScreenContent_ScheduleAnimation_AmbientStop

#
Channel
Diagnostic
Task
LockScreenContent_ScheduleAnimation_Ambient
Opcode
Stop

Fields #

NameDescription
AmbientLayout UInt32
Cookie UInt32

Event ID 42: LockScreenContent_SlideshowSlideCache_InitializeStart

#
Channel
Diagnostic
Task
LockScreenContent_SlideshowSlideCache_Initialize
Opcode
Start

Event ID 43: LockScreenContent_SlideshowSlideCache_InitializeStop

#
Channel
Diagnostic
Task
LockScreenContent_SlideshowSlideCache_Initialize
Opcode
Stop

Event ID 44: LockScreenContent_SlideshowSlideCache_SetupStart

#
Channel
Diagnostic
Task
LockScreenContent_SlideshowSlideCache_Setup
Opcode
Start

Event ID 45: LockScreenContent_SlideshowSlideCache_SetupStop

#
Channel
Diagnostic
Task
LockScreenContent_SlideshowSlideCache_Setup
Opcode
Stop

Event ID 46: LockScreenContent_Repository_DisableConstraints

#
Channel
Diagnostic
Task
LockScreenContent_Repository_DisableConstraints

Fields #

NameDescription
DualMonitorSourcing Boolean
Reason UInt32

Event ID 47: LockScreenContent_Bucket_IngestImageItem

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_IngestImageItem

Fields #

NameDescription
ImagePath UnicodeString
PossibleLayoutRegions UInt32
Bucket UInt32
ImageWidth UInt32
ImageHeight UInt32
MonitorWidth UInt32
MonitorHeight UInt32

Event ID 48: LockScreenContent_Bucket_Refresh

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_Refresh

Fields #

NameDescription
FullRefresh Boolean
Result UInt32

Event ID 49: LockScreenContent_Repository_InitializeBuckets_RecalculatingBuckets

#
Channel
Diagnostic
Task
LockScreenContent_Repository_InitializeBuckets_RecalculatingBuckets

Fields #

NameDescription
WasInitialized Boolean

Event ID 50: LockScreenContent_ThumbnailFetchStart

#
Channel
Diagnostic
Task
LockScreenContent_ThumbnailFetch
Opcode
Start

Event ID 51: LockScreenContent_ThumbnailFetchStop

#
Channel
Diagnostic
Task
LockScreenContent_ThumbnailFetch
Opcode
Stop

Fields #

NameDescription
Width UInt32
Height UInt32

Event ID 52: LockScreenContent_Bucket_InitializeStart

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_Initialize
Opcode
Start

Event ID 53: LockScreenContent_Bucket_InitializeStop

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_Initialize
Opcode
Stop

Fields #

NameDescription
Result UInt32

Event ID 54: LockScreenContent_Bucket_CreateIItemCollectionStart

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_CreateIItemCollection
Opcode
Start

Event ID 55: LockScreenContent_Bucket_CreateIItemCollectionStop

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_CreateIItemCollection
Opcode
Stop

Event ID 56: LockScreenContent_Slide_InitializeStart

#
Channel
Diagnostic
Task
LockScreenContent_Slide_Initialize
Opcode
Start

Event ID 57: LockScreenContent_Slide_InitializeStop

#
Channel
Diagnostic
Task
LockScreenContent_Slide_Initialize
Opcode
Stop

Fields #

NameDescription
Result UInt32

Event ID 58: LockScreenContent_Bucket_GenerateAvailableItemsStart

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_GenerateAvailableItems
Opcode
Start

Event ID 59: LockScreenContent_Bucket_GenerateAvailableItemsStop

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_GenerateAvailableItems
Opcode
Stop

Fields #

NameDescription
BucketSize UInt32
ValidatedItems UInt32

Event ID 60: LockScreenContent_Cache_AddSlideToMonitorCacheStart

#
Channel
Diagnostic
Task
LockScreenContent_Cache_AddSlideToMonitorCache
Opcode
Start

Event ID 61: LockScreenContent_Cache_AddSlideToMonitorCacheStop

#
Channel
Diagnostic
Task
LockScreenContent_Cache_AddSlideToMonitorCache
Opcode
Stop

Event ID 62: LockScreenContent_Repository_InitializeBucketsStart

#
Channel
Diagnostic
Task
LockScreenContent_Repository_InitializeBuckets
Opcode
Start

Event ID 63: LockScreenContent_Repository_InitializeBucketsStop

#
Channel
Diagnostic
Task
LockScreenContent_Repository_InitializeBuckets
Opcode
Stop

Event ID 64: LockScreenContent_Bucket_ImageVerification

#
Channel
Diagnostic
Task
LockScreenContent_Bucket_ImageVerification

Fields #

NameDescription
MeetsLayoutConstraints Boolean
MeetsTimeConstraints Boolean
MeetsSlideReuseConstraints Boolean

Provenance

ETW provider GUID a3c0d58a-9fe5-4f24-a2ce-e16de8baa0d2

Defined in LockScreenContent.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB