Microsoft-Windows-Shsvcs

Event	Title	Channel	Sample	Rule
11501	HDSrv_Service_Start	Diagnostic	N	N
11502	HDSrv_Service_StartStop	Diagnostic	N	N
11503	HDSrv_Service_StopStart	Diagnostic	N	N
11504	HDSrv_Service_Stop	Diagnostic	N	N
11505	HDSrv_Volume_Arrived_UpdatedStart	Diagnostic	N	N
11506	HDSrv_Volume_Arrived_UpdatedStop	Diagnostic	N	N
11507	HDSrv_Volume_RemovedStart	Diagnostic	N	N
11508	HDSrv_Volume_RemovedStop	Diagnostic	N	N
11509	HDSrv_NonVolume_NotifyShellStart	Diagnostic	N	N
11510	HDSrv_NonVolume_NotifyShellStop	Diagnostic	N	N
11511	HDSrv_ProcessInterfaceCallbackStart	Diagnostic	N	N
11512	HDSrv_ProcessInterfaceCallbackStop	Diagnostic	N	N
11513	HDSrv_CreateSafeFileHandleStart	Diagnostic	N	N
11514	HDSrv_CreateSafeFileHandleStop	Diagnostic	N	N

Event ID 11501: HDSrv_Service_Start

Channel: Diagnostic
Task: HDSrv_Service_Start
Opcode: Start

Event ID 11502: HDSrv_Service_StartStop

Channel: Diagnostic
Task: HDSrv_Service_Start
Opcode: Stop

Event ID 11503: HDSrv_Service_StopStart

Channel: Diagnostic
Task: HDSrv_Service_Stop
Opcode: Start

Event ID 11504: HDSrv_Service_Stop

Channel: Diagnostic
Task: HDSrv_Service_Stop
Opcode: Stop

Event ID 11505: HDSrv_Volume_Arrived_UpdatedStart

Channel: Diagnostic
Task: HDSrv_Volume_Arrived_Updated
Opcode: Start

Fields #

Name	Description
`ContainerIdentifier` UnicodeString
`DeviceIdentifier` UnicodeString

Event ID 11506: HDSrv_Volume_Arrived_UpdatedStop

Channel: Diagnostic
Task: HDSrv_Volume_Arrived_Updated
Opcode: Stop

Event ID 11507: HDSrv_Volume_RemovedStart

Channel: Diagnostic
Task: HDSrv_Volume_Removed
Opcode: Start

Fields #

Name	Description
`ContainerIdentifier` UnicodeString
`DeviceIdentifier` UnicodeString

Event ID 11508: HDSrv_Volume_RemovedStop

Channel: Diagnostic
Task: HDSrv_Volume_Removed
Opcode: Stop

Event ID 11509: HDSrv_NonVolume_NotifyShellStart

Channel: Diagnostic
Task: HDSrv_NonVolume_NotifyShell
Opcode: Start

Fields #

Name	Description
`ContainerIdentifier` UnicodeString
`DeviceIdentifier` UnicodeString

Event ID 11510: HDSrv_NonVolume_NotifyShellStop

Channel: Diagnostic
Task: HDSrv_NonVolume_NotifyShell
Opcode: Stop

Event ID 11511: HDSrv_ProcessInterfaceCallbackStart

Channel: Diagnostic
Task: HDSrv_ProcessInterfaceCallback
Opcode: Start

Fields #

Name	Description
`ContainerIdentifier` UnicodeString
`DeviceIdentifier` UnicodeString

Event ID 11512: HDSrv_ProcessInterfaceCallbackStop

Channel: Diagnostic
Task: HDSrv_ProcessInterfaceCallback
Opcode: Stop

Event ID 11513: HDSrv_CreateSafeFileHandleStart

Channel: Diagnostic
Task: HDSrv_CreateSafeFileHandle
Opcode: Start

Fields #

Name	Description
`FileName` UnicodeString
`DesiredAccess` UInt32	Process access rights reference

Event ID 11514: HDSrv_CreateSafeFileHandleStop

Channel: Diagnostic
Task: HDSrv_CreateSafeFileHandle
Opcode: Stop

Provenance

ETW provider GUID 059c3e04-5535-4929-85e1-93030e78f47b

Defined in shsvcs.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB