Microsoft-Windows-StorageSettings
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 1001 | Storage usage breakdown. | Diagnostic | N | N |
| 1002 | Category action. | Diagnostic | N | N |
| 1003 | Volume usage overview. | Diagnostic | N | N |
| 1004 | Device volume count. | Diagnostic | N | N |
| 1005 | Completing initialization. | Diagnostic | N | N |
| 1006 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1007 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1008 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1009 | Iterating cleanup plugins. | Diagnostic | N | N |
| 1010 | Scanning cleanup plugins. | Diagnostic | N | N |
| 1011 | Completing scan. | Diagnostic | N | N |
| 1012 | Completing cleanup. | Diagnostic | N | N |
| 1013 | Purge cleanup plugins. | Diagnostic | N | N |
| 1014 | Purge cleanup plugins. | Diagnostic | N | N |
Event ID 1001: Storage usage breakdown.
#Fields #
| Name | Description |
|---|---|
Version UInt8 | |
StorageType UInt32 | |
DeviceIndex UInt32 | |
DataType UInt32 | |
CategoryId UInt32 | Known values
|
CategorySize UInt64 | |
TotalSize UInt64 | |
FreeSize UInt64 | |
Result Int32 | |
Flag UInt32 | |
CategoryName UnicodeString |
Event ID 1002: Category action.
#Fields #
| Name | Description |
|---|---|
Version UInt8 | |
CategoryExId UInt32 | |
DataType UInt32 | |
CategoryName UnicodeString | |
Result Int32 |
Event ID 1003: Volume usage overview.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
StorageType UInt32 | |
DeviceIndex UInt32 | |
TotalSize UInt64 | |
FreeSize UInt64 | |
FileSystemType UInt32 | |
BusType UInt32 | |
Result Int32 |
Event ID 1004: Device volume count.
#Fields #
| Name | Description |
|---|---|
ActualCount UInt32 | |
ExpectedCount UInt32 | |
Result Int32 |
Event ID 1005: Completing initialization.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DrivePath UnicodeString | |
PluginCount UInt64 | |
PlugInInitialized UInt64 | |
InitTime Double | |
InitCV AnsiString |
Event ID 1006: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
HR Int32 | |
InitCV AnsiString |
Event ID 1007: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
Autorun Boolean | |
ReserveID UInt32 | |
InstantiationTime Double | |
ActualInstantiationTime Double | |
HR Int32 | |
InitCV AnsiString |
Event ID 1008: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
InitCV AnsiString |
Event ID 1009: Iterating cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
Autorun Boolean | |
Name UnicodeString | |
Description UnicodeString | |
InitializationTime Double | |
ActualInitializationTime Double | |
ActualInitTime Double | |
HR Int32 | |
InitCV AnsiString |
Event ID 1010: Scanning cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
Autorun Boolean | |
Name UnicodeString | |
SpaceUsed UInt64 | |
ScanTime Double | |
HR Int32 | |
RefreshOperationType UInt32 | |
CV AnsiString |
Event ID 1011: Completing scan.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DriveLetter UnicodeString | |
TotalScanSize UInt64 | |
ScanTime Double | |
HR Int32 | |
PluginCount UInt64 | |
CreateInstanceFailed UInt32 | |
PluginScanned UInt32 | |
ScanSucceeded UInt32 | |
ScanFailed UInt32 | |
ScanNonZero UInt32 | |
TotalAutoRun UInt32 | |
ShowReserve Boolean | |
StorageReserve AnsiString | |
UnclaimableSpace Int64 | |
ScanCV AnsiString |
Event ID 1012: Completing cleanup.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
DriveLetter UnicodeString | |
TotalPurgeSize UInt64 | |
PurgeTime Double | |
HR Int32 | |
PluginPurged UInt32 | |
PurgeSucceeded UInt32 | |
PurgeFailed UInt32 | |
PurgeNonZero UInt32 | |
TotalBytes UInt64 | |
FreeBytesBefore UInt64 | |
FreeBytesAfter UInt64 | |
UnclaimableSpace UInt64 | |
ReserveAreaInfoAfter AnsiString | |
ScanCV AnsiString | |
PurgeCV AnsiString |
Event ID 1013: Purge cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
Autorun Boolean | |
SpaceToFree UInt64 | |
PurgeCV AnsiString |
Event ID 1014: Purge cleanup plugins.
#Fields #
| Name | Description |
|---|---|
Version UInt32 | |
PlugIn UnicodeString | |
CLSID UnicodeString | |
Autorun Boolean | |
Name UnicodeString | |
SpaceToFree UInt64 | |
SpaceFreed UInt64 | |
CleanupTime Double | |
ActualCleanupTime Double | |
TotalBytes UInt64 | |
FreeBytesBefore UInt64 | |
FreeBytesAfter UInt64 | |
ReserveAreaBefore AnsiString | |
ReserveAreaAfter AnsiString | |
PluginReserveAreaUsage AnsiString | |
HR Int32 | |
PurgeCV AnsiString |
Provenance
ETW provider GUID e934e6dd-62be-55d8-1cc8-416d0039498b
Defined in SettingsHandlers_StorageSense.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB