Microsoft-Windows-Subsys-Csr

Event	Title	Channel	Sample	Rule
1	csr:ShutdownProcessesStart	Operational	N	N
2	csr:ShutdownProcessesStop	Operational	N	N
3	csr:ShutdownProcessStart	Operational	N	N
4	csr:ShutdownProcessStop_V1	Operational	N	N

Event ID 1: csr:ShutdownProcessesStart

Channel: Operational
Task: csr:ShutdownProcesses
Opcode: Start

Event ID 2: csr:ShutdownProcessesStop

Channel: Operational
Task: csr:ShutdownProcesses
Opcode: Stop

Event ID 3: csr:ShutdownProcessStart

Channel: Operational
Task: csr:ShutdownProcess
Opcode: Start

Fields #

Name	Description
`ProcessId` UInt32
`Level` UInt32
`Flags` UInt32

Event ID 4: csr:ShutdownProcessStop_V1

Channel: Operational
Task: csr:ShutdownProcess
Opcode: Stop

Fields #

Name	Description
`Status` UInt32	NTSTATUS reference
`ProcessId` UInt32

Provenance

ETW provider GUID e8316a2d-0d94-4f52-85dd-1e15b66c5891

Defined in csrsrv.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB