detection.wiki

Microsoft-Windows-Sysprep

EventTitleChannelSampleRule
1001Executing sysprep providers from registry location "BasePath" during Phase.AnalyticNN
1002Finished executing sysprep providers with status ErrorCode.AnalyticNN
2001Calling external function "FunctionName" from "DllName".AnalyticNN
2002External function returned with status DllName.AnalyticNN
3001Loading meta-data file "ActionFilePath".AnalyticNN
3002Loading of meta-data file "ActionFilePath" completed.AnalyticNN
4001Creating action list for component "ComponentName".AnalyticNN
4002Action list for component "ComponentName" created.AnalyticNN
5001Deleting file(s) "FilePattern" from directory "DirectoryPath".AnalyticNN
5002File deletion of "FilePattern" from directory "DirectoryPath" returned with …AnalyticNN
6001Deleting directory "DirectoryPath".AnalyticNN
6002Directory deletion for "DirectoryPath" returned with status ErrorCode.AnalyticNN
7001Starting execution of phase "Phase".AnalyticNN
7002Execution of phase returned status ErrorCode.AnalyticNN

Event ID 1001: Executing sysprep providers from registry location "BasePath" during Phase.

#
Channel
Analytic
Task
RunRegistryDlls
Opcode
Start

Message #

Executing sysprep providers from registry location "%1" during %2.

Fields #

NameDescription
BasePath UnicodeString
Phase UnicodeString

Event ID 1002: Finished executing sysprep providers with status ErrorCode.

#
Channel
Analytic
Task
RunRegistryDlls
Opcode
Stop

Message #

Finished executing sysprep providers with status %1.

Fields #

NameDescription
ErrorCode UInt32

Event ID 2001: Calling external function "FunctionName" from "DllName".

#
Channel
Analytic
Task
CallExternalProviderFunction
Opcode
Start

Message #

Calling external function "%2" from "%1".

Fields #

NameDescription
DllName UnicodeString
FunctionName AnsiString
ErrorCode UInt32

Event ID 2002: External function returned with status DllName.

#
Channel
Analytic
Task
CallExternalProviderFunction
Opcode
Stop

Message #

External function returned with status %1.

Fields #

NameDescription
DllName UnicodeString
FunctionName AnsiString
ErrorCode UInt32

Event ID 3001: Loading meta-data file "ActionFilePath".

#
Channel
Analytic
Task
Loadactionmeta_datafile
Opcode
Start

Message #

Loading meta-data file "%1".

Fields #

NameDescription
ActionFilePath UnicodeString

Event ID 3002: Loading of meta-data file "ActionFilePath" completed.

#
Channel
Analytic
Task
Loadactionmeta_datafile
Opcode
Stop

Message #

Loading of meta-data file "%1" completed.

Fields #

NameDescription
ActionFilePath UnicodeString

Event ID 4001: Creating action list for component "ComponentName".

#
Channel
Analytic
Task
Createlistofactionsforacomponent
Opcode
Start

Message #

Creating action list for component "%1".

Fields #

NameDescription
ComponentName UnicodeString

Event ID 4002: Action list for component "ComponentName" created.

#
Channel
Analytic
Task
Createlistofactionsforacomponent
Opcode
Stop

Message #

Action list for component "%1" created.

Fields #

NameDescription
ComponentName UnicodeString

Event ID 5001: Deleting file(s) "FilePattern" from directory "DirectoryPath".

#
Channel
Analytic
Task
Deletingfile(s)ofapattern
Opcode
Start

Message #

Deleting file(s) "%2" from directory "%1".

Fields #

NameDescription
DirectoryPath UnicodeString
FilePattern UnicodeString

Event ID 5002: File deletion of "FilePattern" from directory "DirectoryPath" returned with status ErrorCode.

#
Channel
Analytic
Task
Deletingfile(s)ofapattern
Opcode
Stop

Message #

File deletion of "%2" from directory "%1" returned with status %3.

Fields #

NameDescription
DirectoryPath UnicodeString
FilePattern UnicodeString
ErrorCode UInt32

Event ID 6001: Deleting directory "DirectoryPath".

#
Channel
Analytic
Task
Deleteadirectory
Opcode
Start

Message #

Deleting directory "%1".

Fields #

NameDescription
DirectoryPath UnicodeString

Event ID 6002: Directory deletion for "DirectoryPath" returned with status ErrorCode.

#
Channel
Analytic
Task
Deleteadirectory
Opcode
Stop

Message #

Directory deletion for "%1" returned with status %2.

Fields #

NameDescription
DirectoryPath UnicodeString
ErrorCode UInt32

Event ID 7001: Starting execution of phase "Phase".

#
Channel
Analytic
Task
Executeanentirephase
Opcode
Start

Message #

Starting execution of phase "%1".

Fields #

NameDescription
Phase UnicodeString

Event ID 7002: Execution of phase returned status ErrorCode.

#
Channel
Analytic
Task
Executeanentirephase
Opcode
Stop

Message #

Execution of phase returned status %1.

Fields #

NameDescription
ErrorCode UInt32

Provenance

ETW provider GUID 75ebc33e-77b8-4ba8-9474-4f4a9db2f5c6

Defined in sysprep.exe, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
  • Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB