Microsoft-Windows-TZSync
12 events across 2 channels
| Event | Title | Channel | Sample |
|---|---|---|---|
| 1 | TZSync start | Operational | Y |
| 2 | TZSync stop | Operational | Y |
| 3 | Initialization start | Analytic | N |
| 4 | Initialization completed | Analytic | N |
| 5 | Conversion start | Analytic | N |
| 6 | Conversion completed | Analytic | N |
| 7 | Conversion started for Time Zone: TimeZoneId. | Analytic | N |
| 8 | Conversion completed for Time Zone: TimeZoneId. | Analytic | N |
| 9 | Error in initialization task | Operational | N |
| 10 | Error in conversion for Time Zone: TimeZoneId. | Operational | N |
| 11 | Error in conversion task | Operational | N |
| 12 | TZSync error | Operational | N |
Event ID 1: TZSync start
#Description
TZSync start.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-TZSync",
"guid": "{3527CB55-1298-49D4-AB94-1243DB0FCAFF}",
"event_source_name": "",
"event_id": 1,
"version": 0,
"level": 4,
"task": 0,
"opcode": 1,
"keywords": 4611686018427387904,
"time_created": "2026-06-13T05:39:33.8951708+00:00",
"event_record_id": 7,
"correlation": {},
"execution": {
"process_id": 5280,
"thread_id": 844
},
"channel": "Microsoft-Windows-TZSync/Operational",
"computer": "telemetry-DC-a.cell-a.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": "TZSync start"
}
Event ID 2: TZSync stop
#Description
TZSync stop.
Message #
Example Event #
{
"system": {
"provider": "Microsoft-Windows-TZSync",
"guid": "{3527CB55-1298-49D4-AB94-1243DB0FCAFF}",
"event_source_name": "",
"event_id": 2,
"version": 0,
"level": 4,
"task": 0,
"opcode": 2,
"keywords": 4611686018427387904,
"time_created": "2026-06-13T05:39:35.6299645+00:00",
"event_record_id": 8,
"correlation": {},
"execution": {
"process_id": 5280,
"thread_id": 844
},
"channel": "Microsoft-Windows-TZSync/Operational",
"computer": "telemetry-DC-a.cell-a.ludus.domain",
"security": {
"user_id": "S-1-5-18"
}
},
"event_data": {},
"message": "TZSync stop"
}
Event ID 7: Conversion started for Time Zone: TimeZoneId.
#Event ID 8: Conversion completed for Time Zone: TimeZoneId.
#Event ID 10: Error in conversion for Time Zone: TimeZoneId.
#Provenance
Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.
ETW provider GUID 3527cb55-1298-49d4-ab94-1243db0fcaff
Defined in tzsyncres.dll, which carries the event manifest.
Observed on:
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.2161, captured 2026-06-02