Microsoft-Windows-TZSync

Event	Title	Channel	Sample	Rule
1	TZSync start	Operational	Y	N
2	TZSync stop	Operational	Y	N
3	Initialization start	Analytic	N	N
4	Initialization completed	Analytic	N	N
5	Conversion start	Analytic	N	N
6	Conversion completed	Analytic	N	N
7	Conversion started for Time Zone: TimeZoneId.	Analytic	N	N
8	Conversion completed for Time Zone: TimeZoneId.	Analytic	N	N
9	Error in initialization task	Operational	N	N
10	Error in conversion for Time Zone: TimeZoneId.	Operational	N	N
11	Error in conversion task	Operational	N	N
12	TZSync error	Operational	N	N

Event ID 1: TZSync start

Channel: Operational
Level: Informational
Opcode: Start

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TZSync",
    "guid": "{3527CB55-1298-49D4-AB94-1243DB0FCAFF}",
    "event_source_name": "",
    "event_id": 1,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 1,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:33.8951708+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 5280,
      "thread_id": 844
    },
    "channel": "Microsoft-Windows-TZSync/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "TZSync start"
}

Event ID 2: TZSync stop

Channel: Operational
Level: Informational
Opcode: Stop

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-TZSync",
    "guid": "{3527CB55-1298-49D4-AB94-1243DB0FCAFF}",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 2,
    "keywords": 4611686018427387904,
    "time_created": "2026-06-13T05:39:35.6299645+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 5280,
      "thread_id": 844
    },
    "channel": "Microsoft-Windows-TZSync/Operational",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {},
  "message": "TZSync stop"
}

Event ID 3: Initialization start

Channel: Analytic
Task: Initializationtask
Opcode: Start

Event ID 4: Initialization completed

Channel: Analytic
Task: Initializationtask
Opcode: Stop

Event ID 5: Conversion start

Channel: Analytic
Task: Conversiontask
Opcode: Start

Event ID 6: Conversion completed

Channel: Analytic
Task: Conversiontask
Opcode: Stop

Event ID 7: Conversion started for Time Zone: TimeZoneId.

Channel: Analytic
Task: Conversiontask
Opcode: Start

Message #

Conversion started for Time Zone: %1

Fields #

Name	Description
`TimeZoneId` UnicodeString

Event ID 8: Conversion completed for Time Zone: TimeZoneId.

Channel: Analytic
Task: Conversiontask
Opcode: Stop

Message #

Conversion completed for Time Zone: %1

Fields #

Name	Description
`TimeZoneId` UnicodeString

Event ID 9: Error in initialization task

Channel: Operational
Task: Initializationtask

Event ID 10: Error in conversion for Time Zone: TimeZoneId.

Channel: Operational
Task: Conversiontask

Message #

Error in conversion for Time Zone: %1

Fields #

Name	Description
`TimeZoneId` UnicodeString

Event ID 11: Error in conversion task

Channel: Operational
Task: Conversiontask

Event ID 12: TZSync error

Channel: Operational
Opcode: Info

Provenance

ETW provider GUID 3527cb55-1298-49d4-ab94-1243db0fcaff

Defined in tzsyncres.dll, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.2161, captured 2026-06-02 — Manifest XML pack, 2.0 MB